Analysis
- max time kernel
150s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_3ba869f635422534752b15cedf31c041_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_3ba869f635422534752b15cedf31c041_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_3ba869f635422534752b15cedf31c041_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260511-me35daav3j
- SHA256 e486639e4979cae4f6fea3deb37a9eb58dbd2993a9609546b2ffd600f698cd02
- MD5 3ba869f635422534752b15cedf31c041
- SHA1 2e0e03f7685637515f05d3b3b362be1ad8bc6622
- SHA512 db0d56ce365723b0d40982a8b98559c0d6cecfed262bd6b09d8d6a73918a9350af2cf61b32d17a2c261de75de151df8a65291d2d9961b632455dbc5f5cca538c
- SSDEEP 12288:HU5rCOTeiJPoumyTlIho3Y4CeoQSji5SybrHZvwUI7GNZ:HUQOJJQuz+u3Y4mVi5Sy35vwUiGN
- TLSH T110B4F125B541C032E6D212714EE6EBB2597A7C356B22A4C77B90773EAEB02D2D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2464 CE1D.tmp 2688 CE7B.tmp 912 CEC9.tmp 5112 CF94.tmp 408 D031.tmp 4480 D09E.tmp 3188 D169.tmp 5504 D1F6.tmp 4120 D263.tmp 4660 D32E.tmp 5880 D38C.tmp 4676 D438.tmp 5284 D4D4.tmp 2920 D580.tmp 2004 D5ED.tmp 2196 D67A.tmp 848 D6F7.tmp 4304 D793.tmp 5460 D801.tmp 3416 D8BC.tmp 1168 D92A.tmp 2060 D997.tmp 656 DA24.tmp 6064 DAB0.tmp 2728 DB3D.tmp 444 DBC9.tmp 3924 DC66.tmp 5588 DCF2.tmp 3556 DD7F.tmp 4140 DDEC.tmp 3184 DEA8.tmp 5556 DF44.tmp 4560 DFB1.tmp 2112 E02E.tmp 5964 E09C.tmp 4184 E0EA.tmp 3920 E157.tmp 3392 E1A5.tmp 3572 E222.tmp 3428 E271.tmp 3992 E2BF.tmp 5432 E30D.tmp 3524 E35B.tmp 5788 E3A9.tmp 5372 E3F7.tmp 5952 E445.tmp 4640 E493.tmp 1660 E4E2.tmp 1500 E530.tmp 224 E57E.tmp 2428 E5FB.tmp 228 E659.tmp 3108 E6A7.tmp 2320 E6F5.tmp 580 E753.tmp 4408 E7A1.tmp 1624 E7EF.tmp 4704 E83D.tmp 5696 E88B.tmp 5508 E8D9.tmp 2948 E927.tmp 5792 E975.tmp 3276 E9C4.tmp 3240 EA12.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 163D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B36D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 971B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F30B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 631A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4234.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2464 1048 2026-05-11_3ba869f635422534752b15cedf31c041_elex_mafia_stealc_tofsee.exe 78 PID 2464 wrote to memory of 2688 2464 CE1D.tmp 79 PID 2688 wrote to memory of 912 2688 CE7B.tmp 80 PID 912 wrote to memory of 5112 912 CEC9.tmp 81 PID 5112 wrote to memory of 408 5112 CF94.tmp 82 PID 408 wrote to memory of 4480 408 D031.tmp 83 PID 4480 wrote to memory of 3188 4480 D09E.tmp 84 PID 3188 wrote to memory of 5504 3188 D169.tmp 85 PID 5504 wrote to memory of 4120 5504 D1F6.tmp 86 PID 4120 wrote to memory of 4660 4120 D263.tmp 87 PID 4660 wrote to memory of 5880 4660 D32E.tmp 88 PID 5880 wrote to memory of 4676 5880 D38C.tmp 89 PID 4676 wrote to memory of 5284 4676 D438.tmp 90 PID 5284 wrote to memory of 2920 5284 D4D4.tmp 91 PID 2920 wrote to memory of 2004 2920 D580.tmp 92 PID 2004 wrote to memory of 2196 2004 D5ED.tmp 93 PID 2196 wrote to memory of 848 2196 D67A.tmp 94 PID 848 wrote to memory of 4304 848 D6F7.tmp 95 PID 4304 wrote to memory of 5460 4304 D793.tmp 96 PID 5460 wrote to memory of 3416 5460 D801.tmp 97 PID 3416 wrote to memory of 1168 3416 D8BC.tmp 98 PID 1168 wrote to memory of 2060 1168 D92A.tmp 99 PID 2060 wrote to memory of 656 2060 D997.tmp 100 PID 656 wrote to memory of 6064 656 DA24.tmp 101 PID 6064 wrote to memory of 2728 6064 DAB0.tmp 102 PID 2728 wrote to memory of 444 2728 DB3D.tmp 103 PID 444 wrote to memory of 3924 444 DBC9.tmp 104 PID 3924 wrote to memory of 5588 3924 DC66.tmp 105 PID 5588 wrote to memory of 3556 5588 DCF2.tmp 106 PID 3556 wrote to memory of 4140 3556 DD7F.tmp 107 PID 4140 wrote to memory of 3184 4140 DDEC.tmp 108 PID 3184 wrote to memory of 5556 3184 DEA8.tmp 109 PID 5556 wrote to memory of 4560 5556 DF44.tmp 110 PID 4560 wrote to memory of 2112 4560 DFB1.tmp 111 PID 2112 wrote to memory of 5964 2112 E02E.tmp 112 PID 5964 wrote to memory of 4184 5964 E09C.tmp 113 PID 4184 wrote to memory of 3920 4184 E0EA.tmp 114 PID 3920 wrote to memory of 3392 3920 E157.tmp 115 PID 3392 wrote to memory of 3572 3392 E1A5.tmp 116 PID 3572 wrote to memory of 3428 3572 E222.tmp 117 PID 3428 wrote to memory of 3992 3428 E271.tmp 118 PID 3992 wrote to memory of 5432 3992 E2BF.tmp 119 PID 5432 wrote to memory of 3524 5432 E30D.tmp 120 PID 3524 wrote to memory of 5788 3524 E35B.tmp 121 PID 5788 wrote to memory of 5372 5788 E3A9.tmp 122 PID 5372 wrote to memory of 5952 5372 E3F7.tmp 123 PID 5952 wrote to memory of 4640 5952 E445.tmp 124 PID 4640 wrote to memory of 1660 4640 E493.tmp 125 PID 1660 wrote to memory of 1500 1660 E4E2.tmp 126 PID 1500 wrote to memory of 224 1500 E530.tmp 127 PID 224 wrote to memory of 2428 224 E57E.tmp 128 PID 2428 wrote to memory of 228 2428 E5FB.tmp 129 PID 228 wrote to memory of 3108 228 E659.tmp 130 PID 3108 wrote to memory of 2320 3108 E6A7.tmp 131 PID 2320 wrote to memory of 580 2320 E6F5.tmp 132 PID 580 wrote to memory of 4408 580 E753.tmp 133 PID 4408 wrote to memory of 1624 4408 E7A1.tmp 134 PID 1624 wrote to memory of 4704 1624 E7EF.tmp 135 PID 4704 wrote to memory of 5696 4704 E83D.tmp 136 PID 5696 wrote to memory of 5508 5696 E88B.tmp 137 PID 5508 wrote to memory of 2948 5508 E8D9.tmp 138 PID 2948 wrote to memory of 5792 2948 E927.tmp 139 PID 5792 wrote to memory of 3276 5792 E975.tmp 140 PID 3276 wrote to memory of 3240 3276 E9C4.tmp 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_3ba869f635422534752b15cedf31c041_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_3ba869f635422534752b15cedf31c041_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\E157.tmp"C:\Users\Admin\AppData\Local\Temp\E157.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"65⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"66⤵PID:72
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"67⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"68⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"70⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"71⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"72⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"73⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"74⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"75⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"76⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"77⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"78⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"79⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"80⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"81⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"82⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"83⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"84⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"85⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"86⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"87⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"88⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"89⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"90⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"91⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"93⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"94⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"95⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"96⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"97⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"98⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"99⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"100⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"101⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"102⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"103⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"104⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"105⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"106⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"107⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"108⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"109⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"111⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"112⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"113⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"114⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"115⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"116⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"117⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"118⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"119⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:880 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"121⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"122⤵PID:5244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-