Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 16:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_5ccac29b2fa06bb83e9ec1757661da54_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_5ccac29b2fa06bb83e9ec1757661da54_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-03_5ccac29b2fa06bb83e9ec1757661da54_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260703-th4nmscv61
- SHA256 e0d9b16210af38cbfd70e4d6004c82a0200e5c8d8e42f9a13b52e6133612e610
- MD5 5ccac29b2fa06bb83e9ec1757661da54
- SHA1 e32b3a3ce44f9e9e8ad0c99cc7632fde46636362
- SHA512 9ef07e8022255d6cd9607fb7264c0241f858fa4a414fd0923b4faaf85a00f1fec291bba6656cc314bacbae96a0e00f9fe5b2effcc0f36f0b886a1a065605f1d4
- SSDEEP 12288:9U5rCOTei6/2eAI0IIADGhdEYpx7LIOGXZGS4jtDvhKqZoXWjdq:9UQOJ6MADGPXIxEFKqqGh
- TLSH T109C4F121B985C032E59211304AE6EBB6697E7D719B2660C77B80777E2FB42E1D378307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4768 B820.tmp 5676 B8AC.tmp 6308 B958.tmp 5564 B9C6.tmp 5948 BA43.tmp 6916 BACF.tmp 6040 BB3D.tmp 4784 BBAA.tmp 2208 BC46.tmp 4464 BCC3.tmp 1336 BD50.tmp 1476 BDCD.tmp 6648 BE2B.tmp 1072 BE98.tmp 6564 BF44.tmp 6724 BFB1.tmp 1204 C01F.tmp 4172 C0BB.tmp 6288 C157.tmp 2628 C1B5.tmp 4756 C232.tmp 4488 C29F.tmp 6792 C30D.tmp 5076 C38A.tmp 5888 C407.tmp 2488 C474.tmp 6912 C4E1.tmp 6992 C53F.tmp 6684 C5BC.tmp 2976 C649.tmp 4508 C6A6.tmp 2412 C733.tmp 1324 C7B0.tmp 6924 C81D.tmp 6292 C87B.tmp 2636 C8D9.tmp 5156 C946.tmp 6540 C9A4.tmp 4148 CA02.tmp 944 CA60.tmp 6836 CABD.tmp 2676 CB2B.tmp 6184 CB98.tmp 1656 CC15.tmp 1704 CC82.tmp 3152 CCE0.tmp 6880 CD4E.tmp 5432 CDAB.tmp 6420 CE09.tmp 1344 CE76.tmp 7076 CEE4.tmp 5700 CF51.tmp 1616 CFAF.tmp 6852 D01C.tmp 3524 D07A.tmp 6708 D0D8.tmp 3088 D136.tmp 6712 D193.tmp 1580 D201.tmp 3308 D25E.tmp 2076 D2BC.tmp 2916 D31A.tmp 4528 D378.tmp 2132 D3D5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E78C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 167C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1498.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5988 wrote to memory of 4768 5988 2026-07-03_5ccac29b2fa06bb83e9ec1757661da54_elex_mafia_stealc_tofsee.exe 89 PID 4768 wrote to memory of 5676 4768 B820.tmp 90 PID 5676 wrote to memory of 6308 5676 B8AC.tmp 91 PID 6308 wrote to memory of 5564 6308 B958.tmp 92 PID 5564 wrote to memory of 5948 5564 B9C6.tmp 93 PID 5948 wrote to memory of 6916 5948 BA43.tmp 94 PID 6916 wrote to memory of 6040 6916 BACF.tmp 95 PID 6040 wrote to memory of 4784 6040 BB3D.tmp 96 PID 4784 wrote to memory of 2208 4784 BBAA.tmp 97 PID 2208 wrote to memory of 4464 2208 BC46.tmp 98 PID 4464 wrote to memory of 1336 4464 BCC3.tmp 99 PID 1336 wrote to memory of 1476 1336 BD50.tmp 100 PID 1476 wrote to memory of 6648 1476 BDCD.tmp 101 PID 6648 wrote to memory of 1072 6648 BE2B.tmp 102 PID 1072 wrote to memory of 6564 1072 BE98.tmp 103 PID 6564 wrote to memory of 6724 6564 BF44.tmp 104 PID 6724 wrote to memory of 1204 6724 BFB1.tmp 105 PID 1204 wrote to memory of 4172 1204 C01F.tmp 106 PID 4172 wrote to memory of 6288 4172 C0BB.tmp 107 PID 6288 wrote to memory of 2628 6288 C157.tmp 108 PID 2628 wrote to memory of 4756 2628 C1B5.tmp 109 PID 4756 wrote to memory of 4488 4756 C232.tmp 110 PID 4488 wrote to memory of 6792 4488 C29F.tmp 111 PID 6792 wrote to memory of 5076 6792 C30D.tmp 112 PID 5076 wrote to memory of 5888 5076 C38A.tmp 113 PID 5888 wrote to memory of 2488 5888 C407.tmp 114 PID 2488 wrote to memory of 6912 2488 C474.tmp 115 PID 6912 wrote to memory of 6992 6912 C4E1.tmp 116 PID 6992 wrote to memory of 6684 6992 C53F.tmp 117 PID 6684 wrote to memory of 2976 6684 C5BC.tmp 118 PID 2976 wrote to memory of 4508 2976 C649.tmp 119 PID 4508 wrote to memory of 2412 4508 C6A6.tmp 120 PID 2412 wrote to memory of 1324 2412 C733.tmp 121 PID 1324 wrote to memory of 6924 1324 C7B0.tmp 122 PID 6924 wrote to memory of 6292 6924 C81D.tmp 123 PID 6292 wrote to memory of 2636 6292 C87B.tmp 124 PID 2636 wrote to memory of 5156 2636 C8D9.tmp 125 PID 5156 wrote to memory of 6540 5156 C946.tmp 126 PID 6540 wrote to memory of 4148 6540 C9A4.tmp 127 PID 4148 wrote to memory of 944 4148 CA02.tmp 128 PID 944 wrote to memory of 6836 944 CA60.tmp 129 PID 6836 wrote to memory of 2676 6836 CABD.tmp 130 PID 2676 wrote to memory of 6184 2676 CB2B.tmp 131 PID 6184 wrote to memory of 1656 6184 CB98.tmp 132 PID 1656 wrote to memory of 1704 1656 CC15.tmp 133 PID 1704 wrote to memory of 3152 1704 CC82.tmp 134 PID 3152 wrote to memory of 6880 3152 CCE0.tmp 135 PID 6880 wrote to memory of 5432 6880 CD4E.tmp 136 PID 5432 wrote to memory of 6420 5432 CDAB.tmp 137 PID 6420 wrote to memory of 1344 6420 CE09.tmp 138 PID 1344 wrote to memory of 7076 1344 CE76.tmp 139 PID 7076 wrote to memory of 5700 7076 CEE4.tmp 140 PID 5700 wrote to memory of 1616 5700 CF51.tmp 141 PID 1616 wrote to memory of 6852 1616 CFAF.tmp 142 PID 6852 wrote to memory of 3524 6852 D01C.tmp 143 PID 3524 wrote to memory of 6708 3524 D07A.tmp 144 PID 6708 wrote to memory of 3088 6708 D0D8.tmp 145 PID 3088 wrote to memory of 6712 3088 D136.tmp 146 PID 6712 wrote to memory of 1580 6712 D193.tmp 147 PID 1580 wrote to memory of 3308 1580 D201.tmp 148 PID 3308 wrote to memory of 2076 3308 D25E.tmp 149 PID 2076 wrote to memory of 2916 2076 D2BC.tmp 150 PID 2916 wrote to memory of 4528 2916 D31A.tmp 151 PID 4528 wrote to memory of 2132 4528 D378.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_5ccac29b2fa06bb83e9ec1757661da54_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_5ccac29b2fa06bb83e9ec1757661da54_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\B820.tmp"C:\Users\Admin\AppData\Local\Temp\B820.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\B958.tmp"C:\Users\Admin\AppData\Local\Temp\B958.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6308 -
C:\Users\Admin\AppData\Local\Temp\B9C6.tmp"C:\Users\Admin\AppData\Local\Temp\B9C6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\BACF.tmp"C:\Users\Admin\AppData\Local\Temp\BACF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6916 -
C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\BC46.tmp"C:\Users\Admin\AppData\Local\Temp\BC46.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\BD50.tmp"C:\Users\Admin\AppData\Local\Temp\BD50.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6648 -
C:\Users\Admin\AppData\Local\Temp\BE98.tmp"C:\Users\Admin\AppData\Local\Temp\BE98.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\BF44.tmp"C:\Users\Admin\AppData\Local\Temp\BF44.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6564 -
C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6724 -
C:\Users\Admin\AppData\Local\Temp\C01F.tmp"C:\Users\Admin\AppData\Local\Temp\C01F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\C157.tmp"C:\Users\Admin\AppData\Local\Temp\C157.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6288 -
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\C232.tmp"C:\Users\Admin\AppData\Local\Temp\C232.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C29F.tmp"C:\Users\Admin\AppData\Local\Temp\C29F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6792 -
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\C407.tmp"C:\Users\Admin\AppData\Local\Temp\C407.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\C474.tmp"C:\Users\Admin\AppData\Local\Temp\C474.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6912 -
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6992 -
C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6684 -
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\C733.tmp"C:\Users\Admin\AppData\Local\Temp\C733.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6924 -
C:\Users\Admin\AppData\Local\Temp\C87B.tmp"C:\Users\Admin\AppData\Local\Temp\C87B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6292 -
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6540 -
C:\Users\Admin\AppData\Local\Temp\CA02.tmp"C:\Users\Admin\AppData\Local\Temp\CA02.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6836 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6184 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\CC82.tmp"C:\Users\Admin\AppData\Local\Temp\CC82.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6880 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6420 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7076 -
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6852 -
C:\Users\Admin\AppData\Local\Temp\D07A.tmp"C:\Users\Admin\AppData\Local\Temp\D07A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6708 -
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\D193.tmp"C:\Users\Admin\AppData\Local\Temp\D193.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6712 -
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\D25E.tmp"C:\Users\Admin\AppData\Local\Temp\D25E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\D378.tmp"C:\Users\Admin\AppData\Local\Temp\D378.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"65⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"66⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"67⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"68⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"69⤵PID:6304
-
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"70⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"72⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"74⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\D7CD.tmp"C:\Users\Admin\AppData\Local\Temp\D7CD.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"76⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"77⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"78⤵PID:6988
-
C:\Users\Admin\AppData\Local\Temp\D963.tmp"C:\Users\Admin\AppData\Local\Temp\D963.tmp"79⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"80⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"81⤵PID:6600
-
C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"82⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\DADA.tmp"C:\Users\Admin\AppData\Local\Temp\DADA.tmp"83⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"84⤵PID:6552
-
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"85⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"86⤵PID:6296
-
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"87⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"88⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\DD4B.tmp"C:\Users\Admin\AppData\Local\Temp\DD4B.tmp"89⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"90⤵PID:6300
-
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"91⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\DE65.tmp"C:\Users\Admin\AppData\Local\Temp\DE65.tmp"92⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"93⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\DF10.tmp"C:\Users\Admin\AppData\Local\Temp\DF10.tmp"94⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"95⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"96⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"97⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"98⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"99⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\E172.tmp"C:\Users\Admin\AppData\Local\Temp\E172.tmp"100⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"101⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"102⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\E29B.tmp"C:\Users\Admin\AppData\Local\Temp\E29B.tmp"103⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"104⤵PID:6856
-
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"105⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"106⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\E421.tmp"C:\Users\Admin\AppData\Local\Temp\E421.tmp"107⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\E48F.tmp"C:\Users\Admin\AppData\Local\Temp\E48F.tmp"108⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"109⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\E55A.tmp"C:\Users\Admin\AppData\Local\Temp\E55A.tmp"110⤵PID:6876
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"111⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\E615.tmp"C:\Users\Admin\AppData\Local\Temp\E615.tmp"112⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\E673.tmp"C:\Users\Admin\AppData\Local\Temp\E673.tmp"113⤵PID:7116
-
C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"114⤵PID:7040
-
C:\Users\Admin\AppData\Local\Temp\E71F.tmp"C:\Users\Admin\AppData\Local\Temp\E71F.tmp"115⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\E78C.tmp"C:\Users\Admin\AppData\Local\Temp\E78C.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:7156 -
C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"118⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"119⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:6404 -
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"121⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"122⤵PID:6780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-