Analysis
- max time kernel
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_588d4d77168720539b29d1954b802a3d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_588d4d77168720539b29d1954b802a3d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-17_588d4d77168720539b29d1954b802a3d_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260718-eb7pdsft4m
- SHA256 c44dd2bca24ec5644a1feedc537cbf3f13d34ce8a6a2d7be61658289c8efd73f
- MD5 588d4d77168720539b29d1954b802a3d
- SHA1 bdb1440c92f7cf438a52d5cbcba2689935d1222b
- SHA512 535c31076caf1bf5b67b7066cfb0ce5cf814308c717976b5011773b14c2fff6af98751585ff27fbd5072420f17967f94d66eda191de33fadb5970356d092c43b
- SSDEEP 12288:wU5rCOTeiD97yna4G64Y8PYqcGM9z2azhKiNZ+3/v+I9hUG2VA:wUQOJDJuG64Y8PobpNGEA
- TLSH T1DDE4D02073D8C532E5FB037859B5A6515D7EBD32A712D6CF2F9025AE0AB1BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2496 4B48.tmp 1496 4C70.tmp 3664 4E07.tmp 4996 4F7E.tmp 2704 50A7.tmp 2612 5124.tmp 2636 5318.tmp 2624 5402.tmp 1232 552B.tmp 5116 5654.tmp 3112 572E.tmp 2948 5848.tmp 4808 5971.tmp 2484 5AF7.tmp 1416 5BE2.tmp 4816 5CBC.tmp 1984 5DE5.tmp 2808 5F1E.tmp 5276 6047.tmp 2288 6150.tmp 4968 6279.tmp 3380 6373.tmp 5384 64FA.tmp 1432 6661.tmp 3500 676B.tmp 2516 68A3.tmp 2032 69DC.tmp 5144 6B14.tmp 2884 6C3D.tmp 2188 6D76.tmp 1192 6E70.tmp 5640 6F89.tmp 2576 7054.tmp 4908 70F0.tmp 3840 71BB.tmp 2156 72A6.tmp 5716 7390.tmp 5320 744C.tmp 1088 7517.tmp 5416 75A3.tmp 5760 768E.tmp 2332 770B.tmp 3348 77A7.tmp 3192 7843.tmp 1728 78C0.tmp 4576 798B.tmp 5316 7A28.tmp 4448 7AB4.tmp 4972 7B60.tmp 1508 7BCD.tmp 2748 7C4A.tmp 2192 7CE7.tmp 1660 7D73.tmp 6020 7E8D.tmp 2340 7F0A.tmp 5012 7F87.tmp 1708 7FF4.tmp 2828 8071.tmp 1128 80EE.tmp 4980 816B.tmp 1080 81F8.tmp 5680 8265.tmp 2160 8301.tmp 3032 83CC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 732E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 394C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 417F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A08C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2496 5064 2026-07-17_588d4d77168720539b29d1954b802a3d_elex_mafia_stealc_tofsee.exe 89 PID 2496 wrote to memory of 1496 2496 4B48.tmp 90 PID 1496 wrote to memory of 3664 1496 4C70.tmp 91 PID 3664 wrote to memory of 4996 3664 4E07.tmp 92 PID 4996 wrote to memory of 2704 4996 4F7E.tmp 93 PID 2704 wrote to memory of 2612 2704 50A7.tmp 94 PID 2612 wrote to memory of 2636 2612 5124.tmp 95 PID 2636 wrote to memory of 2624 2636 5318.tmp 96 PID 2624 wrote to memory of 1232 2624 5402.tmp 97 PID 1232 wrote to memory of 5116 1232 552B.tmp 98 PID 5116 wrote to memory of 3112 5116 5654.tmp 99 PID 3112 wrote to memory of 2948 3112 572E.tmp 100 PID 2948 wrote to memory of 4808 2948 5848.tmp 101 PID 4808 wrote to memory of 2484 4808 5971.tmp 102 PID 2484 wrote to memory of 1416 2484 5AF7.tmp 103 PID 1416 wrote to memory of 4816 1416 5BE2.tmp 104 PID 4816 wrote to memory of 1984 4816 5CBC.tmp 105 PID 1984 wrote to memory of 2808 1984 5DE5.tmp 106 PID 2808 wrote to memory of 5276 2808 5F1E.tmp 107 PID 5276 wrote to memory of 2288 5276 6047.tmp 108 PID 2288 wrote to memory of 4968 2288 6150.tmp 109 PID 4968 wrote to memory of 3380 4968 6279.tmp 110 PID 3380 wrote to memory of 5384 3380 6373.tmp 111 PID 5384 wrote to memory of 1432 5384 64FA.tmp 112 PID 1432 wrote to memory of 3500 1432 6661.tmp 113 PID 3500 wrote to memory of 2516 3500 676B.tmp 114 PID 2516 wrote to memory of 2032 2516 68A3.tmp 115 PID 2032 wrote to memory of 5144 2032 69DC.tmp 116 PID 5144 wrote to memory of 2884 5144 6B14.tmp 117 PID 2884 wrote to memory of 2188 2884 6C3D.tmp 118 PID 2188 wrote to memory of 1192 2188 6D76.tmp 119 PID 1192 wrote to memory of 5640 1192 6E70.tmp 120 PID 5640 wrote to memory of 2576 5640 6F89.tmp 121 PID 2576 wrote to memory of 4908 2576 7054.tmp 122 PID 4908 wrote to memory of 3840 4908 70F0.tmp 123 PID 3840 wrote to memory of 2156 3840 71BB.tmp 124 PID 2156 wrote to memory of 5716 2156 72A6.tmp 125 PID 5716 wrote to memory of 5320 5716 7390.tmp 126 PID 5320 wrote to memory of 1088 5320 744C.tmp 127 PID 1088 wrote to memory of 5416 1088 7517.tmp 128 PID 5416 wrote to memory of 5760 5416 75A3.tmp 129 PID 5760 wrote to memory of 2332 5760 768E.tmp 130 PID 2332 wrote to memory of 3348 2332 770B.tmp 131 PID 3348 wrote to memory of 3192 3348 77A7.tmp 132 PID 3192 wrote to memory of 1728 3192 7843.tmp 133 PID 1728 wrote to memory of 4576 1728 78C0.tmp 134 PID 4576 wrote to memory of 5316 4576 798B.tmp 135 PID 5316 wrote to memory of 4448 5316 7A28.tmp 136 PID 4448 wrote to memory of 4972 4448 7AB4.tmp 137 PID 4972 wrote to memory of 1508 4972 7B60.tmp 138 PID 1508 wrote to memory of 2748 1508 7BCD.tmp 139 PID 2748 wrote to memory of 2192 2748 7C4A.tmp 140 PID 2192 wrote to memory of 1660 2192 7CE7.tmp 141 PID 764 wrote to memory of 6020 764 7E10.tmp 143 PID 6020 wrote to memory of 2340 6020 7E8D.tmp 144 PID 2340 wrote to memory of 5012 2340 7F0A.tmp 145 PID 5012 wrote to memory of 1708 5012 7F87.tmp 146 PID 1708 wrote to memory of 2828 1708 7FF4.tmp 147 PID 2828 wrote to memory of 1128 2828 8071.tmp 148 PID 1128 wrote to memory of 4980 1128 80EE.tmp 149 PID 4980 wrote to memory of 1080 4980 816B.tmp 150 PID 1080 wrote to memory of 5680 1080 81F8.tmp 151 PID 5680 wrote to memory of 2160 5680 8265.tmp 152 PID 2160 wrote to memory of 3032 2160 8301.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_588d4d77168720539b29d1954b802a3d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_588d4d77168720539b29d1954b802a3d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5318.tmp"C:\Users\Admin\AppData\Local\Temp\5318.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5DE5.tmp"C:\Users\Admin\AppData\Local\Temp\5DE5.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6279.tmp"C:\Users\Admin\AppData\Local\Temp\6279.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6373.tmp"C:\Users\Admin\AppData\Local\Temp\6373.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\68A3.tmp"C:\Users\Admin\AppData\Local\Temp\68A3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\69DC.tmp"C:\Users\Admin\AppData\Local\Temp\69DC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\6F89.tmp"C:\Users\Admin\AppData\Local\Temp\6F89.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\71BB.tmp"C:\Users\Admin\AppData\Local\Temp\71BB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\744C.tmp"C:\Users\Admin\AppData\Local\Temp\744C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\75A3.tmp"C:\Users\Admin\AppData\Local\Temp\75A3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\770B.tmp"C:\Users\Admin\AppData\Local\Temp\770B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7A28.tmp"C:\Users\Admin\AppData\Local\Temp\7A28.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\7BCD.tmp"C:\Users\Admin\AppData\Local\Temp\7BCD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7D73.tmp"C:\Users\Admin\AppData\Local\Temp\7D73.tmp"54⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"55⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8071.tmp"C:\Users\Admin\AppData\Local\Temp\8071.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\80EE.tmp"C:\Users\Admin\AppData\Local\Temp\80EE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\816B.tmp"C:\Users\Admin\AppData\Local\Temp\816B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"66⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"67⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"68⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\8553.tmp"C:\Users\Admin\AppData\Local\Temp\8553.tmp"69⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\85FF.tmp"C:\Users\Admin\AppData\Local\Temp\85FF.tmp"70⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"71⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"72⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8795.tmp"C:\Users\Admin\AppData\Local\Temp\8795.tmp"73⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"74⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"75⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"76⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\89C8.tmp"C:\Users\Admin\AppData\Local\Temp\89C8.tmp"77⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\8A35.tmp"C:\Users\Admin\AppData\Local\Temp\8A35.tmp"78⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"79⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"80⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"81⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"82⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"83⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"84⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"85⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"86⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"87⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"88⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"89⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\905F.tmp"C:\Users\Admin\AppData\Local\Temp\905F.tmp"90⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\90EC.tmp"C:\Users\Admin\AppData\Local\Temp\90EC.tmp"91⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"92⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"93⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"94⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\92EF.tmp"C:\Users\Admin\AppData\Local\Temp\92EF.tmp"95⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"96⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"97⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\9447.tmp"C:\Users\Admin\AppData\Local\Temp\9447.tmp"98⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\94C4.tmp"C:\Users\Admin\AppData\Local\Temp\94C4.tmp"99⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"100⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"102⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"103⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"104⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"105⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"106⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"107⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\9968.tmp"C:\Users\Admin\AppData\Local\Temp\9968.tmp"108⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"109⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"110⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"111⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"112⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"113⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"114⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"115⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"116⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"117⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"118⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"119⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\9F72.tmp"C:\Users\Admin\AppData\Local\Temp\9F72.tmp"120⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"121⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:3252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-