Analysis
- max time kernel
124s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_ee6d690f6a426852c1f52934e8670017_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_ee6d690f6a426852c1f52934e8670017_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_ee6d690f6a426852c1f52934e8670017_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260805-msg43avhkf
- SHA256 a2c3f99ad01e05d4b6192e54a79fbfaed39a0a57a80235f978ac4c61b8a8a617
- MD5 ee6d690f6a426852c1f52934e8670017
- SHA1 87ba9b47e5500b6336c84145d7173ff82f50a09a
- SHA512 11b327a0755a47c7d0d2ef42aa6aa8276c9cc2b3d9aa53ec7a973bf50c623825965bf2270d2667284a0eb0390dded14ae096d786a12ea9953e8409a362175dc3
- SSDEEP 12288:NU5rCOTeij9diMzWq1Z+abziJypSiTZwlH:NUQOJj+BqOabWJyciTSlH
- TLSH T10DB4F126B685C532E6D202710FD6EBA2293B7C325725A4C33B94637E2FB52E19335347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6012 BB47.tmp 4328 BC13.tmp 2392 BCDE.tmp 1840 BDD8.tmp 3920 BE74.tmp 3372 BFBC.tmp 4864 C097.tmp 2608 C181.tmp 992 C23D.tmp 4880 C2E9.tmp 300 C366.tmp 4348 C421.tmp 5824 C4EC.tmp 2652 C5E6.tmp 2812 C6E0.tmp 5492 C7AB.tmp 3020 C857.tmp 4184 C913.tmp 268 C9AF.tmp 5872 CA3C.tmp 2732 CAC8.tmp 640 CB45.tmp 3744 CC20.tmp 1136 CCEB.tmp 4228 CDB6.tmp 1216 CE43.tmp 1884 CF1E.tmp 5796 CFF8.tmp 4176 D0F2.tmp 1068 D19E.tmp 4964 D24A.tmp 4152 D315.tmp 4884 D3E0.tmp 5056 D46D.tmp 1096 D4FA.tmp 5920 D567.tmp 1240 D5E4.tmp 1672 D680.tmp 3600 D6FD.tmp 5476 D78A.tmp 5548 D807.tmp 4604 D893.tmp 3424 D920.tmp 2032 D9AD.tmp 2768 DA49.tmp 3012 DAB6.tmp 5952 DB33.tmp 1480 DBB0.tmp 1244 DC2D.tmp 952 DCAA.tmp 2056 DD27.tmp 1088 DD95.tmp 4268 DE02.tmp 3996 DEBE.tmp 4652 DF3B.tmp 264 DFB8.tmp 5792 E035.tmp 1236 E0D1.tmp 1820 E15D.tmp 3332 E1FA.tmp 4108 E267.tmp 2956 E2E4.tmp 4804 E351.tmp 4932 E3DE.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1048.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 255C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 448C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B16F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 434F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E715.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 629E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 689A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F16B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 416F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 6012 372 2026-08-05_ee6d690f6a426852c1f52934e8670017_elex_mafia_stealc_tofsee.exe 88 PID 6012 wrote to memory of 4328 6012 BB47.tmp 89 PID 4328 wrote to memory of 2392 4328 BC13.tmp 90 PID 2392 wrote to memory of 1840 2392 BCDE.tmp 91 PID 1840 wrote to memory of 3920 1840 BDD8.tmp 92 PID 3920 wrote to memory of 3372 3920 BE74.tmp 93 PID 3372 wrote to memory of 4864 3372 BFBC.tmp 94 PID 4864 wrote to memory of 2608 4864 C097.tmp 95 PID 2608 wrote to memory of 992 2608 C181.tmp 96 PID 992 wrote to memory of 4880 992 C23D.tmp 97 PID 4880 wrote to memory of 300 4880 C2E9.tmp 98 PID 300 wrote to memory of 4348 300 C366.tmp 99 PID 4348 wrote to memory of 5824 4348 C421.tmp 100 PID 5824 wrote to memory of 2652 5824 C4EC.tmp 101 PID 2652 wrote to memory of 2812 2652 C5E6.tmp 102 PID 2812 wrote to memory of 5492 2812 C6E0.tmp 103 PID 5492 wrote to memory of 3020 5492 C7AB.tmp 104 PID 3020 wrote to memory of 4184 3020 C857.tmp 105 PID 4184 wrote to memory of 268 4184 C913.tmp 106 PID 268 wrote to memory of 5872 268 C9AF.tmp 107 PID 5872 wrote to memory of 2732 5872 CA3C.tmp 108 PID 2732 wrote to memory of 640 2732 CAC8.tmp 109 PID 640 wrote to memory of 3744 640 CB45.tmp 110 PID 3744 wrote to memory of 1136 3744 CC20.tmp 111 PID 1136 wrote to memory of 4228 1136 CCEB.tmp 112 PID 4228 wrote to memory of 1216 4228 CDB6.tmp 113 PID 1216 wrote to memory of 1884 1216 CE43.tmp 114 PID 1884 wrote to memory of 5796 1884 CF1E.tmp 115 PID 5796 wrote to memory of 4176 5796 CFF8.tmp 116 PID 4176 wrote to memory of 1068 4176 D0F2.tmp 117 PID 1068 wrote to memory of 4964 1068 D19E.tmp 118 PID 4964 wrote to memory of 4152 4964 D24A.tmp 119 PID 4152 wrote to memory of 4884 4152 D315.tmp 120 PID 4884 wrote to memory of 5056 4884 D3E0.tmp 121 PID 5056 wrote to memory of 1096 5056 D46D.tmp 122 PID 1096 wrote to memory of 5920 1096 D4FA.tmp 123 PID 5920 wrote to memory of 1240 5920 D567.tmp 124 PID 1240 wrote to memory of 1672 1240 D5E4.tmp 125 PID 1672 wrote to memory of 3600 1672 D680.tmp 126 PID 3600 wrote to memory of 5476 3600 D6FD.tmp 127 PID 5476 wrote to memory of 5548 5476 D78A.tmp 128 PID 5548 wrote to memory of 4604 5548 D807.tmp 129 PID 4604 wrote to memory of 3424 4604 D893.tmp 130 PID 3424 wrote to memory of 2032 3424 D920.tmp 131 PID 2032 wrote to memory of 2768 2032 D9AD.tmp 132 PID 2768 wrote to memory of 3012 2768 DA49.tmp 133 PID 3012 wrote to memory of 5952 3012 DAB6.tmp 134 PID 5952 wrote to memory of 1480 5952 DB33.tmp 135 PID 1480 wrote to memory of 1244 1480 DBB0.tmp 136 PID 1244 wrote to memory of 952 1244 DC2D.tmp 137 PID 952 wrote to memory of 2056 952 DCAA.tmp 138 PID 2056 wrote to memory of 1088 2056 DD27.tmp 139 PID 1088 wrote to memory of 4268 1088 DD95.tmp 140 PID 4268 wrote to memory of 3996 4268 DE02.tmp 141 PID 3996 wrote to memory of 4652 3996 DEBE.tmp 142 PID 4652 wrote to memory of 264 4652 DF3B.tmp 143 PID 264 wrote to memory of 5792 264 DFB8.tmp 144 PID 5792 wrote to memory of 1236 5792 E035.tmp 145 PID 1236 wrote to memory of 1820 1236 E0D1.tmp 146 PID 1820 wrote to memory of 3332 1820 E15D.tmp 147 PID 3332 wrote to memory of 4108 3332 E1FA.tmp 148 PID 4108 wrote to memory of 2956 4108 E267.tmp 149 PID 2956 wrote to memory of 4804 2956 E2E4.tmp 150 PID 4804 wrote to memory of 4932 4804 E351.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_ee6d690f6a426852c1f52934e8670017_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_ee6d690f6a426852c1f52934e8670017_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\BC13.tmp"C:\Users\Admin\AppData\Local\Temp\BC13.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"C:\Users\Admin\AppData\Local\Temp\BDD8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\BE74.tmp"C:\Users\Admin\AppData\Local\Temp\BE74.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\C181.tmp"C:\Users\Admin\AppData\Local\Temp\C181.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\C421.tmp"C:\Users\Admin\AppData\Local\Temp\C421.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\CC20.tmp"C:\Users\Admin\AppData\Local\Temp\CC20.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\CE43.tmp"C:\Users\Admin\AppData\Local\Temp\CE43.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\D19E.tmp"C:\Users\Admin\AppData\Local\Temp\D19E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\D567.tmp"C:\Users\Admin\AppData\Local\Temp\D567.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\D680.tmp"C:\Users\Admin\AppData\Local\Temp\D680.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\DA49.tmp"C:\Users\Admin\AppData\Local\Temp\DA49.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\DB33.tmp"C:\Users\Admin\AppData\Local\Temp\DB33.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\DD27.tmp"C:\Users\Admin\AppData\Local\Temp\DD27.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\DD95.tmp"C:\Users\Admin\AppData\Local\Temp\DD95.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\DE02.tmp"C:\Users\Admin\AppData\Local\Temp\DE02.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\E15D.tmp"C:\Users\Admin\AppData\Local\Temp\E15D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\E267.tmp"C:\Users\Admin\AppData\Local\Temp\E267.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\E2E4.tmp"C:\Users\Admin\AppData\Local\Temp\E2E4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\E351.tmp"C:\Users\Admin\AppData\Local\Temp\E351.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"65⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"66⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"67⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"68⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"70⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"71⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"72⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"73⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:840 -
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"76⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"77⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"78⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"79⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"80⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"81⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"82⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"83⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"84⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"85⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"86⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"87⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"88⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"89⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\F16B.tmp"C:\Users\Admin\AppData\Local\Temp\F16B.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"91⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"92⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\F340.tmp"C:\Users\Admin\AppData\Local\Temp\F340.tmp"94⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"95⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"96⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"98⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"99⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"100⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"102⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\F802.tmp"C:\Users\Admin\AppData\Local\Temp\F802.tmp"103⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"104⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"105⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\F989.tmp"C:\Users\Admin\AppData\Local\Temp\F989.tmp"106⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"107⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\FA93.tmp"C:\Users\Admin\AppData\Local\Temp\FA93.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\FB10.tmp"C:\Users\Admin\AppData\Local\Temp\FB10.tmp"109⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"110⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\FC19.tmp"C:\Users\Admin\AppData\Local\Temp\FC19.tmp"111⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\FD23.tmp"C:\Users\Admin\AppData\Local\Temp\FD23.tmp"113⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"115⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\FEA9.tmp"C:\Users\Admin\AppData\Local\Temp\FEA9.tmp"116⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"117⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"118⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"119⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"120⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\12A.tmp"C:\Users\Admin\AppData\Local\Temp\12A.tmp"121⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1B7.tmp"C:\Users\Admin\AppData\Local\Temp\1B7.tmp"122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-