Analysis
- max time kernel
131s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_04394cdb052780e96cdb8fd7a95edebc_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_04394cdb052780e96cdb8fd7a95edebc_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_04394cdb052780e96cdb8fd7a95edebc_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260805-dyzfvsvthx
- SHA256 2003227b1fd159ed12d25e64ad3e3cbaf21f7a47da2649ec0ed78bfd8ebd158b
- MD5 04394cdb052780e96cdb8fd7a95edebc
- SHA1 f5b1725f3f8afeb7f3c9438c3f87c806482ea75d
- SHA512 32a837fa3d520a308b153c09f9d45c5f10c90788382199db326c58562c4a62d6067ab532075ebeccfcb8180c1481ae66395eff8b4a25a8a2f0e6284024f1882f
- SSDEEP 12288:wU5rCOTeiDs/m6cNHnZSAfGNZ+3/v+I9hUG2VA:wUQOJDhNHnYGGNGEA
- TLSH T17AE4D02177D88536E9FB037859B5A6604D7EFD32A722D6CF6F8012AE0971BC08671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4612 45B.tmp 5052 5E2.tmp 2540 72A.tmp 3440 863.tmp 2040 92E.tmp 2912 9AB.tmp 1160 B70.tmp 2656 C0C.tmp 5348 CC8.tmp 4608 EBC.tmp 4504 FC5.tmp 2592 110D.tmp 6016 1246.tmp 1900 137E.tmp 2976 1459.tmp 296 1582.tmp 1508 167C.tmp 1364 17D4.tmp 4208 191C.tmp 5652 19E7.tmp 5392 1B1F.tmp 5044 1C68.tmp 3168 1DBF.tmp 4316 1EE8.tmp 2504 2021.tmp 1388 212A.tmp 4220 2234.tmp 3584 233E.tmp 4348 24C4.tmp 5312 25CE.tmp 5736 2716.tmp 1576 288D.tmp 1036 2987.tmp 2360 2A52.tmp 3600 2AFE.tmp 4796 2BF8.tmp 4224 2CA4.tmp 4656 2D40.tmp 2924 2E1B.tmp 5944 2ED6.tmp 5956 2FC1.tmp 1552 305D.tmp 1424 3128.tmp 692 3212.tmp 3848 32ED.tmp 2796 33D8.tmp 3128 3474.tmp 3392 3500.tmp 1868 35AC.tmp 5232 3629.tmp 2800 36C6.tmp 3272 3762.tmp 4992 37CF.tmp 2196 383D.tmp 5772 38E8.tmp 6012 3975.tmp 2292 39F2.tmp 1844 3A7F.tmp 6048 3AFC.tmp 5948 3B88.tmp 4600 3C15.tmp 5624 3CA2.tmp 2596 3D1F.tmp 3576 3DAB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 666C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F38E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8483.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 936 wrote to memory of 4612 936 2026-08-05_04394cdb052780e96cdb8fd7a95edebc_elex_mafia_stealc_tofsee.exe 90 PID 4612 wrote to memory of 5052 4612 45B.tmp 91 PID 5052 wrote to memory of 2540 5052 5E2.tmp 92 PID 2540 wrote to memory of 3440 2540 72A.tmp 93 PID 3440 wrote to memory of 2040 3440 863.tmp 94 PID 2040 wrote to memory of 2912 2040 92E.tmp 95 PID 2912 wrote to memory of 1160 2912 9AB.tmp 96 PID 1160 wrote to memory of 2656 1160 B70.tmp 97 PID 2656 wrote to memory of 5348 2656 C0C.tmp 98 PID 5348 wrote to memory of 4608 5348 CC8.tmp 99 PID 4608 wrote to memory of 4504 4608 EBC.tmp 100 PID 4504 wrote to memory of 2592 4504 FC5.tmp 101 PID 2592 wrote to memory of 6016 2592 110D.tmp 102 PID 6016 wrote to memory of 1900 6016 1246.tmp 103 PID 1900 wrote to memory of 2976 1900 137E.tmp 104 PID 2976 wrote to memory of 296 2976 1459.tmp 105 PID 296 wrote to memory of 1508 296 1582.tmp 106 PID 1508 wrote to memory of 1364 1508 167C.tmp 107 PID 1364 wrote to memory of 4208 1364 17D4.tmp 108 PID 4208 wrote to memory of 5652 4208 191C.tmp 109 PID 5652 wrote to memory of 5392 5652 19E7.tmp 110 PID 5392 wrote to memory of 5044 5392 1B1F.tmp 111 PID 5044 wrote to memory of 3168 5044 1C68.tmp 112 PID 3168 wrote to memory of 4316 3168 1DBF.tmp 113 PID 4316 wrote to memory of 2504 4316 1EE8.tmp 114 PID 2504 wrote to memory of 1388 2504 2021.tmp 115 PID 1388 wrote to memory of 4220 1388 212A.tmp 116 PID 4220 wrote to memory of 3584 4220 2234.tmp 117 PID 3584 wrote to memory of 4348 3584 233E.tmp 118 PID 4348 wrote to memory of 5312 4348 24C4.tmp 119 PID 5312 wrote to memory of 5736 5312 25CE.tmp 120 PID 5736 wrote to memory of 1576 5736 2716.tmp 121 PID 1576 wrote to memory of 1036 1576 288D.tmp 122 PID 1036 wrote to memory of 2360 1036 2987.tmp 123 PID 2360 wrote to memory of 3600 2360 2A52.tmp 124 PID 3600 wrote to memory of 4796 3600 2AFE.tmp 125 PID 4796 wrote to memory of 4224 4796 2BF8.tmp 126 PID 4224 wrote to memory of 4656 4224 2CA4.tmp 127 PID 4656 wrote to memory of 2924 4656 2D40.tmp 128 PID 2924 wrote to memory of 5944 2924 2E1B.tmp 129 PID 5944 wrote to memory of 5956 5944 2ED6.tmp 130 PID 5956 wrote to memory of 1552 5956 2FC1.tmp 131 PID 1552 wrote to memory of 1424 1552 305D.tmp 132 PID 1424 wrote to memory of 692 1424 3128.tmp 133 PID 692 wrote to memory of 3848 692 3212.tmp 134 PID 3848 wrote to memory of 2796 3848 32ED.tmp 135 PID 2796 wrote to memory of 3128 2796 33D8.tmp 136 PID 3128 wrote to memory of 3392 3128 3474.tmp 137 PID 3392 wrote to memory of 1868 3392 3500.tmp 138 PID 1868 wrote to memory of 5232 1868 35AC.tmp 139 PID 5232 wrote to memory of 2800 5232 3629.tmp 140 PID 2800 wrote to memory of 3272 2800 36C6.tmp 141 PID 3272 wrote to memory of 4992 3272 3762.tmp 142 PID 4992 wrote to memory of 2196 4992 37CF.tmp 143 PID 2196 wrote to memory of 5772 2196 383D.tmp 144 PID 5772 wrote to memory of 6012 5772 38E8.tmp 145 PID 6012 wrote to memory of 2292 6012 3975.tmp 146 PID 2292 wrote to memory of 1844 2292 39F2.tmp 147 PID 1844 wrote to memory of 6048 1844 3A7F.tmp 148 PID 6048 wrote to memory of 5948 6048 3AFC.tmp 149 PID 5948 wrote to memory of 4600 5948 3B88.tmp 150 PID 4600 wrote to memory of 5624 4600 3C15.tmp 151 PID 5624 wrote to memory of 2596 5624 3CA2.tmp 152 PID 2596 wrote to memory of 3576 2596 3D1F.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_04394cdb052780e96cdb8fd7a95edebc_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_04394cdb052780e96cdb8fd7a95edebc_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\45B.tmp"C:\Users\Admin\AppData\Local\Temp\45B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\72A.tmp"C:\Users\Admin\AppData\Local\Temp\72A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\B70.tmp"C:\Users\Admin\AppData\Local\Temp\B70.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\EBC.tmp"C:\Users\Admin\AppData\Local\Temp\EBC.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\FC5.tmp"C:\Users\Admin\AppData\Local\Temp\FC5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1246.tmp"C:\Users\Admin\AppData\Local\Temp\1246.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1582.tmp"C:\Users\Admin\AppData\Local\Temp\1582.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\167C.tmp"C:\Users\Admin\AppData\Local\Temp\167C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\212A.tmp"C:\Users\Admin\AppData\Local\Temp\212A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2234.tmp"C:\Users\Admin\AppData\Local\Temp\2234.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\233E.tmp"C:\Users\Admin\AppData\Local\Temp\233E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\2987.tmp"C:\Users\Admin\AppData\Local\Temp\2987.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\305D.tmp"C:\Users\Admin\AppData\Local\Temp\305D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3212.tmp"C:\Users\Admin\AppData\Local\Temp\3212.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3474.tmp"C:\Users\Admin\AppData\Local\Temp\3474.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\35AC.tmp"C:\Users\Admin\AppData\Local\Temp\35AC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\3629.tmp"C:\Users\Admin\AppData\Local\Temp\3629.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\3975.tmp"C:\Users\Admin\AppData\Local\Temp\3975.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\3B88.tmp"C:\Users\Admin\AppData\Local\Temp\3B88.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\3C15.tmp"C:\Users\Admin\AppData\Local\Temp\3C15.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"65⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\3E28.tmp"C:\Users\Admin\AppData\Local\Temp\3E28.tmp"66⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"67⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\3F41.tmp"C:\Users\Admin\AppData\Local\Temp\3F41.tmp"68⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"69⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"70⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"71⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\4184.tmp"C:\Users\Admin\AppData\Local\Temp\4184.tmp"72⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"73⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"74⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"75⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\43A6.tmp"C:\Users\Admin\AppData\Local\Temp\43A6.tmp"76⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"77⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"78⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"79⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"80⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"81⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"82⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:552 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"84⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\4869.tmp"C:\Users\Admin\AppData\Local\Temp\4869.tmp"85⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"86⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\49A2.tmp"C:\Users\Admin\AppData\Local\Temp\49A2.tmp"87⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"88⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"89⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"90⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"91⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"92⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"93⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"95⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"96⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"97⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"98⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"99⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"100⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"101⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"102⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"103⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"104⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\5346.tmp"C:\Users\Admin\AppData\Local\Temp\5346.tmp"105⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"106⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\548F.tmp"C:\Users\Admin\AppData\Local\Temp\548F.tmp"107⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\553A.tmp"C:\Users\Admin\AppData\Local\Temp\553A.tmp"108⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\55E6.tmp"C:\Users\Admin\AppData\Local\Temp\55E6.tmp"109⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\5663.tmp"C:\Users\Admin\AppData\Local\Temp\5663.tmp"110⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"111⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\579C.tmp"C:\Users\Admin\AppData\Local\Temp\579C.tmp"112⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"113⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"114⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"115⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"116⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5B74.tmp"C:\Users\Admin\AppData\Local\Temp\5B74.tmp"118⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"119⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"120⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\5D68.tmp"C:\Users\Admin\AppData\Local\Temp\5D68.tmp"121⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5DE5.tmp"C:\Users\Admin\AppData\Local\Temp\5DE5.tmp"122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-