Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_73707dffcb43513dae9d82abfc37dbac_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_73707dffcb43513dae9d82abfc37dbac_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-23_73707dffcb43513dae9d82abfc37dbac_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260723-bmtecsck2v
- SHA256 2b335b66eb0fc70634c1def2cdef9e92f6a0acbd8ae875bd2a8a4376d6398a04
- MD5 73707dffcb43513dae9d82abfc37dbac
- SHA1 ca51d48390fc0e5cff20c3358397ee358fe878b3
- SHA512 8f44dea12a28f638913cabacecca1aab261de9e361fb0aa18a588afd03e579cf2547dc9a2d8523c2750a1ca5c0331fa9af7e5cabd8a7f599d712cc9bf3ad88c7
- SSDEEP 12288:wU5rCOTeiDPn+vpS6NvpFn4VNZ+3/v+I9hUG2VA:wUQOJDPU7vpFWNGEA
- TLSH T1A1E4D02073D88536E5FB037859B5E6644D7EBD32A722D6CF2F8015AE4A71BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4836 48EB.tmp 4396 4A33.tmp 5116 4B5C.tmp 3744 4D9E.tmp 3468 4E69.tmp 400 4F63.tmp 4468 505D.tmp 3224 5186.tmp 4276 52CE.tmp 3004 53D8.tmp 1588 5436.tmp 1688 54B3.tmp 3344 5530.tmp 2932 558D.tmp 4204 55EB.tmp 2644 5649.tmp 972 56B6.tmp 1692 5733.tmp 2344 5781.tmp 4644 57CF.tmp 1880 582D.tmp 4372 588B.tmp 1368 58D9.tmp 2152 5927.tmp 4712 5975.tmp 1832 59D3.tmp 4744 5A21.tmp 636 5A6F.tmp 2388 5ABD.tmp 5096 5B0C.tmp 2604 5B79.tmp 3752 5BC7.tmp 60 5C25.tmp 4760 5C83.tmp 1416 5CE0.tmp 3640 5D2E.tmp 1408 5D7D.tmp 4476 5DCB.tmp 2216 5E19.tmp 2212 5E67.tmp 1340 5EB5.tmp 4408 5F22.tmp 3684 5F71.tmp 4832 5FCE.tmp 3896 603C.tmp 2808 608A.tmp 3456 60D8.tmp 3884 6126.tmp 1384 6193.tmp 4732 61F1.tmp 4128 625F.tmp 4048 62BC.tmp 3928 632A.tmp 3320 6378.tmp 3888 63C6.tmp 4332 6414.tmp 3916 6462.tmp 3860 64B0.tmp 1092 652D.tmp 2124 657B.tmp 3992 65D9.tmp 4180 6647.tmp 960 6695.tmp 3412 66E3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 693F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A89F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 949A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ECE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E0D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 4836 3576 2026-07-23_73707dffcb43513dae9d82abfc37dbac_elex_mafia_stealc_tofsee.exe 85 PID 4836 wrote to memory of 4396 4836 48EB.tmp 86 PID 4396 wrote to memory of 5116 4396 4A33.tmp 87 PID 5116 wrote to memory of 3744 5116 4B5C.tmp 88 PID 3744 wrote to memory of 3468 3744 4D9E.tmp 89 PID 3468 wrote to memory of 400 3468 4E69.tmp 90 PID 400 wrote to memory of 4468 400 4F63.tmp 91 PID 4468 wrote to memory of 3224 4468 505D.tmp 92 PID 3224 wrote to memory of 4276 3224 5186.tmp 93 PID 4276 wrote to memory of 3004 4276 52CE.tmp 94 PID 3004 wrote to memory of 1588 3004 53D8.tmp 95 PID 1588 wrote to memory of 1688 1588 5436.tmp 96 PID 1688 wrote to memory of 3344 1688 54B3.tmp 97 PID 3344 wrote to memory of 2932 3344 5530.tmp 98 PID 2932 wrote to memory of 4204 2932 558D.tmp 99 PID 4204 wrote to memory of 2644 4204 55EB.tmp 100 PID 2644 wrote to memory of 972 2644 5649.tmp 101 PID 972 wrote to memory of 1692 972 56B6.tmp 102 PID 1692 wrote to memory of 2344 1692 5733.tmp 103 PID 2344 wrote to memory of 4644 2344 5781.tmp 104 PID 4644 wrote to memory of 1880 4644 57CF.tmp 105 PID 1880 wrote to memory of 4372 1880 582D.tmp 106 PID 4372 wrote to memory of 1368 4372 588B.tmp 107 PID 1368 wrote to memory of 2152 1368 58D9.tmp 108 PID 2152 wrote to memory of 4712 2152 5927.tmp 109 PID 4712 wrote to memory of 1832 4712 5975.tmp 110 PID 1832 wrote to memory of 4744 1832 59D3.tmp 111 PID 4744 wrote to memory of 636 4744 5A21.tmp 112 PID 636 wrote to memory of 2388 636 5A6F.tmp 113 PID 2388 wrote to memory of 5096 2388 5ABD.tmp 114 PID 5096 wrote to memory of 2604 5096 5B0C.tmp 115 PID 2604 wrote to memory of 3752 2604 5B79.tmp 116 PID 3752 wrote to memory of 60 3752 5BC7.tmp 117 PID 60 wrote to memory of 4760 60 5C25.tmp 118 PID 4760 wrote to memory of 1416 4760 5C83.tmp 119 PID 1416 wrote to memory of 3640 1416 5CE0.tmp 120 PID 3640 wrote to memory of 1408 3640 5D2E.tmp 121 PID 1408 wrote to memory of 4476 1408 5D7D.tmp 122 PID 4476 wrote to memory of 2216 4476 5DCB.tmp 123 PID 2216 wrote to memory of 2212 2216 5E19.tmp 124 PID 2212 wrote to memory of 1340 2212 5E67.tmp 125 PID 1340 wrote to memory of 4408 1340 5EB5.tmp 126 PID 4408 wrote to memory of 3684 4408 5F22.tmp 127 PID 3684 wrote to memory of 4832 3684 5F71.tmp 128 PID 4832 wrote to memory of 3896 4832 5FCE.tmp 129 PID 3896 wrote to memory of 2808 3896 603C.tmp 130 PID 2808 wrote to memory of 3456 2808 608A.tmp 131 PID 3456 wrote to memory of 3884 3456 60D8.tmp 132 PID 3884 wrote to memory of 1384 3884 6126.tmp 133 PID 1384 wrote to memory of 4732 1384 6193.tmp 134 PID 4732 wrote to memory of 4128 4732 61F1.tmp 135 PID 4128 wrote to memory of 4048 4128 625F.tmp 136 PID 4048 wrote to memory of 3928 4048 62BC.tmp 137 PID 3928 wrote to memory of 3320 3928 632A.tmp 138 PID 3320 wrote to memory of 3888 3320 6378.tmp 139 PID 3888 wrote to memory of 4332 3888 63C6.tmp 140 PID 4332 wrote to memory of 3916 4332 6414.tmp 141 PID 3916 wrote to memory of 3860 3916 6462.tmp 142 PID 3860 wrote to memory of 1092 3860 64B0.tmp 143 PID 1092 wrote to memory of 2124 1092 652D.tmp 144 PID 2124 wrote to memory of 3992 2124 657B.tmp 145 PID 3992 wrote to memory of 4180 3992 65D9.tmp 146 PID 4180 wrote to memory of 960 4180 6647.tmp 147 PID 960 wrote to memory of 3412 960 6695.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_73707dffcb43513dae9d82abfc37dbac_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_73707dffcb43513dae9d82abfc37dbac_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\4E69.tmp"C:\Users\Admin\AppData\Local\Temp\4E69.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5733.tmp"C:\Users\Admin\AppData\Local\Temp\5733.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\588B.tmp"C:\Users\Admin\AppData\Local\Temp\588B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\603C.tmp"C:\Users\Admin\AppData\Local\Temp\603C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\61F1.tmp"C:\Users\Admin\AppData\Local\Temp\61F1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\62BC.tmp"C:\Users\Admin\AppData\Local\Temp\62BC.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\632A.tmp"C:\Users\Admin\AppData\Local\Temp\632A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\6378.tmp"C:\Users\Admin\AppData\Local\Temp\6378.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"65⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"66⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"67⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"68⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"69⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"70⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"71⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"72⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"73⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"74⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"75⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"77⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6C80.tmp"C:\Users\Admin\AppData\Local\Temp\6C80.tmp"78⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"79⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"80⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"81⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"82⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"83⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"84⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"85⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"86⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"87⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"88⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"89⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"90⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"91⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"92⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"93⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"94⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\71FF.tmp"C:\Users\Admin\AppData\Local\Temp\71FF.tmp"95⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"96⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"97⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"98⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7337.tmp"C:\Users\Admin\AppData\Local\Temp\7337.tmp"99⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\7385.tmp"C:\Users\Admin\AppData\Local\Temp\7385.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"101⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"102⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"103⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\750C.tmp"C:\Users\Admin\AppData\Local\Temp\750C.tmp"104⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"105⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"106⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"107⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"108⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\771F.tmp"C:\Users\Admin\AppData\Local\Temp\771F.tmp"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"110⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"111⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"112⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"113⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"114⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"115⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\79CF.tmp"C:\Users\Admin\AppData\Local\Temp\79CF.tmp"116⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"117⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"118⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"119⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"120⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"121⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"122⤵PID:4052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-