Analysis
- max time kernel
129s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_52da56948907418c386192a042628c22_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_52da56948907418c386192a042628c22_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_52da56948907418c386192a042628c22_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260805-dmfjlsvsbw
- SHA256 f4f6255480b2f415c283992b5bf9ef6e5d799d641f683fe4a0d623c02ab1f81a
- MD5 52da56948907418c386192a042628c22
- SHA1 e6c4cc935ada294374eaffa9442b262e6643d503
- SHA512 408ec1a593429354f4dffc07e7ced43e8570bb75dffc15ff5482de51980d47389b947a433421b3c930b9efa7838ce3b584d1777722c607760f777f1022714916
- SSDEEP 12288:NU5rCOTeijYYoSkffrtzXB+Q6qynPXslVUVEpTZwlH4Hp:NUQOJj70XZ6q0fs7jpTSlH4Hp
- TLSH T136B4F1267685C233E69202711BD6EBA22A3BBC75533590C73B94623E2FB17D0D379346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1920 3D5D.tmp 248 3E09.tmp 1988 3EE4.tmp 1040 3F9F.tmp 4116 408A.tmp 4236 4135.tmp 4836 4210.tmp 4912 42BC.tmp 2032 4368.tmp 4500 4481.tmp 5700 453D.tmp 1848 4608.tmp 5352 46C3.tmp 1816 479E.tmp 5180 4898.tmp 3496 4982.tmp 3780 4A5D.tmp 3848 4B19.tmp 5472 4BC5.tmp 940 4C80.tmp 5572 4D3C.tmp 3996 4DE7.tmp 1484 4E93.tmp 5732 4F8D.tmp 3400 5039.tmp 2284 50C6.tmp 1032 5162.tmp 2740 520E.tmp 3104 52C9.tmp 4528 5385.tmp 1480 5460.tmp 5784 5569.tmp 3828 5644.tmp 4556 56C1.tmp 1268 574E.tmp 5636 57DA.tmp 4120 5857.tmp 5816 58E4.tmp 2040 5980.tmp 2524 59FD.tmp 3648 5A99.tmp 4428 5B26.tmp 4616 5BB3.tmp 2008 5C4F.tmp 4340 5CCC.tmp 5104 5D59.tmp 5936 5DE5.tmp 1372 5E72.tmp 1152 5EFE.tmp 4168 5F7B.tmp 4920 6027.tmp 2164 60A4.tmp 5484 6141.tmp 1796 61BE.tmp 2436 624A.tmp 4136 62E6.tmp 1256 6373.tmp 5828 6400.tmp 5920 649C.tmp 6000 6538.tmp 1596 65C5.tmp 4688 6642.tmp 5116 66EE.tmp 4476 676B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 479E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D44E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 790A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F3B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 1920 5112 2026-08-05_52da56948907418c386192a042628c22_elex_mafia_stealc_tofsee.exe 89 PID 1920 wrote to memory of 248 1920 3D5D.tmp 90 PID 248 wrote to memory of 1988 248 3E09.tmp 91 PID 1988 wrote to memory of 1040 1988 3EE4.tmp 92 PID 1040 wrote to memory of 4116 1040 3F9F.tmp 93 PID 4116 wrote to memory of 4236 4116 408A.tmp 94 PID 4236 wrote to memory of 4836 4236 4135.tmp 95 PID 4836 wrote to memory of 4912 4836 4210.tmp 96 PID 4912 wrote to memory of 2032 4912 42BC.tmp 97 PID 2032 wrote to memory of 4500 2032 4368.tmp 98 PID 4500 wrote to memory of 5700 4500 4481.tmp 99 PID 5700 wrote to memory of 1848 5700 453D.tmp 100 PID 1848 wrote to memory of 5352 1848 4608.tmp 101 PID 5352 wrote to memory of 1816 5352 46C3.tmp 102 PID 1816 wrote to memory of 5180 1816 479E.tmp 103 PID 5180 wrote to memory of 3496 5180 4898.tmp 104 PID 3496 wrote to memory of 3780 3496 4982.tmp 105 PID 3780 wrote to memory of 3848 3780 4A5D.tmp 106 PID 3848 wrote to memory of 5472 3848 4B19.tmp 107 PID 5472 wrote to memory of 940 5472 4BC5.tmp 108 PID 940 wrote to memory of 5572 940 4C80.tmp 109 PID 5572 wrote to memory of 3996 5572 4D3C.tmp 110 PID 3996 wrote to memory of 1484 3996 4DE7.tmp 111 PID 1484 wrote to memory of 5732 1484 4E93.tmp 112 PID 5732 wrote to memory of 3400 5732 4F8D.tmp 113 PID 3400 wrote to memory of 2284 3400 5039.tmp 114 PID 2284 wrote to memory of 1032 2284 50C6.tmp 115 PID 1032 wrote to memory of 2740 1032 5162.tmp 116 PID 2740 wrote to memory of 3104 2740 520E.tmp 117 PID 3104 wrote to memory of 4528 3104 52C9.tmp 118 PID 4528 wrote to memory of 1480 4528 5385.tmp 119 PID 1480 wrote to memory of 5784 1480 5460.tmp 120 PID 5784 wrote to memory of 3828 5784 5569.tmp 121 PID 3828 wrote to memory of 4556 3828 5644.tmp 122 PID 4556 wrote to memory of 1268 4556 56C1.tmp 123 PID 1268 wrote to memory of 5636 1268 574E.tmp 124 PID 5636 wrote to memory of 4120 5636 57DA.tmp 125 PID 4120 wrote to memory of 5816 4120 5857.tmp 126 PID 5816 wrote to memory of 2040 5816 58E4.tmp 127 PID 2040 wrote to memory of 2524 2040 5980.tmp 128 PID 2524 wrote to memory of 3648 2524 59FD.tmp 129 PID 3648 wrote to memory of 4428 3648 5A99.tmp 130 PID 4428 wrote to memory of 4616 4428 5B26.tmp 131 PID 4616 wrote to memory of 2008 4616 5BB3.tmp 132 PID 2008 wrote to memory of 4340 2008 5C4F.tmp 133 PID 4340 wrote to memory of 5104 4340 5CCC.tmp 134 PID 5104 wrote to memory of 5936 5104 5D59.tmp 135 PID 5936 wrote to memory of 1372 5936 5DE5.tmp 136 PID 1372 wrote to memory of 1152 1372 5E72.tmp 137 PID 1152 wrote to memory of 4168 1152 5EFE.tmp 138 PID 4168 wrote to memory of 4920 4168 5F7B.tmp 139 PID 4920 wrote to memory of 2164 4920 6027.tmp 140 PID 2164 wrote to memory of 5484 2164 60A4.tmp 141 PID 5484 wrote to memory of 1796 5484 6141.tmp 142 PID 1796 wrote to memory of 2436 1796 61BE.tmp 143 PID 2436 wrote to memory of 4136 2436 624A.tmp 144 PID 4136 wrote to memory of 1256 4136 62E6.tmp 145 PID 1256 wrote to memory of 5828 1256 6373.tmp 146 PID 5828 wrote to memory of 5920 5828 6400.tmp 147 PID 5920 wrote to memory of 6000 5920 649C.tmp 148 PID 6000 wrote to memory of 1596 6000 6538.tmp 149 PID 1596 wrote to memory of 4688 1596 65C5.tmp 150 PID 4688 wrote to memory of 5116 4688 6642.tmp 151 PID 5116 wrote to memory of 4476 5116 66EE.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_52da56948907418c386192a042628c22_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_52da56948907418c386192a042628c22_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\42BC.tmp"C:\Users\Admin\AppData\Local\Temp\42BC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4481.tmp"C:\Users\Admin\AppData\Local\Temp\4481.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4898.tmp"C:\Users\Admin\AppData\Local\Temp\4898.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\4982.tmp"C:\Users\Admin\AppData\Local\Temp\4982.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\5039.tmp"C:\Users\Admin\AppData\Local\Temp\5039.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\50C6.tmp"C:\Users\Admin\AppData\Local\Temp\50C6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\520E.tmp"C:\Users\Admin\AppData\Local\Temp\520E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5460.tmp"C:\Users\Admin\AppData\Local\Temp\5460.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\5569.tmp"C:\Users\Admin\AppData\Local\Temp\5569.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\5644.tmp"C:\Users\Admin\AppData\Local\Temp\5644.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\56C1.tmp"C:\Users\Admin\AppData\Local\Temp\56C1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\574E.tmp"C:\Users\Admin\AppData\Local\Temp\574E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\5BB3.tmp"C:\Users\Admin\AppData\Local\Temp\5BB3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5D59.tmp"C:\Users\Admin\AppData\Local\Temp\5D59.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5DE5.tmp"C:\Users\Admin\AppData\Local\Temp\5DE5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\5E72.tmp"C:\Users\Admin\AppData\Local\Temp\5E72.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\61BE.tmp"C:\Users\Admin\AppData\Local\Temp\61BE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\624A.tmp"C:\Users\Admin\AppData\Local\Temp\624A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\62E6.tmp"C:\Users\Admin\AppData\Local\Temp\62E6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\6373.tmp"C:\Users\Admin\AppData\Local\Temp\6373.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\6400.tmp"C:\Users\Admin\AppData\Local\Temp\6400.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\66EE.tmp"C:\Users\Admin\AppData\Local\Temp\66EE.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"65⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6817.tmp"C:\Users\Admin\AppData\Local\Temp\6817.tmp"66⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\68A3.tmp"C:\Users\Admin\AppData\Local\Temp\68A3.tmp"67⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\6911.tmp"C:\Users\Admin\AppData\Local\Temp\6911.tmp"68⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\699D.tmp"C:\Users\Admin\AppData\Local\Temp\699D.tmp"69⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"70⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"71⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"72⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"73⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\6CCA.tmp"C:\Users\Admin\AppData\Local\Temp\6CCA.tmp"74⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6D66.tmp"C:\Users\Admin\AppData\Local\Temp\6D66.tmp"75⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"76⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"77⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"79⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\7035.tmp"C:\Users\Admin\AppData\Local\Temp\7035.tmp"80⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"81⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\715E.tmp"C:\Users\Admin\AppData\Local\Temp\715E.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\71FA.tmp"C:\Users\Admin\AppData\Local\Temp\71FA.tmp"83⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"84⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"85⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"86⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\744C.tmp"C:\Users\Admin\AppData\Local\Temp\744C.tmp"87⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"88⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\7584.tmp"C:\Users\Admin\AppData\Local\Temp\7584.tmp"89⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"90⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"91⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"92⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"93⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\7882.tmp"C:\Users\Admin\AppData\Local\Temp\7882.tmp"94⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\791E.tmp"C:\Users\Admin\AppData\Local\Temp\791E.tmp"95⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\7A47.tmp"C:\Users\Admin\AppData\Local\Temp\7A47.tmp"97⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"98⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"99⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"100⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"101⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"102⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"103⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"104⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"105⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"106⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"107⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"108⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\810D.tmp"C:\Users\Admin\AppData\Local\Temp\810D.tmp"109⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"110⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"111⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"113⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"114⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\84C6.tmp"C:\Users\Admin\AppData\Local\Temp\84C6.tmp"115⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"116⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"117⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"118⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"119⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"121⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"122⤵PID:4432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-