Analysis
- max time kernel
131s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_d37b6d8d4041dfed927ed3b1878b5bfe_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_d37b6d8d4041dfed927ed3b1878b5bfe_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-22_d37b6d8d4041dfed927ed3b1878b5bfe_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260722-xvbeeabb27
- SHA256 1b3d1ec23cff432794d34bc6c694963487eaad201704d2a0e4014bb111228e9c
- MD5 d37b6d8d4041dfed927ed3b1878b5bfe
- SHA1 3cbabef47cab9bfcd5a0d1bc01f1905c44d4154e
- SHA512 7522c7b67a9e4c85b8d27e8333a66d96d9e16c4c92ab3422ca1995e85b5fd261d57067409f9f2cec42999c91b0fcf09f58231fa23ee6e4cf41630c4744f8184c
- SSDEEP 12288:9U5rCOTei6rYnh5MJlyqSmu1Vc0qZoXWjdqpby1grA70G+o:9UQOJ6SMJlVSmu1y0qqGh4yATXo
- TLSH T18CE40221B545C032E99602308FE6DBB1693ABD715B2264C37BC47B6E6FB02D2D27435B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4624 A195.tmp 3068 A270.tmp 4476 A30C.tmp 5012 A3C8.tmp 5828 A493.tmp 4380 A59D.tmp 2696 A723.tmp 4432 A7CF.tmp 2516 A83C.tmp 4608 A8AA.tmp 2112 A9A4.tmp 5020 AA9E.tmp 5080 AB4A.tmp 6004 AC24.tmp 3048 ACE0.tmp 5856 AD6D.tmp 1620 AE47.tmp 3764 AEF3.tmp 240 AFBE.tmp 1108 B01C.tmp 3744 B07A.tmp 2780 B193.tmp 2972 B24F.tmp 4636 B2FA.tmp 2396 B3B6.tmp 5224 B471.tmp 5420 B51D.tmp 5312 B59A.tmp 2636 B608.tmp 1252 B6E2.tmp 3972 B7AE.tmp 2568 B869.tmp 1900 B915.tmp 5412 B982.tmp 5368 BA0F.tmp 4592 BAAB.tmp 3644 BB38.tmp 5180 BBC4.tmp 5876 BC61.tmp 1508 BCED.tmp 2652 BD99.tmp 4444 BE26.tmp 5896 BEA3.tmp 4472 BF4F.tmp 5408 BFEB.tmp 3704 C078.tmp 4844 C123.tmp 5952 C1A0.tmp 1572 C22D.tmp 2084 C2AA.tmp 6100 C346.tmp 5660 C3D3.tmp 964 C450.tmp 3948 C4DD.tmp 5708 C569.tmp 5692 C5F6.tmp 1156 C682.tmp 6092 C6F0.tmp 4260 C78C.tmp 5296 C809.tmp 5284 C896.tmp 4568 C913.tmp 5812 C9AF.tmp 4588 CA4B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2900.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9319.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 801E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 917E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6056 wrote to memory of 4624 6056 2026-07-22_d37b6d8d4041dfed927ed3b1878b5bfe_elex_mafia_stealc_tofsee.exe 89 PID 4624 wrote to memory of 3068 4624 A195.tmp 90 PID 3068 wrote to memory of 4476 3068 A270.tmp 91 PID 4476 wrote to memory of 5012 4476 A30C.tmp 92 PID 5012 wrote to memory of 5828 5012 A3C8.tmp 93 PID 5828 wrote to memory of 4380 5828 A493.tmp 94 PID 4380 wrote to memory of 2696 4380 A59D.tmp 95 PID 2696 wrote to memory of 4432 2696 A723.tmp 96 PID 4432 wrote to memory of 2516 4432 A7CF.tmp 97 PID 2516 wrote to memory of 4608 2516 A83C.tmp 98 PID 4608 wrote to memory of 2112 4608 A8AA.tmp 99 PID 2112 wrote to memory of 5020 2112 A9A4.tmp 100 PID 5020 wrote to memory of 5080 5020 AA9E.tmp 101 PID 5080 wrote to memory of 6004 5080 AB4A.tmp 102 PID 6004 wrote to memory of 3048 6004 AC24.tmp 103 PID 3048 wrote to memory of 5856 3048 ACE0.tmp 104 PID 5856 wrote to memory of 1620 5856 AD6D.tmp 105 PID 1620 wrote to memory of 3764 1620 AE47.tmp 106 PID 3764 wrote to memory of 240 3764 AEF3.tmp 107 PID 240 wrote to memory of 1108 240 AFBE.tmp 108 PID 1108 wrote to memory of 3744 1108 B01C.tmp 109 PID 3744 wrote to memory of 2780 3744 B07A.tmp 110 PID 2780 wrote to memory of 2972 2780 B193.tmp 111 PID 2972 wrote to memory of 4636 2972 B24F.tmp 112 PID 4636 wrote to memory of 2396 4636 B2FA.tmp 113 PID 2396 wrote to memory of 5224 2396 B3B6.tmp 114 PID 5224 wrote to memory of 5420 5224 B471.tmp 115 PID 5420 wrote to memory of 5312 5420 B51D.tmp 116 PID 5312 wrote to memory of 2636 5312 B59A.tmp 117 PID 2636 wrote to memory of 1252 2636 B608.tmp 118 PID 1252 wrote to memory of 3972 1252 B6E2.tmp 119 PID 3972 wrote to memory of 2568 3972 B7AE.tmp 120 PID 2568 wrote to memory of 1900 2568 B869.tmp 121 PID 1900 wrote to memory of 5412 1900 B915.tmp 122 PID 5412 wrote to memory of 5368 5412 B982.tmp 123 PID 5368 wrote to memory of 4592 5368 BA0F.tmp 124 PID 4592 wrote to memory of 3644 4592 BAAB.tmp 125 PID 3644 wrote to memory of 5180 3644 BB38.tmp 126 PID 5180 wrote to memory of 5876 5180 BBC4.tmp 127 PID 5876 wrote to memory of 1508 5876 BC61.tmp 128 PID 1508 wrote to memory of 2652 1508 BCED.tmp 129 PID 2652 wrote to memory of 4444 2652 BD99.tmp 130 PID 4444 wrote to memory of 5896 4444 BE26.tmp 131 PID 5896 wrote to memory of 4472 5896 BEA3.tmp 132 PID 4472 wrote to memory of 5408 4472 BF4F.tmp 133 PID 5408 wrote to memory of 3704 5408 BFEB.tmp 134 PID 3704 wrote to memory of 4844 3704 C078.tmp 135 PID 4844 wrote to memory of 5952 4844 C123.tmp 136 PID 5952 wrote to memory of 1572 5952 C1A0.tmp 137 PID 1572 wrote to memory of 2084 1572 C22D.tmp 138 PID 2084 wrote to memory of 6100 2084 C2AA.tmp 139 PID 6100 wrote to memory of 5660 6100 C346.tmp 140 PID 5660 wrote to memory of 964 5660 C3D3.tmp 141 PID 964 wrote to memory of 3948 964 C450.tmp 142 PID 3948 wrote to memory of 5708 3948 C4DD.tmp 143 PID 5708 wrote to memory of 5692 5708 C569.tmp 144 PID 5692 wrote to memory of 1156 5692 C5F6.tmp 145 PID 1156 wrote to memory of 6092 1156 C682.tmp 146 PID 6092 wrote to memory of 4260 6092 C6F0.tmp 147 PID 4260 wrote to memory of 5296 4260 C78C.tmp 148 PID 5296 wrote to memory of 5284 5296 C809.tmp 149 PID 5284 wrote to memory of 4568 5284 C896.tmp 150 PID 4568 wrote to memory of 5812 4568 C913.tmp 151 PID 5812 wrote to memory of 4588 5812 C9AF.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_d37b6d8d4041dfed927ed3b1878b5bfe_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_d37b6d8d4041dfed927ed3b1878b5bfe_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A30C.tmp"C:\Users\Admin\AppData\Local\Temp\A30C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\A83C.tmp"C:\Users\Admin\AppData\Local\Temp\A83C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"C:\Users\Admin\AppData\Local\Temp\AA9E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\AB4A.tmp"C:\Users\Admin\AppData\Local\Temp\AB4A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\B6E2.tmp"C:\Users\Admin\AppData\Local\Temp\B6E2.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\B915.tmp"C:\Users\Admin\AppData\Local\Temp\B915.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\BB38.tmp"C:\Users\Admin\AppData\Local\Temp\BB38.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\C078.tmp"C:\Users\Admin\AppData\Local\Temp\C078.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\C346.tmp"C:\Users\Admin\AppData\Local\Temp\C346.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\C450.tmp"C:\Users\Admin\AppData\Local\Temp\C450.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\C682.tmp"C:\Users\Admin\AppData\Local\Temp\C682.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\C896.tmp"C:\Users\Admin\AppData\Local\Temp\C896.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"65⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"66⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\CB36.tmp"C:\Users\Admin\AppData\Local\Temp\CB36.tmp"67⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"68⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"69⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"70⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"71⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"72⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"73⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\CE91.tmp"C:\Users\Admin\AppData\Local\Temp\CE91.tmp"74⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"75⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"76⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\D037.tmp"C:\Users\Admin\AppData\Local\Temp\D037.tmp"77⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"78⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"79⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"80⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\D279.tmp"C:\Users\Admin\AppData\Local\Temp\D279.tmp"81⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"82⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\D383.tmp"C:\Users\Admin\AppData\Local\Temp\D383.tmp"83⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"84⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\D4AB.tmp"C:\Users\Admin\AppData\Local\Temp\D4AB.tmp"85⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"86⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\D661.tmp"C:\Users\Admin\AppData\Local\Temp\D661.tmp"88⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"89⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"90⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"92⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\D95F.tmp"C:\Users\Admin\AppData\Local\Temp\D95F.tmp"93⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"94⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"95⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"96⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\DB91.tmp"C:\Users\Admin\AppData\Local\Temp\DB91.tmp"97⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"98⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"99⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"100⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"101⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"102⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"103⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"104⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"105⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\E044.tmp"C:\Users\Admin\AppData\Local\Temp\E044.tmp"107⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"108⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"109⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"110⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\E286.tmp"C:\Users\Admin\AppData\Local\Temp\E286.tmp"111⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"112⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"113⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"114⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"115⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\E574.tmp"C:\Users\Admin\AppData\Local\Temp\E574.tmp"116⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"117⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"118⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"119⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"120⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"122⤵PID:1312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-