Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260710-x49zbsas21
- SHA256 3331ba225af6391f8257964467e76e931fdd586c076d9790cb6ffe9f641500d6
- MD5 cc39e0d15f4b79406831d4b3bcfa138a
- SHA1 0f38484350e588f23651e14e4836b74182c1a756
- SHA512 f89e89d42aba07f6050de1ca8c5339f1d5deaa790c7e1729e5874c2b8044950a3e36c1ee4e82b06ab81631052c5e74f2a7ebd494edc0a055f97b81ec14f33346
- SSDEEP 12288:9U5rCOTei6pkaXtOFTiM4ApkySFs/ePib0qZoXWjdq:9UQOJ6pkYt8iMRbB70qqGh
- TLSH T1B2C4F121B549C032E59202348EE6EBB1693A7C319B66A0C77BD0B76E6F712D1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5048 F5.tmp 5240 1C0.tmp 4736 25C.tmp 4492 2AB.tmp 4448 347.tmp 5628 395.tmp 4940 3E3.tmp 4228 441.tmp 2836 49F.tmp 4480 4FC.tmp 3280 55A.tmp 4360 5B8.tmp 4980 616.tmp 4664 673.tmp 5344 6D1.tmp 5692 71F.tmp 2480 76D.tmp 3892 7BB.tmp 1724 819.tmp 2316 867.tmp 2428 8B5.tmp 3844 923.tmp 692 971.tmp 1512 9BF.tmp 4848 A1D.tmp 6048 A6B.tmp 1688 AB9.tmp 5112 B07.tmp 4368 B65.tmp 5708 BC3.tmp 5412 C20.tmp 3064 C6F.tmp 3320 CCC.tmp 5232 D2A.tmp 4312 D78.tmp 2408 DC6.tmp 1876 E14.tmp 1356 E63.tmp 3256 EC0.tmp 2336 F0E.tmp 2264 F5D.tmp 4000 FAB.tmp 3136 FF9.tmp 6104 1047.tmp 1720 1095.tmp 4600 10E3.tmp 5748 1131.tmp 5812 117F.tmp 1792 11CE.tmp 2928 121C.tmp 972 126A.tmp 2512 12B8.tmp 6004 1316.tmp 2536 13A2.tmp 5244 142F.tmp 5156 147D.tmp 2600 14DB.tmp 4992 1558.tmp 5224 15A6.tmp 400 1604.tmp 5584 1652.tmp 6040 16A0.tmp 4560 16EE.tmp 1560 173C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 503E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4801.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 626E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6335.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 553A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 365D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5324 wrote to memory of 5048 5324 2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe 86 PID 5048 wrote to memory of 5240 5048 F5.tmp 87 PID 5240 wrote to memory of 4736 5240 1C0.tmp 88 PID 4736 wrote to memory of 4492 4736 25C.tmp 89 PID 4492 wrote to memory of 4448 4492 2AB.tmp 90 PID 4448 wrote to memory of 5628 4448 347.tmp 91 PID 5628 wrote to memory of 4940 5628 395.tmp 92 PID 4940 wrote to memory of 4228 4940 3E3.tmp 93 PID 4228 wrote to memory of 2836 4228 441.tmp 94 PID 2836 wrote to memory of 4480 2836 49F.tmp 95 PID 4480 wrote to memory of 3280 4480 4FC.tmp 96 PID 3280 wrote to memory of 4360 3280 55A.tmp 97 PID 4360 wrote to memory of 4980 4360 5B8.tmp 98 PID 4980 wrote to memory of 4664 4980 616.tmp 99 PID 4664 wrote to memory of 5344 4664 673.tmp 100 PID 5344 wrote to memory of 5692 5344 6D1.tmp 101 PID 5692 wrote to memory of 2480 5692 71F.tmp 102 PID 2480 wrote to memory of 3892 2480 76D.tmp 103 PID 3892 wrote to memory of 1724 3892 7BB.tmp 104 PID 1724 wrote to memory of 2316 1724 819.tmp 105 PID 2316 wrote to memory of 2428 2316 867.tmp 106 PID 2428 wrote to memory of 3844 2428 8B5.tmp 107 PID 3844 wrote to memory of 692 3844 923.tmp 108 PID 692 wrote to memory of 1512 692 971.tmp 109 PID 1512 wrote to memory of 4848 1512 9BF.tmp 110 PID 4848 wrote to memory of 6048 4848 A1D.tmp 111 PID 6048 wrote to memory of 1688 6048 A6B.tmp 112 PID 1688 wrote to memory of 5112 1688 AB9.tmp 113 PID 5112 wrote to memory of 4368 5112 B07.tmp 114 PID 4368 wrote to memory of 5708 4368 B65.tmp 115 PID 5708 wrote to memory of 5412 5708 BC3.tmp 116 PID 5412 wrote to memory of 3064 5412 C20.tmp 117 PID 3064 wrote to memory of 3320 3064 C6F.tmp 118 PID 3320 wrote to memory of 5232 3320 CCC.tmp 119 PID 5232 wrote to memory of 4312 5232 D2A.tmp 120 PID 4312 wrote to memory of 2408 4312 D78.tmp 121 PID 2408 wrote to memory of 1876 2408 DC6.tmp 122 PID 1876 wrote to memory of 1356 1876 E14.tmp 123 PID 1356 wrote to memory of 3256 1356 E63.tmp 124 PID 3256 wrote to memory of 2336 3256 EC0.tmp 125 PID 2336 wrote to memory of 2264 2336 F0E.tmp 126 PID 2264 wrote to memory of 4000 2264 F5D.tmp 127 PID 4000 wrote to memory of 3136 4000 FAB.tmp 128 PID 3136 wrote to memory of 6104 3136 FF9.tmp 129 PID 6104 wrote to memory of 1720 6104 1047.tmp 130 PID 1720 wrote to memory of 4600 1720 1095.tmp 131 PID 4600 wrote to memory of 5748 4600 10E3.tmp 132 PID 5748 wrote to memory of 5812 5748 1131.tmp 133 PID 5812 wrote to memory of 1792 5812 117F.tmp 134 PID 1792 wrote to memory of 2928 1792 11CE.tmp 135 PID 2928 wrote to memory of 972 2928 121C.tmp 136 PID 972 wrote to memory of 2512 972 126A.tmp 137 PID 2512 wrote to memory of 6004 2512 12B8.tmp 138 PID 6004 wrote to memory of 2536 6004 1316.tmp 139 PID 2536 wrote to memory of 5244 2536 13A2.tmp 140 PID 5244 wrote to memory of 5156 5244 142F.tmp 141 PID 5156 wrote to memory of 2600 5156 147D.tmp 142 PID 2600 wrote to memory of 4992 2600 14DB.tmp 143 PID 4992 wrote to memory of 5224 4992 1558.tmp 144 PID 5224 wrote to memory of 400 5224 15A6.tmp 145 PID 400 wrote to memory of 5584 400 1604.tmp 146 PID 5584 wrote to memory of 6040 5584 1652.tmp 147 PID 6040 wrote to memory of 4560 6040 16A0.tmp 148 PID 4560 wrote to memory of 1560 4560 16EE.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"65⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"66⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"67⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"68⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"69⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"70⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"72⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"73⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"74⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"75⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"76⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"77⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"78⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"79⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"80⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"81⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"82⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"83⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"84⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"85⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"86⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"87⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"88⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"89⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"90⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"91⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"92⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"93⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"94⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"95⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"96⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"97⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"98⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"99⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"100⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"101⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"102⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"103⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"104⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"105⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"106⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"107⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"108⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"109⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"110⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"111⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"112⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"113⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"114⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"115⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"116⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"117⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"118⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"119⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"120⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"121⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"122⤵PID:5624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-