Analysis
- max time kernel
124s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_5cf0464e2709581d76d7f480ddd171b4_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_5cf0464e2709581d76d7f480ddd171b4_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_5cf0464e2709581d76d7f480ddd171b4_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260729-gc1ctaed34
- SHA256 0327ba0e87798948236afe535e539160e5abb4e4a7a7be241479534f6cecb107
- MD5 5cf0464e2709581d76d7f480ddd171b4
- SHA1 f0e6e390f66d19d7ab7f849ce8c9c62e67464d0a
- SHA512 0b4ca053313c176f148e5e91c9b1fe242f9c260d40df9b119c337c5f172dd3d606f7947f5ae6145b04394a3b05042e447850c7a2a98e4a3df5ec740244028472
- SSDEEP 12288:wU5rCOTeiDvtoPCFIv41oqRB95pNZ+3/v+I9hUG2VA:wUQOJDvtoPCFIkrZ5pNGEA
- TLSH T1C2E4E12177D88532E5FB037859B5E6614E7EBD32A722D6CF6B8011AE09B1BC0D631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5868 EAC.tmp 3348 F77.tmp 5888 11E8.tmp 6040 137E.tmp 4756 1582.tmp 5256 169B.tmp 5532 17E3.tmp 3480 18DD.tmp 4220 1A25.tmp 4732 1B5E.tmp 3380 1C48.tmp 5616 1D33.tmp 376 1E3C.tmp 2204 1F94.tmp 4736 20CD.tmp 5668 21E6.tmp 5388 235D.tmp 1568 2486.tmp 4640 25BE.tmp 808 26C8.tmp 2940 2800.tmp 5096 2958.tmp 5924 2AA0.tmp 2152 2BE8.tmp 1376 2D30.tmp 1868 2E88.tmp 2844 2FA1.tmp 1312 3147.tmp 2756 3261.tmp 820 3389.tmp 5468 3493.tmp 2452 358D.tmp 4284 3704.tmp 5996 37DF.tmp 4500 386B.tmp 4644 3917.tmp 840 3A02.tmp 2664 3ABD.tmp 5332 3BA8.tmp 4716 3C34.tmp 3976 3CF0.tmp 4800 3DDA.tmp 920 3E96.tmp 5348 3F61.tmp 5724 404B.tmp 4212 40E7.tmp 6088 41C2.tmp 4860 428D.tmp 1360 4349.tmp 2424 43C6.tmp 2968 4452.tmp 1276 44DF.tmp 3372 458B.tmp 4480 4637.tmp 4280 46B4.tmp 444 4750.tmp 4072 480B.tmp 6100 4888.tmp 5708 4915.tmp 1764 49E0.tmp 4156 4A4E.tmp 2592 4AEA.tmp 5280 4B76.tmp 5136 4C03.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B55C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D44E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E67E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6335.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B183.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 5868 1196 2026-07-29_5cf0464e2709581d76d7f480ddd171b4_elex_mafia_stealc_tofsee.exe 89 PID 5868 wrote to memory of 3348 5868 EAC.tmp 90 PID 3348 wrote to memory of 5888 3348 F77.tmp 91 PID 5888 wrote to memory of 6040 5888 11E8.tmp 92 PID 6040 wrote to memory of 4756 6040 137E.tmp 93 PID 4756 wrote to memory of 5256 4756 1582.tmp 94 PID 5256 wrote to memory of 5532 5256 169B.tmp 95 PID 5532 wrote to memory of 3480 5532 17E3.tmp 96 PID 3480 wrote to memory of 4220 3480 18DD.tmp 97 PID 4220 wrote to memory of 4732 4220 1A25.tmp 98 PID 4732 wrote to memory of 3380 4732 1B5E.tmp 99 PID 3380 wrote to memory of 5616 3380 1C48.tmp 100 PID 5616 wrote to memory of 376 5616 1D33.tmp 101 PID 376 wrote to memory of 2204 376 1E3C.tmp 102 PID 2204 wrote to memory of 4736 2204 1F94.tmp 103 PID 4736 wrote to memory of 5668 4736 20CD.tmp 104 PID 5668 wrote to memory of 5388 5668 21E6.tmp 105 PID 5388 wrote to memory of 1568 5388 235D.tmp 106 PID 1568 wrote to memory of 4640 1568 2486.tmp 107 PID 4640 wrote to memory of 808 4640 25BE.tmp 108 PID 808 wrote to memory of 2940 808 26C8.tmp 109 PID 2940 wrote to memory of 5096 2940 2800.tmp 110 PID 5096 wrote to memory of 5924 5096 2958.tmp 111 PID 5924 wrote to memory of 2152 5924 2AA0.tmp 112 PID 2152 wrote to memory of 1376 2152 2BE8.tmp 113 PID 1376 wrote to memory of 1868 1376 2D30.tmp 114 PID 1868 wrote to memory of 2844 1868 2E88.tmp 115 PID 2844 wrote to memory of 1312 2844 2FA1.tmp 116 PID 1312 wrote to memory of 2756 1312 3147.tmp 117 PID 2756 wrote to memory of 820 2756 3261.tmp 118 PID 820 wrote to memory of 5468 820 3389.tmp 119 PID 5468 wrote to memory of 2452 5468 3493.tmp 120 PID 2452 wrote to memory of 4284 2452 358D.tmp 121 PID 4284 wrote to memory of 5996 4284 3704.tmp 122 PID 5996 wrote to memory of 4500 5996 37DF.tmp 123 PID 4500 wrote to memory of 4644 4500 386B.tmp 124 PID 4644 wrote to memory of 840 4644 3917.tmp 125 PID 840 wrote to memory of 2664 840 3A02.tmp 126 PID 2664 wrote to memory of 5332 2664 3ABD.tmp 127 PID 5332 wrote to memory of 4716 5332 3BA8.tmp 128 PID 4716 wrote to memory of 3976 4716 3C34.tmp 129 PID 3976 wrote to memory of 4800 3976 3CF0.tmp 130 PID 4800 wrote to memory of 920 4800 3DDA.tmp 131 PID 920 wrote to memory of 5348 920 3E96.tmp 132 PID 5348 wrote to memory of 5724 5348 3F61.tmp 133 PID 5724 wrote to memory of 4212 5724 404B.tmp 134 PID 4212 wrote to memory of 6088 4212 40E7.tmp 135 PID 6088 wrote to memory of 4860 6088 41C2.tmp 136 PID 4860 wrote to memory of 1360 4860 428D.tmp 137 PID 1360 wrote to memory of 2424 1360 4349.tmp 138 PID 2424 wrote to memory of 2968 2424 43C6.tmp 139 PID 2968 wrote to memory of 1276 2968 4452.tmp 140 PID 1276 wrote to memory of 3372 1276 44DF.tmp 141 PID 3372 wrote to memory of 4480 3372 458B.tmp 142 PID 4480 wrote to memory of 4280 4480 4637.tmp 143 PID 4280 wrote to memory of 444 4280 46B4.tmp 144 PID 444 wrote to memory of 4072 444 4750.tmp 145 PID 4072 wrote to memory of 6100 4072 480B.tmp 146 PID 6100 wrote to memory of 5708 6100 4888.tmp 147 PID 5708 wrote to memory of 1764 5708 4915.tmp 148 PID 1764 wrote to memory of 4156 1764 49E0.tmp 149 PID 4156 wrote to memory of 2592 4156 4A4E.tmp 150 PID 2592 wrote to memory of 5280 2592 4AEA.tmp 151 PID 5280 wrote to memory of 5136 5280 4B76.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_5cf0464e2709581d76d7f480ddd171b4_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_5cf0464e2709581d76d7f480ddd171b4_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\11E8.tmp"C:\Users\Admin\AppData\Local\Temp\11E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\1582.tmp"C:\Users\Admin\AppData\Local\Temp\1582.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\18DD.tmp"C:\Users\Admin\AppData\Local\Temp\18DD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\1D33.tmp"C:\Users\Admin\AppData\Local\Temp\1D33.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\1F94.tmp"C:\Users\Admin\AppData\Local\Temp\1F94.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\2486.tmp"C:\Users\Admin\AppData\Local\Temp\2486.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\25BE.tmp"C:\Users\Admin\AppData\Local\Temp\25BE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\386B.tmp"C:\Users\Admin\AppData\Local\Temp\386B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\3A02.tmp"C:\Users\Admin\AppData\Local\Temp\3A02.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\41C2.tmp"C:\Users\Admin\AppData\Local\Temp\41C2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4452.tmp"C:\Users\Admin\AppData\Local\Temp\4452.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\49E0.tmp"C:\Users\Admin\AppData\Local\Temp\49E0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\4B76.tmp"C:\Users\Admin\AppData\Local\Temp\4B76.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"65⤵
- Executes dropped EXE
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"66⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"67⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"68⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\4E36.tmp"C:\Users\Admin\AppData\Local\Temp\4E36.tmp"69⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"70⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"71⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"72⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\502A.tmp"C:\Users\Admin\AppData\Local\Temp\502A.tmp"73⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\50C6.tmp"C:\Users\Admin\AppData\Local\Temp\50C6.tmp"74⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\5143.tmp"C:\Users\Admin\AppData\Local\Temp\5143.tmp"75⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\51C0.tmp"C:\Users\Admin\AppData\Local\Temp\51C0.tmp"76⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\524C.tmp"C:\Users\Admin\AppData\Local\Temp\524C.tmp"77⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"78⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"79⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\53D3.tmp"C:\Users\Admin\AppData\Local\Temp\53D3.tmp"80⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"81⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\54FC.tmp"C:\Users\Admin\AppData\Local\Temp\54FC.tmp"82⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5589.tmp"C:\Users\Admin\AppData\Local\Temp\5589.tmp"83⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\5615.tmp"C:\Users\Admin\AppData\Local\Temp\5615.tmp"84⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"85⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"86⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"87⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"88⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\58D4.tmp"C:\Users\Admin\AppData\Local\Temp\58D4.tmp"89⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"90⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"91⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"92⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5B07.tmp"C:\Users\Admin\AppData\Local\Temp\5B07.tmp"93⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"94⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\5C01.tmp"C:\Users\Admin\AppData\Local\Temp\5C01.tmp"95⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"96⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5D39.tmp"C:\Users\Admin\AppData\Local\Temp\5D39.tmp"97⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"98⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\5E33.tmp"C:\Users\Admin\AppData\Local\Temp\5E33.tmp"99⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"100⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"102⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6056.tmp"C:\Users\Admin\AppData\Local\Temp\6056.tmp"103⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"104⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"105⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"106⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"107⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6335.tmp"C:\Users\Admin\AppData\Local\Temp\6335.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\63C1.tmp"C:\Users\Admin\AppData\Local\Temp\63C1.tmp"109⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"111⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"112⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"113⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"114⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"116⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"117⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"118⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\695F.tmp"C:\Users\Admin\AppData\Local\Temp\695F.tmp"119⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"120⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\6A78.tmp"C:\Users\Admin\AppData\Local\Temp\6A78.tmp"121⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\6AF5.tmp"C:\Users\Admin\AppData\Local\Temp\6AF5.tmp"122⤵PID:260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-