Analysis
- max time kernel
120s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_c30c7cf5e08b97acd2ce0d70553a0b2a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_c30c7cf5e08b97acd2ce0d70553a0b2a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_c30c7cf5e08b97acd2ce0d70553a0b2a_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260718-cnpcgacz7m
- SHA256 00b59ce951e74593ad07a7ea6caf844e3d8683d629c1684ce81d92be89366ef7
- MD5 c30c7cf5e08b97acd2ce0d70553a0b2a
- SHA1 8483159ee2c1a9140e07e0c21e36af7b221ab52f
- SHA512 4d83851f1bca1c5a00ffdf74ae0443709baa5f95848e2786325c50baacd944b6e3477bdc1b2aed2475879eaa884e5a2fbfefc701cd98de9440353aa9488e935d
- SSDEEP 12288:wU5rCOTeiDHU5lb+8aieVb55y85FHPdNZ+3/v+I9hUG2VA:wUQOJD6lb+meVN5yOHVNGEA
- TLSH T1CBE4D12173D88532D9F7037859B5F6654D7EBD22A721D6CF2F8016AE0AB1BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2452 9F92.tmp 1700 A0BB.tmp 2912 A157.tmp 2704 A2DD.tmp 3756 A3D7.tmp 4372 A493.tmp 2196 A57D.tmp 3856 A668.tmp 4408 A752.tmp 2296 A84C.tmp 4468 A9A4.tmp 4664 AA9E.tmp 5660 ABA7.tmp 4784 ACE0.tmp 1340 AE18.tmp 1656 AF32.tmp 1724 B00C.tmp 4092 B126.tmp 5872 B23F.tmp 3152 B339.tmp 1068 B4DF.tmp 3396 B5E8.tmp 2240 B6C3.tmp 4952 B7FC.tmp 1572 B934.tmp 3972 BA3E.tmp 1888 BB76.tmp 2972 BC90.tmp 5432 BD99.tmp 6080 BEE1.tmp 3528 BFBC.tmp 252 C0D5.tmp 6016 C1DF.tmp 1884 C2C9.tmp 888 C3A4.tmp 1216 C48E.tmp 1032 C52B.tmp 1696 C5A8.tmp 948 C6A2.tmp 4620 C73E.tmp 3708 C7F9.tmp 4900 C896.tmp 1936 C932.tmp 2648 C9FD.tmp 5624 CAC8.tmp 1336 CB84.tmp 1672 CC7E.tmp 4484 CD39.tmp 4704 CDB6.tmp 4444 CE43.tmp 1964 CEDF.tmp 1188 CF5C.tmp 2432 CFE9.tmp 5616 D0B4.tmp 2792 D121.tmp 2404 D1FC.tmp 1448 D2B7.tmp 4860 D315.tmp 2576 D3F0.tmp 820 D47D.tmp 2604 D509.tmp 6124 D577.tmp 5560 D5E4.tmp 4412 D671.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A57D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 631B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E81F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1096.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 507E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 379C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4148 wrote to memory of 2452 4148 2026-07-17_c30c7cf5e08b97acd2ce0d70553a0b2a_elex_mafia_stealc_tofsee.exe 88 PID 2452 wrote to memory of 1700 2452 9F92.tmp 89 PID 1700 wrote to memory of 2912 1700 A0BB.tmp 90 PID 2912 wrote to memory of 2704 2912 A157.tmp 91 PID 2704 wrote to memory of 3756 2704 A2DD.tmp 92 PID 3756 wrote to memory of 4372 3756 A3D7.tmp 93 PID 4372 wrote to memory of 2196 4372 A493.tmp 94 PID 2196 wrote to memory of 3856 2196 A57D.tmp 95 PID 3856 wrote to memory of 4408 3856 A668.tmp 96 PID 4408 wrote to memory of 2296 4408 A752.tmp 97 PID 2296 wrote to memory of 4468 2296 A84C.tmp 98 PID 4468 wrote to memory of 4664 4468 A9A4.tmp 99 PID 4664 wrote to memory of 5660 4664 AA9E.tmp 100 PID 5660 wrote to memory of 4784 5660 ABA7.tmp 101 PID 4784 wrote to memory of 1340 4784 ACE0.tmp 102 PID 1340 wrote to memory of 1656 1340 AE18.tmp 103 PID 1656 wrote to memory of 1724 1656 AF32.tmp 104 PID 1724 wrote to memory of 4092 1724 B00C.tmp 105 PID 4092 wrote to memory of 5872 4092 B126.tmp 106 PID 5872 wrote to memory of 3152 5872 B23F.tmp 107 PID 3152 wrote to memory of 1068 3152 B339.tmp 108 PID 1068 wrote to memory of 3396 1068 B4DF.tmp 109 PID 3396 wrote to memory of 2240 3396 B5E8.tmp 110 PID 2240 wrote to memory of 4952 2240 B6C3.tmp 111 PID 4952 wrote to memory of 1572 4952 B7FC.tmp 112 PID 1572 wrote to memory of 3972 1572 B934.tmp 113 PID 3972 wrote to memory of 1888 3972 BA3E.tmp 114 PID 1888 wrote to memory of 2972 1888 BB76.tmp 115 PID 2972 wrote to memory of 5432 2972 BC90.tmp 116 PID 5432 wrote to memory of 6080 5432 BD99.tmp 117 PID 6080 wrote to memory of 3528 6080 BEE1.tmp 118 PID 3528 wrote to memory of 252 3528 BFBC.tmp 119 PID 252 wrote to memory of 6016 252 C0D5.tmp 120 PID 6016 wrote to memory of 1884 6016 C1DF.tmp 121 PID 1884 wrote to memory of 888 1884 C2C9.tmp 122 PID 888 wrote to memory of 1216 888 C3A4.tmp 123 PID 1216 wrote to memory of 1032 1216 C48E.tmp 124 PID 1032 wrote to memory of 1696 1032 C52B.tmp 125 PID 1696 wrote to memory of 948 1696 C5A8.tmp 126 PID 948 wrote to memory of 4620 948 C6A2.tmp 127 PID 4620 wrote to memory of 3708 4620 C73E.tmp 128 PID 3708 wrote to memory of 4900 3708 C7F9.tmp 129 PID 4900 wrote to memory of 1936 4900 C896.tmp 130 PID 1936 wrote to memory of 2648 1936 C932.tmp 131 PID 2648 wrote to memory of 5624 2648 C9FD.tmp 132 PID 5624 wrote to memory of 1336 5624 CAC8.tmp 133 PID 1336 wrote to memory of 1672 1336 CB84.tmp 134 PID 1672 wrote to memory of 4484 1672 CC7E.tmp 135 PID 4484 wrote to memory of 4704 4484 CD39.tmp 136 PID 4704 wrote to memory of 4444 4704 CDB6.tmp 137 PID 4444 wrote to memory of 1964 4444 CE43.tmp 138 PID 1964 wrote to memory of 1188 1964 CEDF.tmp 139 PID 1188 wrote to memory of 2432 1188 CF5C.tmp 140 PID 2432 wrote to memory of 5616 2432 CFE9.tmp 141 PID 5616 wrote to memory of 2792 5616 D0B4.tmp 142 PID 2792 wrote to memory of 2404 2792 D121.tmp 143 PID 2404 wrote to memory of 1448 2404 D1FC.tmp 144 PID 1448 wrote to memory of 4860 1448 D2B7.tmp 145 PID 4860 wrote to memory of 2576 4860 D315.tmp 146 PID 2576 wrote to memory of 820 2576 D3F0.tmp 147 PID 820 wrote to memory of 2604 820 D47D.tmp 148 PID 2604 wrote to memory of 6124 2604 D509.tmp 149 PID 6124 wrote to memory of 5560 6124 D577.tmp 150 PID 5560 wrote to memory of 4412 5560 D5E4.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_c30c7cf5e08b97acd2ce0d70553a0b2a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_c30c7cf5e08b97acd2ce0d70553a0b2a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\A84C.tmp"C:\Users\Admin\AppData\Local\Temp\A84C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\AE18.tmp"C:\Users\Admin\AppData\Local\Temp\AE18.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\AF32.tmp"C:\Users\Admin\AppData\Local\Temp\AF32.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\BC90.tmp"C:\Users\Admin\AppData\Local\Temp\BC90.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\C52B.tmp"C:\Users\Admin\AppData\Local\Temp\C52B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\C896.tmp"C:\Users\Admin\AppData\Local\Temp\C896.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\CE43.tmp"C:\Users\Admin\AppData\Local\Temp\CE43.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\CFE9.tmp"C:\Users\Admin\AppData\Local\Temp\CFE9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\D47D.tmp"C:\Users\Admin\AppData\Local\Temp\D47D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\D509.tmp"C:\Users\Admin\AppData\Local\Temp\D509.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"65⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"66⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\D77A.tmp"C:\Users\Admin\AppData\Local\Temp\D77A.tmp"67⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"68⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"69⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"70⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"71⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"72⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"73⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"74⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"75⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"76⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"77⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"78⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"79⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\DE60.tmp"C:\Users\Admin\AppData\Local\Temp\DE60.tmp"80⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"81⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"82⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"83⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"84⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"85⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"86⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"87⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"88⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"89⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"90⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"92⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\E545.tmp"C:\Users\Admin\AppData\Local\Temp\E545.tmp"93⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"94⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"95⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"96⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\E749.tmp"C:\Users\Admin\AppData\Local\Temp\E749.tmp"97⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"98⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\E814.tmp"C:\Users\Admin\AppData\Local\Temp\E814.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"100⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"101⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"102⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"103⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"104⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"105⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"106⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"107⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"108⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"109⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"110⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"111⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"112⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"113⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"114⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"115⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"116⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"117⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\F274.tmp"C:\Users\Admin\AppData\Local\Temp\F274.tmp"118⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"119⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"120⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"121⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-