Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 07:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260630-en
3 signatures
150 seconds
General
- Target 2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260702-h7d9hadx21
- SHA256 efb71eead9f9435d6c0b3c1db80539d65770431c631fa13a19c984df2812f5fe
- MD5 efadc1f25d1150913379dd9b352618d2
- SHA1 139900f9d2c3be5113daccf043eec04b69dbed68
- SHA512 73597bba837133de10f7332532d674608ec2a5f93c8245cf435e0b7e01668372c7260db1c25f273f1bb85307e4a2683bb2ca30ae5904d4666063cd0864e85376
- SSDEEP 12288:HU5rCOTeiJE5qtj+x8Ya4RMp2Ak/T1kENZ:HUQOJJEc1vUWQnN
- TLSH T1C2B4F121B441C032E9D202304AE6EBA2693ABD715B2654C73F90677E2FB53D1E779307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 396 3E5C.tmp 2520 3F27.tmp 4864 3FD3.tmp 3416 408E.tmp 4304 410B.tmp 3200 4188.tmp 1976 4225.tmp 2144 4292.tmp 5052 431F.tmp 3620 43BB.tmp 2292 4438.tmp 3916 44D4.tmp 4384 4590.tmp 4988 460D.tmp 900 467A.tmp 2784 46E7.tmp 4164 4793.tmp 968 482F.tmp 5108 48EB.tmp 4328 49A6.tmp 4804 4A72.tmp 1096 4B2D.tmp 2872 4BAA.tmp 368 4C37.tmp 3540 4CC3.tmp 1644 4D31.tmp 2364 4DBD.tmp 2996 4E2B.tmp 4716 4EE6.tmp 4648 4F63.tmp 4512 5148.tmp 3572 51E4.tmp 3472 5280.tmp 4180 52CE.tmp 3764 531C.tmp 1468 537A.tmp 3492 53C8.tmp 4608 5416.tmp 2108 5474.tmp 4352 54C2.tmp 2020 5510.tmp 1592 555E.tmp 4792 55AD.tmp 4964 55FB.tmp 4288 5649.tmp 3836 56A7.tmp 2068 5704.tmp 3772 5752.tmp 2924 57A1.tmp 3028 581E.tmp 3660 586C.tmp 4968 58E9.tmp 3800 5946.tmp 3360 59B4.tmp 1608 5A12.tmp 4732 5A7F.tmp 2724 5AFC.tmp 2192 5B69.tmp 4004 5BD7.tmp 3420 5C25.tmp 732 5C92.tmp 4668 5D00.tmp 648 5D5D.tmp 1132 5DCB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7318.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4879.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 998C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 823B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 693F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 396 1464 2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe 86 PID 396 wrote to memory of 2520 396 3E5C.tmp 87 PID 2520 wrote to memory of 4864 2520 3F27.tmp 88 PID 4864 wrote to memory of 3416 4864 3FD3.tmp 89 PID 3416 wrote to memory of 4304 3416 408E.tmp 90 PID 4304 wrote to memory of 3200 4304 410B.tmp 91 PID 3200 wrote to memory of 1976 3200 4188.tmp 92 PID 1976 wrote to memory of 2144 1976 4225.tmp 93 PID 2144 wrote to memory of 5052 2144 4292.tmp 94 PID 5052 wrote to memory of 3620 5052 431F.tmp 95 PID 3620 wrote to memory of 2292 3620 43BB.tmp 96 PID 2292 wrote to memory of 3916 2292 4438.tmp 97 PID 3916 wrote to memory of 4384 3916 44D4.tmp 98 PID 4384 wrote to memory of 4988 4384 4590.tmp 99 PID 4988 wrote to memory of 900 4988 460D.tmp 100 PID 900 wrote to memory of 2784 900 467A.tmp 101 PID 2784 wrote to memory of 4164 2784 46E7.tmp 102 PID 4164 wrote to memory of 968 4164 4793.tmp 103 PID 968 wrote to memory of 5108 968 482F.tmp 104 PID 5108 wrote to memory of 4328 5108 48EB.tmp 105 PID 4328 wrote to memory of 4804 4328 49A6.tmp 106 PID 4804 wrote to memory of 1096 4804 4A72.tmp 107 PID 1096 wrote to memory of 2872 1096 4B2D.tmp 108 PID 2872 wrote to memory of 368 2872 4BAA.tmp 109 PID 368 wrote to memory of 3540 368 4C37.tmp 110 PID 3540 wrote to memory of 1644 3540 4CC3.tmp 111 PID 1644 wrote to memory of 2364 1644 4D31.tmp 112 PID 2364 wrote to memory of 2996 2364 4DBD.tmp 113 PID 2996 wrote to memory of 4716 2996 4E2B.tmp 116 PID 4716 wrote to memory of 4648 4716 4EE6.tmp 118 PID 4648 wrote to memory of 4512 4648 4F63.tmp 119 PID 4512 wrote to memory of 3572 4512 5148.tmp 120 PID 3572 wrote to memory of 3472 3572 51E4.tmp 121 PID 3472 wrote to memory of 4180 3472 5280.tmp 123 PID 4180 wrote to memory of 3764 4180 52CE.tmp 124 PID 3764 wrote to memory of 1468 3764 531C.tmp 125 PID 1468 wrote to memory of 3492 1468 537A.tmp 128 PID 3492 wrote to memory of 4608 3492 53C8.tmp 130 PID 4608 wrote to memory of 2108 4608 5416.tmp 132 PID 2108 wrote to memory of 4352 2108 5474.tmp 133 PID 4352 wrote to memory of 2020 4352 54C2.tmp 134 PID 2020 wrote to memory of 1592 2020 5510.tmp 135 PID 1592 wrote to memory of 4792 1592 555E.tmp 136 PID 4792 wrote to memory of 4964 4792 55AD.tmp 137 PID 4964 wrote to memory of 4288 4964 55FB.tmp 138 PID 4288 wrote to memory of 3836 4288 5649.tmp 139 PID 3836 wrote to memory of 2068 3836 56A7.tmp 140 PID 2068 wrote to memory of 3772 2068 5704.tmp 141 PID 3772 wrote to memory of 2924 3772 5752.tmp 142 PID 2924 wrote to memory of 3028 2924 57A1.tmp 143 PID 3028 wrote to memory of 3660 3028 581E.tmp 144 PID 3660 wrote to memory of 4968 3660 586C.tmp 145 PID 4968 wrote to memory of 3800 4968 58E9.tmp 146 PID 3800 wrote to memory of 3360 3800 5946.tmp 147 PID 3360 wrote to memory of 1608 3360 59B4.tmp 148 PID 1608 wrote to memory of 4732 1608 5A12.tmp 149 PID 4732 wrote to memory of 2724 4732 5A7F.tmp 150 PID 2724 wrote to memory of 2192 2724 5AFC.tmp 151 PID 2192 wrote to memory of 4004 2192 5B69.tmp 152 PID 4004 wrote to memory of 3420 4004 5BD7.tmp 153 PID 3420 wrote to memory of 732 3420 5C25.tmp 154 PID 732 wrote to memory of 4668 732 5C92.tmp 155 PID 4668 wrote to memory of 648 4668 5D00.tmp 156 PID 648 wrote to memory of 1132 648 5D5D.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_efadc1f25d1150913379dd9b352618d2_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\4D31.tmp"C:\Users\Admin\AppData\Local\Temp\4D31.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"65⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"66⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"67⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"68⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"69⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"70⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"72⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6099.tmp"C:\Users\Admin\AppData\Local\Temp\6099.tmp"73⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"74⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"75⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"76⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"77⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"78⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\62BC.tmp"C:\Users\Admin\AppData\Local\Temp\62BC.tmp"79⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\630A.tmp"C:\Users\Admin\AppData\Local\Temp\630A.tmp"80⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"81⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"82⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"83⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"84⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"85⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"86⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\65BA.tmp"C:\Users\Admin\AppData\Local\Temp\65BA.tmp"87⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"88⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"89⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"90⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"91⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"92⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"93⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"94⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"95⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"96⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"97⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"98⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"99⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"100⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"101⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"102⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"103⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"104⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"105⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"106⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"107⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"108⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"109⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"110⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"112⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"113⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"114⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"115⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"116⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"117⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"118⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"119⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"120⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"121⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-