Analysis
- max time kernel
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260710-x49zbsas21
- SHA256 3331ba225af6391f8257964467e76e931fdd586c076d9790cb6ffe9f641500d6
- MD5 cc39e0d15f4b79406831d4b3bcfa138a
- SHA1 0f38484350e588f23651e14e4836b74182c1a756
- SHA512 f89e89d42aba07f6050de1ca8c5339f1d5deaa790c7e1729e5874c2b8044950a3e36c1ee4e82b06ab81631052c5e74f2a7ebd494edc0a055f97b81ec14f33346
- SSDEEP 12288:9U5rCOTei6pkaXtOFTiM4ApkySFs/ePib0qZoXWjdq:9UQOJ6pkYt8iMRbB70qqGh
- TLSH T1B2C4F121B549C032E59202348EE6EBB1693A7C319B66A0C77BD0B76E6F712D1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4664 B02.tmp 5796 BCE.tmp 1160 CA8.tmp 4560 D73.tmp 4624 E4E.tmp 3484 F19.tmp 3308 FF4.tmp 1784 1217.tmp 1364 12E2.tmp 4364 135F.tmp 2440 13EC.tmp 6136 1469.tmp 436 1534.tmp 3704 15D0.tmp 3424 169B.tmp 2144 1776.tmp 5092 1803.tmp 2404 18BE.tmp 4412 194B.tmp 724 1A06.tmp 5756 1AD1.tmp 480 1B7D.tmp 4908 1BFA.tmp 264 1CC5.tmp 3132 1D71.tmp 3712 1E4C.tmp 2208 1F36.tmp 5948 2021.tmp 4468 20CD.tmp 2576 2178.tmp 1124 2215.tmp 5952 22E0.tmp 4872 23BB.tmp 1348 2457.tmp 4848 24E3.tmp 2140 2570.tmp 4108 25FD.tmp 3252 2689.tmp 1188 2706.tmp 5912 2783.tmp 5356 2810.tmp 856 288D.tmp 920 28FA.tmp 3868 2987.tmp 5100 2A04.tmp 4972 2A71.tmp 4216 2ADF.tmp 3864 2B5C.tmp 5672 2BD9.tmp 2356 2C46.tmp 3540 2CD3.tmp 1264 2D50.tmp 4060 2DEC.tmp 1952 2E59.tmp 2240 2ED6.tmp 5528 2F63.tmp 5352 2FF0.tmp 1528 307C.tmp 5228 3118.tmp 5776 3186.tmp 4596 3212.tmp 4752 3280.tmp 3420 32ED.tmp 5616 335B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 552B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B92F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B57B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E31E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 824 wrote to memory of 4664 824 2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe 87 PID 4664 wrote to memory of 5796 4664 B02.tmp 88 PID 5796 wrote to memory of 1160 5796 BCE.tmp 89 PID 1160 wrote to memory of 4560 1160 CA8.tmp 90 PID 4560 wrote to memory of 4624 4560 D73.tmp 91 PID 4624 wrote to memory of 3484 4624 E4E.tmp 92 PID 3484 wrote to memory of 3308 3484 F19.tmp 93 PID 3308 wrote to memory of 1784 3308 FF4.tmp 94 PID 1784 wrote to memory of 1364 1784 1217.tmp 95 PID 1364 wrote to memory of 4364 1364 12E2.tmp 96 PID 4364 wrote to memory of 2440 4364 135F.tmp 97 PID 2440 wrote to memory of 6136 2440 13EC.tmp 98 PID 6136 wrote to memory of 436 6136 1469.tmp 99 PID 436 wrote to memory of 3704 436 1534.tmp 100 PID 3704 wrote to memory of 3424 3704 15D0.tmp 101 PID 3424 wrote to memory of 2144 3424 169B.tmp 102 PID 2144 wrote to memory of 5092 2144 1776.tmp 103 PID 5092 wrote to memory of 2404 5092 1803.tmp 104 PID 2404 wrote to memory of 4412 2404 18BE.tmp 105 PID 4412 wrote to memory of 724 4412 194B.tmp 106 PID 724 wrote to memory of 5756 724 1A06.tmp 107 PID 5756 wrote to memory of 480 5756 1AD1.tmp 108 PID 480 wrote to memory of 4908 480 1B7D.tmp 109 PID 4908 wrote to memory of 264 4908 1BFA.tmp 110 PID 264 wrote to memory of 3132 264 1CC5.tmp 111 PID 3132 wrote to memory of 3712 3132 1D71.tmp 112 PID 3712 wrote to memory of 2208 3712 1E4C.tmp 113 PID 2208 wrote to memory of 5948 2208 1F36.tmp 114 PID 5948 wrote to memory of 4468 5948 2021.tmp 115 PID 4468 wrote to memory of 2576 4468 20CD.tmp 116 PID 2576 wrote to memory of 1124 2576 2178.tmp 117 PID 1124 wrote to memory of 5952 1124 2215.tmp 118 PID 5952 wrote to memory of 4872 5952 22E0.tmp 119 PID 4872 wrote to memory of 1348 4872 23BB.tmp 120 PID 1348 wrote to memory of 4848 1348 2457.tmp 121 PID 4848 wrote to memory of 2140 4848 24E3.tmp 122 PID 2140 wrote to memory of 4108 2140 2570.tmp 123 PID 4108 wrote to memory of 3252 4108 25FD.tmp 124 PID 3252 wrote to memory of 1188 3252 2689.tmp 125 PID 1188 wrote to memory of 5912 1188 2706.tmp 126 PID 5912 wrote to memory of 5356 5912 2783.tmp 127 PID 5356 wrote to memory of 856 5356 2810.tmp 128 PID 856 wrote to memory of 920 856 288D.tmp 129 PID 920 wrote to memory of 3868 920 28FA.tmp 130 PID 3868 wrote to memory of 5100 3868 2987.tmp 131 PID 5100 wrote to memory of 4972 5100 2A04.tmp 132 PID 4972 wrote to memory of 4216 4972 2A71.tmp 133 PID 4216 wrote to memory of 3864 4216 2ADF.tmp 134 PID 3864 wrote to memory of 5672 3864 2B5C.tmp 135 PID 5672 wrote to memory of 2356 5672 2BD9.tmp 136 PID 2356 wrote to memory of 3540 2356 2C46.tmp 137 PID 3540 wrote to memory of 1264 3540 2CD3.tmp 138 PID 1264 wrote to memory of 4060 1264 2D50.tmp 139 PID 4060 wrote to memory of 1952 4060 2DEC.tmp 140 PID 1952 wrote to memory of 2240 1952 2E59.tmp 141 PID 2240 wrote to memory of 5528 2240 2ED6.tmp 142 PID 5528 wrote to memory of 5352 5528 2F63.tmp 143 PID 5352 wrote to memory of 1528 5352 2FF0.tmp 144 PID 1528 wrote to memory of 5228 1528 307C.tmp 145 PID 5228 wrote to memory of 5776 5228 3118.tmp 146 PID 5776 wrote to memory of 4596 5776 3186.tmp 147 PID 4596 wrote to memory of 4752 4596 3212.tmp 148 PID 4752 wrote to memory of 3420 4752 3280.tmp 149 PID 3420 wrote to memory of 5616 3420 32ED.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_cc39e0d15f4b79406831d4b3bcfa138a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\E4E.tmp"C:\Users\Admin\AppData\Local\Temp\E4E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1469.tmp"C:\Users\Admin\AppData\Local\Temp\1469.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\15D0.tmp"C:\Users\Admin\AppData\Local\Temp\15D0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\1F36.tmp"C:\Users\Admin\AppData\Local\Temp\1F36.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2215.tmp"C:\Users\Admin\AppData\Local\Temp\2215.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\22E0.tmp"C:\Users\Admin\AppData\Local\Temp\22E0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\23BB.tmp"C:\Users\Admin\AppData\Local\Temp\23BB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\2457.tmp"C:\Users\Admin\AppData\Local\Temp\2457.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2987.tmp"C:\Users\Admin\AppData\Local\Temp\2987.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\2C46.tmp"C:\Users\Admin\AppData\Local\Temp\2C46.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\2D50.tmp"C:\Users\Admin\AppData\Local\Temp\2D50.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2E59.tmp"C:\Users\Admin\AppData\Local\Temp\2E59.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\307C.tmp"C:\Users\Admin\AppData\Local\Temp\307C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\3212.tmp"C:\Users\Admin\AppData\Local\Temp\3212.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3280.tmp"C:\Users\Admin\AppData\Local\Temp\3280.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\335B.tmp"C:\Users\Admin\AppData\Local\Temp\335B.tmp"65⤵
- Executes dropped EXE
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"66⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"67⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\34C2.tmp"C:\Users\Admin\AppData\Local\Temp\34C2.tmp"68⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\352F.tmp"C:\Users\Admin\AppData\Local\Temp\352F.tmp"69⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\35BC.tmp"C:\Users\Admin\AppData\Local\Temp\35BC.tmp"70⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"71⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"72⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"74⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"75⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"76⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"77⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"78⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"79⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"80⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"82⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"83⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"84⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"85⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"86⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"87⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"88⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"89⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"90⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"91⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\41C2.tmp"C:\Users\Admin\AppData\Local\Temp\41C2.tmp"93⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"94⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\42CC.tmp"C:\Users\Admin\AppData\Local\Temp\42CC.tmp"95⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"96⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"97⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"98⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"99⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"100⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"101⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"102⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"103⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"104⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"105⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\483A.tmp"C:\Users\Admin\AppData\Local\Temp\483A.tmp"106⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"108⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"109⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"110⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"111⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"112⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\4C32.tmp"C:\Users\Admin\AppData\Local\Temp\4C32.tmp"113⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"114⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"115⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"117⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"118⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"119⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"120⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"121⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:5048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-