Analysis
- max time kernel
119s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 19:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5ef04a1104465af06e73d8bb0b84170e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5ef04a1104465af06e73d8bb0b84170e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-20_5ef04a1104465af06e73d8bb0b84170e_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260720-x5xemaex21
- SHA256 59c26f2016d3fe483d9f27155d9a40d5ada5c1117690d11260bc8353643fa9c4
- MD5 5ef04a1104465af06e73d8bb0b84170e
- SHA1 a24132de7f99a548a3118d2a573aa30154ae476c
- SHA512 8e0b8033af632dece1d9e79568968888f45055cc744ca5c1e004391abe3eb9b63a9f69b9d569d9a06048c547dd3e28b19172a51530370277458bc1bbf6ec62ab
- SSDEEP 12288:wU5rCOTeiDySzvCxHZKCPExvxTCf65X9TFWFRjNZ+3/v+I9hUG2VA:wUQOJDyyCx5dspxTm6Z/WnjNGEA
- TLSH T152E4E12073D88536E9F7037859B5F6654E7EBD266722D6CF2F8412AE0971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5196 15D0.tmp 1808 16E9.tmp 5648 1812.tmp 4148 18AE.tmp 1952 192B.tmp 1240 1A06.tmp 2800 1A74.tmp 1668 1B2F.tmp 5516 1BAC.tmp 1568 1C96.tmp 2888 1DDF.tmp 1984 1E4C.tmp 5392 1EE8.tmp 3452 1F75.tmp 4500 2011.tmp 1584 20AD.tmp 4892 2198.tmp 252 2244.tmp 3748 22FF.tmp 4700 239B.tmp 1308 2418.tmp 2516 24C4.tmp 4192 258F.tmp 4472 264B.tmp 4272 26E7.tmp 3064 2793.tmp 3608 286E.tmp 3364 2958.tmp 4560 29E5.tmp 5136 2A71.tmp 4912 2B2D.tmp 1420 2BE8.tmp 2376 2C85.tmp 3220 2D02.tmp 3816 2DAD.tmp 3972 2E0B.tmp 1088 2E88.tmp 4456 2EF6.tmp 2324 2F63.tmp 2712 2FF0.tmp 2360 309B.tmp 4372 3157.tmp 928 31F3.tmp 4592 3261.tmp 5152 32BE.tmp 1896 331C.tmp 3312 3389.tmp 2732 3406.tmp 1316 3483.tmp 5556 34E1.tmp 808 354F.tmp 1608 35DB.tmp 5992 3639.tmp 1388 36A6.tmp 2128 3714.tmp 4484 37EE.tmp 3928 386B.tmp 4716 38D9.tmp 5140 3956.tmp 2540 39E2.tmp 2460 3A50.tmp 2620 3ACD.tmp 5568 3B3A.tmp 5492 3BB7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B20B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5FA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 5196 3480 2026-07-20_5ef04a1104465af06e73d8bb0b84170e_elex_mafia_stealc_tofsee.exe 89 PID 5196 wrote to memory of 1808 5196 15D0.tmp 90 PID 1808 wrote to memory of 5648 1808 16E9.tmp 91 PID 5648 wrote to memory of 4148 5648 1812.tmp 92 PID 4148 wrote to memory of 1952 4148 18AE.tmp 93 PID 1952 wrote to memory of 1240 1952 192B.tmp 94 PID 1240 wrote to memory of 2800 1240 1A06.tmp 95 PID 2800 wrote to memory of 1668 2800 1A74.tmp 96 PID 1668 wrote to memory of 5516 1668 1B2F.tmp 97 PID 5516 wrote to memory of 1568 5516 1BAC.tmp 98 PID 1568 wrote to memory of 2888 1568 1C96.tmp 99 PID 2888 wrote to memory of 1984 2888 1DDF.tmp 100 PID 1984 wrote to memory of 5392 1984 1E4C.tmp 101 PID 5392 wrote to memory of 3452 5392 1EE8.tmp 102 PID 3452 wrote to memory of 4500 3452 1F75.tmp 103 PID 4500 wrote to memory of 1584 4500 2011.tmp 104 PID 1584 wrote to memory of 4892 1584 20AD.tmp 105 PID 4892 wrote to memory of 252 4892 2198.tmp 106 PID 252 wrote to memory of 3748 252 2244.tmp 107 PID 3748 wrote to memory of 4700 3748 22FF.tmp 108 PID 4700 wrote to memory of 1308 4700 239B.tmp 109 PID 1308 wrote to memory of 2516 1308 2418.tmp 110 PID 2516 wrote to memory of 4192 2516 24C4.tmp 111 PID 4192 wrote to memory of 4472 4192 258F.tmp 112 PID 4472 wrote to memory of 4272 4472 264B.tmp 113 PID 4272 wrote to memory of 3064 4272 26E7.tmp 114 PID 3064 wrote to memory of 3608 3064 2793.tmp 115 PID 3608 wrote to memory of 3364 3608 286E.tmp 116 PID 3364 wrote to memory of 4560 3364 2958.tmp 117 PID 4560 wrote to memory of 5136 4560 29E5.tmp 118 PID 5136 wrote to memory of 4912 5136 2A71.tmp 119 PID 4912 wrote to memory of 1420 4912 2B2D.tmp 120 PID 1420 wrote to memory of 2376 1420 2BE8.tmp 121 PID 2376 wrote to memory of 3220 2376 2C85.tmp 122 PID 3220 wrote to memory of 3816 3220 2D02.tmp 123 PID 3816 wrote to memory of 3972 3816 2DAD.tmp 124 PID 3972 wrote to memory of 1088 3972 2E0B.tmp 125 PID 1088 wrote to memory of 4456 1088 2E88.tmp 126 PID 4456 wrote to memory of 2324 4456 2EF6.tmp 127 PID 2324 wrote to memory of 2712 2324 2F63.tmp 128 PID 2712 wrote to memory of 2360 2712 2FF0.tmp 129 PID 2360 wrote to memory of 4372 2360 309B.tmp 130 PID 4372 wrote to memory of 928 4372 3157.tmp 131 PID 928 wrote to memory of 4592 928 31F3.tmp 132 PID 4592 wrote to memory of 5152 4592 3261.tmp 133 PID 5152 wrote to memory of 1896 5152 32BE.tmp 134 PID 1896 wrote to memory of 3312 1896 331C.tmp 135 PID 3312 wrote to memory of 2732 3312 3389.tmp 136 PID 2732 wrote to memory of 1316 2732 3406.tmp 137 PID 1316 wrote to memory of 5556 1316 3483.tmp 138 PID 5556 wrote to memory of 808 5556 34E1.tmp 139 PID 808 wrote to memory of 1608 808 354F.tmp 140 PID 1608 wrote to memory of 5992 1608 35DB.tmp 141 PID 5992 wrote to memory of 1388 5992 3639.tmp 142 PID 1388 wrote to memory of 2128 1388 36A6.tmp 143 PID 5360 wrote to memory of 4484 5360 3791.tmp 145 PID 4484 wrote to memory of 3928 4484 37EE.tmp 146 PID 3928 wrote to memory of 4716 3928 386B.tmp 147 PID 4716 wrote to memory of 5140 4716 38D9.tmp 148 PID 5140 wrote to memory of 2540 5140 3956.tmp 149 PID 2540 wrote to memory of 2460 2540 39E2.tmp 150 PID 2460 wrote to memory of 2620 2460 3A50.tmp 151 PID 2620 wrote to memory of 5568 2620 3ACD.tmp 152 PID 5568 wrote to memory of 5492 5568 3B3A.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5ef04a1104465af06e73d8bb0b84170e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5ef04a1104465af06e73d8bb0b84170e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\15D0.tmp"C:\Users\Admin\AppData\Local\Temp\15D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1812.tmp"C:\Users\Admin\AppData\Local\Temp\1812.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\18AE.tmp"C:\Users\Admin\AppData\Local\Temp\18AE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\192B.tmp"C:\Users\Admin\AppData\Local\Temp\192B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1A74.tmp"C:\Users\Admin\AppData\Local\Temp\1A74.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\20AD.tmp"C:\Users\Admin\AppData\Local\Temp\20AD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\2198.tmp"C:\Users\Admin\AppData\Local\Temp\2198.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\2244.tmp"C:\Users\Admin\AppData\Local\Temp\2244.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\239B.tmp"C:\Users\Admin\AppData\Local\Temp\239B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\258F.tmp"C:\Users\Admin\AppData\Local\Temp\258F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\264B.tmp"C:\Users\Admin\AppData\Local\Temp\264B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\286E.tmp"C:\Users\Admin\AppData\Local\Temp\286E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2D02.tmp"C:\Users\Admin\AppData\Local\Temp\2D02.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3157.tmp"C:\Users\Admin\AppData\Local\Temp\3157.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\31F3.tmp"C:\Users\Admin\AppData\Local\Temp\31F3.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\32BE.tmp"C:\Users\Admin\AppData\Local\Temp\32BE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3406.tmp"C:\Users\Admin\AppData\Local\Temp\3406.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\36A6.tmp"C:\Users\Admin\AppData\Local\Temp\36A6.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3714.tmp"C:\Users\Admin\AppData\Local\Temp\3714.tmp"56⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"57⤵
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\37EE.tmp"C:\Users\Admin\AppData\Local\Temp\37EE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\386B.tmp"C:\Users\Admin\AppData\Local\Temp\386B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"67⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"68⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"69⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"70⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"71⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\3EC4.tmp"C:\Users\Admin\AppData\Local\Temp\3EC4.tmp"72⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3F41.tmp"C:\Users\Admin\AppData\Local\Temp\3F41.tmp"73⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"74⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"75⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"76⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"77⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\41A3.tmp"C:\Users\Admin\AppData\Local\Temp\41A3.tmp"78⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"79⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"80⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"81⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"82⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"83⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"84⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"85⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\45C9.tmp"C:\Users\Admin\AppData\Local\Temp\45C9.tmp"86⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\4656.tmp"C:\Users\Admin\AppData\Local\Temp\4656.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\46E3.tmp"C:\Users\Admin\AppData\Local\Temp\46E3.tmp"88⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"90⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\485A.tmp"C:\Users\Admin\AppData\Local\Temp\485A.tmp"91⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"93⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"94⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"95⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"96⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"97⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\4C32.tmp"C:\Users\Admin\AppData\Local\Temp\4C32.tmp"99⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"100⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"101⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"102⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4E84.tmp"C:\Users\Admin\AppData\Local\Temp\4E84.tmp"103⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"104⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"105⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"107⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\50E5.tmp"C:\Users\Admin\AppData\Local\Temp\50E5.tmp"108⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"109⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"110⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"111⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"112⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5375.tmp"C:\Users\Admin\AppData\Local\Temp\5375.tmp"113⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"114⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"115⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\54DD.tmp"C:\Users\Admin\AppData\Local\Temp\54DD.tmp"116⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"117⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\55B7.tmp"C:\Users\Admin\AppData\Local\Temp\55B7.tmp"118⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"119⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\56A2.tmp"C:\Users\Admin\AppData\Local\Temp\56A2.tmp"120⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"121⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\578C.tmp"C:\Users\Admin\AppData\Local\Temp\578C.tmp"122⤵PID:1848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-