Analysis
- max time kernel
130s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 21:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_e4de8e06ef118e3b78eb7257ad88be50_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_e4de8e06ef118e3b78eb7257ad88be50_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_e4de8e06ef118e3b78eb7257ad88be50_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260806-1kdcsst1dv
- SHA256 9e1388463f6c7ac32729886c158269fa801d5bb428a29c926b4b9ba93c9c8eaa
- MD5 e4de8e06ef118e3b78eb7257ad88be50
- SHA1 c4fa669477ca78950c7cef7e639c9508db9115e4
- SHA512 8a24408a43248b2e6b36879d27daebac5eef49fa75c5f34f331093d60ea08d81357259bba730adde8b376e616488e0383e8223ecc9277bf28263160fec1ab445
- SSDEEP 12288:NU5rCOTeijI2xQMceeXOcjqXZMEMATZwlH4Hp:NUQOJjI2xQbvJIMNATSlH4Hp
- TLSH T1E5B4F125B285C133E69202710FD6DBA26A3BBD36633690C33B94667E2F716D1D376342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 484 CE48.tmp 3412 CF42.tmp 3236 D00D.tmp 1052 D0F7.tmp 6008 D1D2.tmp 4908 D2BC.tmp 4100 D358.tmp 4052 D443.tmp 5680 D57B.tmp 2888 D637.tmp 3784 D6D3.tmp 4296 D76F.tmp 4748 D81B.tmp 904 D8B7.tmp 2840 D9C1.tmp 4440 DA7D.tmp 4484 DB09.tmp 5956 DBB5.tmp 368 DC32.tmp 252 DCCE.tmp 3600 DD99.tmp 4568 DE26.tmp 3232 DF30.tmp 6132 DFFB.tmp 4632 E0E5.tmp 5184 E1C0.tmp 2096 E2BA.tmp 2448 E385.tmp 5000 E46F.tmp 8 E569.tmp 4956 E635.tmp 5280 E6F0.tmp 5844 E7AC.tmp 1148 E848.tmp 4300 E8D4.tmp 5640 E951.tmp 2892 E9BF.tmp 5072 EA3C.tmp 4204 EAC8.tmp 5572 EB36.tmp 1600 EBC2.tmp 3288 EC6E.tmp 3216 ECEB.tmp 5620 ED78.tmp 5276 EDF5.tmp 2948 EE72.tmp 2424 EEFF.tmp 4360 EF8B.tmp 5628 F008.tmp 988 F095.tmp 6088 F121.tmp 1640 F19E.tmp 3368 F22B.tmp 5848 F2C7.tmp 2984 F344.tmp 2464 F3D1.tmp 4236 F45E.tmp 3392 F4EA.tmp 5068 F577.tmp 2924 F5E4.tmp 896 F661.tmp 1604 F6EE.tmp 5076 F77A.tmp 5284 F7E8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 931E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4954.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A25C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 427E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 737C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 484 4616 2026-08-06_e4de8e06ef118e3b78eb7257ad88be50_elex_mafia_stealc_tofsee.exe 90 PID 484 wrote to memory of 3412 484 CE48.tmp 91 PID 3412 wrote to memory of 3236 3412 CF42.tmp 92 PID 3236 wrote to memory of 1052 3236 D00D.tmp 93 PID 1052 wrote to memory of 6008 1052 D0F7.tmp 94 PID 6008 wrote to memory of 4908 6008 D1D2.tmp 95 PID 4908 wrote to memory of 4100 4908 D2BC.tmp 96 PID 4100 wrote to memory of 4052 4100 D358.tmp 97 PID 4052 wrote to memory of 5680 4052 D443.tmp 98 PID 5680 wrote to memory of 2888 5680 D57B.tmp 99 PID 2888 wrote to memory of 3784 2888 D637.tmp 100 PID 3784 wrote to memory of 4296 3784 D6D3.tmp 101 PID 4296 wrote to memory of 4748 4296 D76F.tmp 102 PID 4748 wrote to memory of 904 4748 D81B.tmp 103 PID 904 wrote to memory of 2840 904 D8B7.tmp 104 PID 2840 wrote to memory of 4440 2840 D9C1.tmp 105 PID 4440 wrote to memory of 4484 4440 DA7D.tmp 106 PID 4484 wrote to memory of 5956 4484 DB09.tmp 107 PID 5956 wrote to memory of 368 5956 DBB5.tmp 108 PID 368 wrote to memory of 252 368 DC32.tmp 109 PID 252 wrote to memory of 3600 252 DCCE.tmp 110 PID 3600 wrote to memory of 4568 3600 DD99.tmp 111 PID 4568 wrote to memory of 3232 4568 DE26.tmp 112 PID 3232 wrote to memory of 6132 3232 DF30.tmp 113 PID 6132 wrote to memory of 4632 6132 DFFB.tmp 114 PID 4632 wrote to memory of 5184 4632 E0E5.tmp 115 PID 5184 wrote to memory of 2096 5184 E1C0.tmp 116 PID 2096 wrote to memory of 2448 2096 E2BA.tmp 117 PID 2448 wrote to memory of 5000 2448 E385.tmp 118 PID 5000 wrote to memory of 8 5000 E46F.tmp 119 PID 8 wrote to memory of 4956 8 E569.tmp 120 PID 4956 wrote to memory of 5280 4956 E635.tmp 121 PID 5280 wrote to memory of 5844 5280 E6F0.tmp 122 PID 5844 wrote to memory of 1148 5844 E7AC.tmp 123 PID 1148 wrote to memory of 4300 1148 E848.tmp 124 PID 4300 wrote to memory of 5640 4300 E8D4.tmp 125 PID 5640 wrote to memory of 2892 5640 E951.tmp 126 PID 2892 wrote to memory of 5072 2892 E9BF.tmp 127 PID 5072 wrote to memory of 4204 5072 EA3C.tmp 128 PID 4204 wrote to memory of 5572 4204 EAC8.tmp 129 PID 5572 wrote to memory of 1600 5572 EB36.tmp 130 PID 1600 wrote to memory of 3288 1600 EBC2.tmp 131 PID 3288 wrote to memory of 3216 3288 EC6E.tmp 132 PID 3216 wrote to memory of 5620 3216 ECEB.tmp 133 PID 5620 wrote to memory of 5276 5620 ED78.tmp 134 PID 5276 wrote to memory of 2948 5276 EDF5.tmp 135 PID 2948 wrote to memory of 2424 2948 EE72.tmp 136 PID 2424 wrote to memory of 4360 2424 EEFF.tmp 137 PID 4360 wrote to memory of 5628 4360 EF8B.tmp 138 PID 5628 wrote to memory of 988 5628 F008.tmp 139 PID 988 wrote to memory of 6088 988 F095.tmp 140 PID 6088 wrote to memory of 1640 6088 F121.tmp 141 PID 1640 wrote to memory of 3368 1640 F19E.tmp 142 PID 3368 wrote to memory of 5848 3368 F22B.tmp 143 PID 5848 wrote to memory of 2984 5848 F2C7.tmp 144 PID 2984 wrote to memory of 2464 2984 F344.tmp 145 PID 2464 wrote to memory of 4236 2464 F3D1.tmp 146 PID 4236 wrote to memory of 3392 4236 F45E.tmp 147 PID 3392 wrote to memory of 5068 3392 F4EA.tmp 148 PID 5068 wrote to memory of 2924 5068 F577.tmp 149 PID 2924 wrote to memory of 896 2924 F5E4.tmp 150 PID 896 wrote to memory of 1604 896 F661.tmp 151 PID 1604 wrote to memory of 5076 1604 F6EE.tmp 152 PID 5076 wrote to memory of 5284 5076 F77A.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_e4de8e06ef118e3b78eb7257ad88be50_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_e4de8e06ef118e3b78eb7257ad88be50_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\D57B.tmp"C:\Users\Admin\AppData\Local\Temp\D57B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\D81B.tmp"C:\Users\Admin\AppData\Local\Temp\D81B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\DB09.tmp"C:\Users\Admin\AppData\Local\Temp\DB09.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\DC32.tmp"C:\Users\Admin\AppData\Local\Temp\DC32.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\DD99.tmp"C:\Users\Admin\AppData\Local\Temp\DD99.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\E385.tmp"C:\Users\Admin\AppData\Local\Temp\E385.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\E635.tmp"C:\Users\Admin\AppData\Local\Temp\E635.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\EB36.tmp"C:\Users\Admin\AppData\Local\Temp\EB36.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\ED78.tmp"C:\Users\Admin\AppData\Local\Temp\ED78.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\F095.tmp"C:\Users\Admin\AppData\Local\Temp\F095.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\F19E.tmp"C:\Users\Admin\AppData\Local\Temp\F19E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\F22B.tmp"C:\Users\Admin\AppData\Local\Temp\F22B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\F577.tmp"C:\Users\Admin\AppData\Local\Temp\F577.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"65⤵
- Executes dropped EXE
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"66⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\F901.tmp"C:\Users\Admin\AppData\Local\Temp\F901.tmp"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\F99D.tmp"C:\Users\Admin\AppData\Local\Temp\F99D.tmp"68⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"69⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"70⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\FB53.tmp"C:\Users\Admin\AppData\Local\Temp\FB53.tmp"71⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"72⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"73⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"74⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"75⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"76⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"77⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\FEED.tmp"C:\Users\Admin\AppData\Local\Temp\FEED.tmp"78⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\FF79.tmp"C:\Users\Admin\AppData\Local\Temp\FF79.tmp"79⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"80⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\73.tmp"C:\Users\Admin\AppData\Local\Temp\73.tmp"81⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\E1.tmp"C:\Users\Admin\AppData\Local\Temp\E1.tmp"82⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\15E.tmp"C:\Users\Admin\AppData\Local\Temp\15E.tmp"83⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"84⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\2E4.tmp"C:\Users\Admin\AppData\Local\Temp\2E4.tmp"86⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"87⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\3EE.tmp"C:\Users\Admin\AppData\Local\Temp\3EE.tmp"88⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"89⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\507.tmp"C:\Users\Admin\AppData\Local\Temp\507.tmp"90⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\594.tmp"C:\Users\Admin\AppData\Local\Temp\594.tmp"91⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"93⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"94⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp"95⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"96⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\8A1.tmp"C:\Users\Admin\AppData\Local\Temp\8A1.tmp"97⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"98⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"99⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"100⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\AD4.tmp"C:\Users\Admin\AppData\Local\Temp\AD4.tmp"101⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\B51.tmp"C:\Users\Admin\AppData\Local\Temp\B51.tmp"102⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BED.tmp"C:\Users\Admin\AppData\Local\Temp\BED.tmp"103⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"104⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\CE7.tmp"C:\Users\Admin\AppData\Local\Temp\CE7.tmp"105⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"106⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"107⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"108⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"109⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"110⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"111⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\1081.tmp"C:\Users\Admin\AppData\Local\Temp\1081.tmp"112⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"113⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"114⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"115⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\12A4.tmp"C:\Users\Admin\AppData\Local\Temp\12A4.tmp"116⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\1321.tmp"C:\Users\Admin\AppData\Local\Temp\1321.tmp"117⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\138E.tmp"C:\Users\Admin\AppData\Local\Temp\138E.tmp"118⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"119⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"120⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"121⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"122⤵PID:3456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-