Analysis
- max time kernel
134s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 07:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_5beab1399b74241939b919c2a9adea75_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_5beab1399b74241939b919c2a9adea75_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_5beab1399b74241939b919c2a9adea75_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260804-hzdyrsfa35
- SHA256 5213237de30323a987d97cd37cf5373939a651b590612b1952a72c98f162d1f9
- MD5 5beab1399b74241939b919c2a9adea75
- SHA1 1c1b52689888f3868e3c5cde3ba62c72239c871e
- SHA512 5e6205db372939432fc837c72fe2c3fcdde899f97da95874982ba2d0ffbe97bf3cec46fe413d9d2094bf01c100ccb9373901c281821f3292f18aa2870f83aaa3
- SSDEEP 12288:wU5rCOTeiDE82NdAKuhWfDwPX9VmtFu2NZ+3/v+I9hUG2VA:wUQOJDH2NSiWgY2NGEA
- TLSH T136E4D02173D88132D5FB037859B5F6615D7EBD32A722D6DF2B9062AE0A71BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5860 D6E3.tmp 4644 D82B.tmp 4612 D992.tmp 3332 DB19.tmp 3264 DC80.tmp 5484 DD1C.tmp 2572 DE55.tmp 2988 DFCC.tmp 3296 E0E5.tmp 1672 E1C0.tmp 4324 E356.tmp 5280 E450.tmp 2796 E54A.tmp 1804 E625.tmp 244 E6F0.tmp 2172 E76D.tmp 916 E7EA.tmp 4316 EA1D.tmp 4372 EB17.tmp 4788 EC4F.tmp 5564 ED68.tmp 3112 EEC0.tmp 1264 F027.tmp 3224 F150.tmp 3740 F2C7.tmp 6040 F3F0.tmp 5432 F46D.tmp 3400 F5E4.tmp 1820 F70D.tmp 3300 F817.tmp 4288 F911.tmp 5156 F9FB.tmp 1776 FAE5.tmp 4976 FB72.tmp 1500 FC4D.tmp 1668 FCE9.tmp 5660 FDA5.tmp 2736 FE9F.tmp 4816 FFA8.tmp 6104 93.tmp 5152 12F.tmp 3572 1AC.tmp 4228 248.tmp 1152 304.tmp 4416 3AF.tmp 1228 47B.tmp 3836 546.tmp 4280 630.tmp 2712 6AD.tmp 5952 73A.tmp 5556 7C6.tmp 1148 872.tmp 4680 93D.tmp 3452 9DA.tmp 5948 A57.tmp 4204 AC4.tmp 2520 B60.tmp 3680 C0C.tmp 3408 CA8.tmp 1084 D25.tmp 4832 DD1.tmp 1972 E6D.tmp 4516 EEA.tmp 4560 F77.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 975F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C44B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 807C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 672C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B065.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5313.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 5860 2524 2026-08-04_5beab1399b74241939b919c2a9adea75_elex_mafia_stealc_tofsee.exe 90 PID 5860 wrote to memory of 4644 5860 D6E3.tmp 91 PID 4644 wrote to memory of 4612 4644 D82B.tmp 92 PID 4612 wrote to memory of 3332 4612 D992.tmp 93 PID 3332 wrote to memory of 3264 3332 DB19.tmp 94 PID 3264 wrote to memory of 5484 3264 DC80.tmp 95 PID 5484 wrote to memory of 2572 5484 DD1C.tmp 96 PID 2572 wrote to memory of 2988 2572 DE55.tmp 97 PID 2988 wrote to memory of 3296 2988 DFCC.tmp 98 PID 3296 wrote to memory of 1672 3296 E0E5.tmp 99 PID 1672 wrote to memory of 4324 1672 E1C0.tmp 100 PID 4324 wrote to memory of 5280 4324 E356.tmp 101 PID 5280 wrote to memory of 2796 5280 E450.tmp 102 PID 2796 wrote to memory of 1804 2796 E54A.tmp 103 PID 1804 wrote to memory of 244 1804 E625.tmp 104 PID 244 wrote to memory of 2172 244 E6F0.tmp 105 PID 2172 wrote to memory of 916 2172 E76D.tmp 106 PID 916 wrote to memory of 4316 916 E7EA.tmp 107 PID 4316 wrote to memory of 4372 4316 EA1D.tmp 108 PID 4372 wrote to memory of 4788 4372 EB17.tmp 109 PID 4788 wrote to memory of 5564 4788 EC4F.tmp 110 PID 5564 wrote to memory of 3112 5564 ED68.tmp 111 PID 3112 wrote to memory of 1264 3112 EEC0.tmp 112 PID 1264 wrote to memory of 3224 1264 F027.tmp 113 PID 3224 wrote to memory of 3740 3224 F150.tmp 114 PID 3740 wrote to memory of 6040 3740 F2C7.tmp 115 PID 6040 wrote to memory of 5432 6040 F3F0.tmp 116 PID 5432 wrote to memory of 3400 5432 F46D.tmp 117 PID 3400 wrote to memory of 1820 3400 F5E4.tmp 118 PID 1820 wrote to memory of 3300 1820 F70D.tmp 119 PID 3300 wrote to memory of 4288 3300 F817.tmp 120 PID 4288 wrote to memory of 5156 4288 F911.tmp 121 PID 5156 wrote to memory of 1776 5156 F9FB.tmp 122 PID 1776 wrote to memory of 4976 1776 FAE5.tmp 123 PID 4976 wrote to memory of 1500 4976 FB72.tmp 124 PID 1500 wrote to memory of 1668 1500 FC4D.tmp 125 PID 1668 wrote to memory of 5660 1668 FCE9.tmp 126 PID 5660 wrote to memory of 2736 5660 FDA5.tmp 127 PID 2736 wrote to memory of 4816 2736 FE9F.tmp 128 PID 4816 wrote to memory of 6104 4816 FFA8.tmp 129 PID 6104 wrote to memory of 5152 6104 93.tmp 130 PID 5152 wrote to memory of 3572 5152 12F.tmp 131 PID 3572 wrote to memory of 4228 3572 1AC.tmp 132 PID 4228 wrote to memory of 1152 4228 248.tmp 133 PID 1152 wrote to memory of 4416 1152 304.tmp 134 PID 4416 wrote to memory of 1228 4416 3AF.tmp 135 PID 1228 wrote to memory of 3836 1228 47B.tmp 136 PID 3836 wrote to memory of 4280 3836 546.tmp 137 PID 4280 wrote to memory of 2712 4280 630.tmp 138 PID 2712 wrote to memory of 5952 2712 6AD.tmp 139 PID 5952 wrote to memory of 5556 5952 73A.tmp 140 PID 5556 wrote to memory of 1148 5556 7C6.tmp 141 PID 1148 wrote to memory of 4680 1148 872.tmp 142 PID 4680 wrote to memory of 3452 4680 93D.tmp 143 PID 3452 wrote to memory of 5948 3452 9DA.tmp 144 PID 5948 wrote to memory of 4204 5948 A57.tmp 145 PID 4204 wrote to memory of 2520 4204 AC4.tmp 146 PID 2520 wrote to memory of 3680 2520 B60.tmp 147 PID 3680 wrote to memory of 3408 3680 C0C.tmp 148 PID 3408 wrote to memory of 1084 3408 CA8.tmp 149 PID 1084 wrote to memory of 4832 1084 D25.tmp 150 PID 4832 wrote to memory of 1972 4832 DD1.tmp 151 PID 1972 wrote to memory of 4516 1972 E6D.tmp 152 PID 4516 wrote to memory of 4560 4516 EEA.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5beab1399b74241939b919c2a9adea75_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5beab1399b74241939b919c2a9adea75_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\E76D.tmp"C:\Users\Admin\AppData\Local\Temp\E76D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\EB17.tmp"C:\Users\Admin\AppData\Local\Temp\EB17.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\F027.tmp"C:\Users\Admin\AppData\Local\Temp\F027.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\F150.tmp"C:\Users\Admin\AppData\Local\Temp\F150.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\F70D.tmp"C:\Users\Admin\AppData\Local\Temp\F70D.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F817.tmp"C:\Users\Admin\AppData\Local\Temp\F817.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\F911.tmp"C:\Users\Admin\AppData\Local\Temp\F911.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\FC4D.tmp"C:\Users\Admin\AppData\Local\Temp\FC4D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\FCE9.tmp"C:\Users\Admin\AppData\Local\Temp\FCE9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\12F.tmp"C:\Users\Admin\AppData\Local\Temp\12F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\1AC.tmp"C:\Users\Admin\AppData\Local\Temp\1AC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\3AF.tmp"C:\Users\Admin\AppData\Local\Temp\3AF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\872.tmp"C:\Users\Admin\AppData\Local\Temp\872.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\A57.tmp"C:\Users\Admin\AppData\Local\Temp\A57.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\AC4.tmp"C:\Users\Admin\AppData\Local\Temp\AC4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\DD1.tmp"C:\Users\Admin\AppData\Local\Temp\DD1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\E6D.tmp"C:\Users\Admin\AppData\Local\Temp\E6D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\EEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"65⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\1081.tmp"C:\Users\Admin\AppData\Local\Temp\1081.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"68⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"69⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"70⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\12D2.tmp"C:\Users\Admin\AppData\Local\Temp\12D2.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\138E.tmp"C:\Users\Admin\AppData\Local\Temp\138E.tmp"72⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\141B.tmp"C:\Users\Admin\AppData\Local\Temp\141B.tmp"73⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"74⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"75⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\15C0.tmp"C:\Users\Admin\AppData\Local\Temp\15C0.tmp"76⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"77⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"78⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"79⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\1812.tmp"C:\Users\Admin\AppData\Local\Temp\1812.tmp"80⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"81⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\192B.tmp"C:\Users\Admin\AppData\Local\Temp\192B.tmp"82⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"83⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"84⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"85⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"86⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"87⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"88⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"89⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\1D81.tmp"C:\Users\Admin\AppData\Local\Temp\1D81.tmp"90⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1E9A.tmp"C:\Users\Admin\AppData\Local\Temp\1E9A.tmp"92⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\1F27.tmp"C:\Users\Admin\AppData\Local\Temp\1F27.tmp"93⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\1FA4.tmp"C:\Users\Admin\AppData\Local\Temp\1FA4.tmp"94⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2040.tmp"C:\Users\Admin\AppData\Local\Temp\2040.tmp"95⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"96⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"97⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"98⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"99⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"100⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\239B.tmp"C:\Users\Admin\AppData\Local\Temp\239B.tmp"101⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp"C:\Users\Admin\AppData\Local\Temp\2428.tmp"102⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\2532.tmp"C:\Users\Admin\AppData\Local\Temp\2532.tmp"104⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"105⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"106⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"107⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\2774.tmp"C:\Users\Admin\AppData\Local\Temp\2774.tmp"108⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"109⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\287D.tmp"C:\Users\Admin\AppData\Local\Temp\287D.tmp"110⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\291A.tmp"C:\Users\Admin\AppData\Local\Temp\291A.tmp"111⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2987.tmp"C:\Users\Admin\AppData\Local\Temp\2987.tmp"112⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2A14.tmp"C:\Users\Admin\AppData\Local\Temp\2A14.tmp"113⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"114⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"115⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"116⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2C56.tmp"C:\Users\Admin\AppData\Local\Temp\2C56.tmp"117⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"118⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"119⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"120⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"121⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"122⤵PID:1316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-