Analysis
- max time kernel
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_40373ad2a0995652bdd53c5f3e9b6db9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_40373ad2a0995652bdd53c5f3e9b6db9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-14_40373ad2a0995652bdd53c5f3e9b6db9_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260814-1tm9cscc37
- SHA256 f2dab9f5b3b9ababf0e6231e4fec3c2663e2ecbdad0ff25b1d4c1fddeef186a4
- MD5 40373ad2a0995652bdd53c5f3e9b6db9
- SHA1 75c50b1f024a47bb3ca77975312804389605f98f
- SHA512 6d0c5d9b3975fec30670eb3a2544701975ea11d871b0a44a67fc7bd4eeb6a8b83177cd6b8856b0696a2dfceac791b7fe147bb8662f10432c6f7a94577d8bd9fb
- SSDEEP 12288:wU5rCOTeiD6SXT1ZQpoHHGeQNZ+3/v+I9hUG2VA:wUQOJD/jtHkNGEA
- TLSH T13CE4D02173D88632E5F7037859B5E6614D7EFD226722D6CF2F8016AE09B1BD08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4132 4358.tmp 6068 452D.tmp 5516 4646.tmp 4376 46F2.tmp 5468 476F.tmp 5524 48B7.tmp 4104 4A2E.tmp 120 4B48.tmp 3768 4C70.tmp 5032 4D6A.tmp 2896 4EA3.tmp 4948 4F9D.tmp 1160 5087.tmp 1112 5172.tmp 2364 527B.tmp 6028 5385.tmp 3460 547F.tmp 5180 55A8.tmp 4268 56C1.tmp 4652 57CB.tmp 4620 5913.tmp 5876 5A0D.tmp 2352 5B16.tmp 4284 5C3F.tmp 3776 5D49.tmp 5572 5E62.tmp 4936 5F8B.tmp 2008 6095.tmp 1904 61CD.tmp 1516 62A8.tmp 1332 6392.tmp 4884 64AC.tmp 2052 65C5.tmp 4832 6680.tmp 5460 675B.tmp 5664 6836.tmp 4240 68E2.tmp 4224 69DC.tmp 1756 6A97.tmp 2740 6B33.tmp 2488 6BFF.tmp 880 6CD9.tmp 1524 6D85.tmp 4276 6E50.tmp 3428 6F2B.tmp 776 6FB8.tmp 1880 7044.tmp 4692 70D1.tmp 4432 714E.tmp 1780 71BB.tmp 3712 7248.tmp 6036 72D5.tmp 3232 7352.tmp 5436 73DE.tmp 5964 746B.tmp 4864 74F7.tmp 4848 7574.tmp 5428 75E2.tmp 3016 765F.tmp 2576 76CC.tmp 5612 7749.tmp 5984 77B7.tmp 4584 7834.tmp 364 78A1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F36A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 885B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 902B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F483.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5872 wrote to memory of 4132 5872 2026-08-14_40373ad2a0995652bdd53c5f3e9b6db9_elex_mafia_stealc_tofsee.exe 89 PID 4132 wrote to memory of 6068 4132 4358.tmp 90 PID 6068 wrote to memory of 5516 6068 452D.tmp 91 PID 5516 wrote to memory of 4376 5516 4646.tmp 92 PID 4376 wrote to memory of 5468 4376 46F2.tmp 93 PID 5468 wrote to memory of 5524 5468 476F.tmp 94 PID 5524 wrote to memory of 4104 5524 48B7.tmp 95 PID 4104 wrote to memory of 120 4104 4A2E.tmp 96 PID 120 wrote to memory of 3768 120 4B48.tmp 97 PID 3768 wrote to memory of 5032 3768 4C70.tmp 98 PID 5032 wrote to memory of 2896 5032 4D6A.tmp 99 PID 2896 wrote to memory of 4948 2896 4EA3.tmp 100 PID 4948 wrote to memory of 1160 4948 4F9D.tmp 101 PID 1160 wrote to memory of 1112 1160 5087.tmp 102 PID 1112 wrote to memory of 2364 1112 5172.tmp 103 PID 2364 wrote to memory of 6028 2364 527B.tmp 104 PID 6028 wrote to memory of 3460 6028 5385.tmp 105 PID 3460 wrote to memory of 5180 3460 547F.tmp 106 PID 5180 wrote to memory of 4268 5180 55A8.tmp 107 PID 4268 wrote to memory of 4652 4268 56C1.tmp 108 PID 4652 wrote to memory of 4620 4652 57CB.tmp 109 PID 4620 wrote to memory of 5876 4620 5913.tmp 110 PID 5876 wrote to memory of 2352 5876 5A0D.tmp 111 PID 2352 wrote to memory of 4284 2352 5B16.tmp 112 PID 4284 wrote to memory of 3776 4284 5C3F.tmp 113 PID 3776 wrote to memory of 5572 3776 5D49.tmp 114 PID 5572 wrote to memory of 4936 5572 5E62.tmp 115 PID 4936 wrote to memory of 2008 4936 5F8B.tmp 116 PID 2008 wrote to memory of 1904 2008 6095.tmp 117 PID 1904 wrote to memory of 1516 1904 61CD.tmp 118 PID 1516 wrote to memory of 1332 1516 62A8.tmp 119 PID 1332 wrote to memory of 4884 1332 6392.tmp 120 PID 4884 wrote to memory of 2052 4884 64AC.tmp 121 PID 2052 wrote to memory of 4832 2052 65C5.tmp 122 PID 4832 wrote to memory of 5460 4832 6680.tmp 123 PID 5460 wrote to memory of 5664 5460 675B.tmp 124 PID 5664 wrote to memory of 4240 5664 6836.tmp 125 PID 4240 wrote to memory of 4224 4240 68E2.tmp 126 PID 4224 wrote to memory of 1756 4224 69DC.tmp 127 PID 1756 wrote to memory of 2740 1756 6A97.tmp 128 PID 2740 wrote to memory of 2488 2740 6B33.tmp 129 PID 2488 wrote to memory of 880 2488 6BFF.tmp 130 PID 880 wrote to memory of 1524 880 6CD9.tmp 131 PID 1524 wrote to memory of 4276 1524 6D85.tmp 132 PID 4276 wrote to memory of 3428 4276 6E50.tmp 133 PID 3428 wrote to memory of 776 3428 6F2B.tmp 134 PID 776 wrote to memory of 1880 776 6FB8.tmp 135 PID 1880 wrote to memory of 4692 1880 7044.tmp 136 PID 4692 wrote to memory of 4432 4692 70D1.tmp 137 PID 4432 wrote to memory of 1780 4432 714E.tmp 138 PID 1780 wrote to memory of 3712 1780 71BB.tmp 139 PID 3712 wrote to memory of 6036 3712 7248.tmp 140 PID 6036 wrote to memory of 3232 6036 72D5.tmp 141 PID 3232 wrote to memory of 5436 3232 7352.tmp 142 PID 5436 wrote to memory of 5964 5436 73DE.tmp 143 PID 5964 wrote to memory of 4864 5964 746B.tmp 144 PID 4864 wrote to memory of 4848 4864 74F7.tmp 145 PID 4848 wrote to memory of 5428 4848 7574.tmp 146 PID 5428 wrote to memory of 3016 5428 75E2.tmp 147 PID 3016 wrote to memory of 2576 3016 765F.tmp 148 PID 2576 wrote to memory of 5612 2576 76CC.tmp 149 PID 5612 wrote to memory of 5984 5612 7749.tmp 150 PID 5984 wrote to memory of 4584 5984 77B7.tmp 151 PID 4584 wrote to memory of 364 4584 7834.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_40373ad2a0995652bdd53c5f3e9b6db9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_40373ad2a0995652bdd53c5f3e9b6db9_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\46F2.tmp"C:\Users\Admin\AppData\Local\Temp\46F2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\476F.tmp"C:\Users\Admin\AppData\Local\Temp\476F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\56C1.tmp"C:\Users\Admin\AppData\Local\Temp\56C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5913.tmp"C:\Users\Admin\AppData\Local\Temp\5913.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5D49.tmp"C:\Users\Admin\AppData\Local\Temp\5D49.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5E62.tmp"C:\Users\Admin\AppData\Local\Temp\5E62.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\61CD.tmp"C:\Users\Admin\AppData\Local\Temp\61CD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\62A8.tmp"C:\Users\Admin\AppData\Local\Temp\62A8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\64AC.tmp"C:\Users\Admin\AppData\Local\Temp\64AC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\69DC.tmp"C:\Users\Admin\AppData\Local\Temp\69DC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\6A97.tmp"C:\Users\Admin\AppData\Local\Temp\6A97.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\6D85.tmp"C:\Users\Admin\AppData\Local\Temp\6D85.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\6E50.tmp"C:\Users\Admin\AppData\Local\Temp\6E50.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\714E.tmp"C:\Users\Admin\AppData\Local\Temp\714E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\71BB.tmp"C:\Users\Admin\AppData\Local\Temp\71BB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7248.tmp"C:\Users\Admin\AppData\Local\Temp\7248.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\7352.tmp"C:\Users\Admin\AppData\Local\Temp\7352.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\7574.tmp"C:\Users\Admin\AppData\Local\Temp\7574.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\75E2.tmp"C:\Users\Admin\AppData\Local\Temp\75E2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\77B7.tmp"C:\Users\Admin\AppData\Local\Temp\77B7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\78A1.tmp"C:\Users\Admin\AppData\Local\Temp\78A1.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:364 -
C:\Users\Admin\AppData\Local\Temp\791E.tmp"C:\Users\Admin\AppData\Local\Temp\791E.tmp"66⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"67⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"68⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7A66.tmp"C:\Users\Admin\AppData\Local\Temp\7A66.tmp"69⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"70⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"71⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\7BED.tmp"C:\Users\Admin\AppData\Local\Temp\7BED.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"73⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"74⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"75⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"77⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"80⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\8032.tmp"C:\Users\Admin\AppData\Local\Temp\8032.tmp"81⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"82⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\812C.tmp"C:\Users\Admin\AppData\Local\Temp\812C.tmp"83⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"84⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"85⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"86⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\8320.tmp"C:\Users\Admin\AppData\Local\Temp\8320.tmp"87⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"88⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"89⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"91⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"92⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\862E.tmp"C:\Users\Admin\AppData\Local\Temp\862E.tmp"93⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\869B.tmp"C:\Users\Admin\AppData\Local\Temp\869B.tmp"94⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"95⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\87B4.tmp"C:\Users\Admin\AppData\Local\Temp\87B4.tmp"96⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"97⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"98⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"99⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"100⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"101⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"102⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"103⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"104⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"105⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"106⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\8D04.tmp"C:\Users\Admin\AppData\Local\Temp\8D04.tmp"107⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"108⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"109⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"110⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\8F17.tmp"C:\Users\Admin\AppData\Local\Temp\8F17.tmp"111⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\8F94.tmp"C:\Users\Admin\AppData\Local\Temp\8F94.tmp"112⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"113⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"114⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"115⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"116⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"117⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\9253.tmp"C:\Users\Admin\AppData\Local\Temp\9253.tmp"118⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\92D0.tmp"C:\Users\Admin\AppData\Local\Temp\92D0.tmp"119⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"120⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"121⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"122⤵PID:1288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-