Analysis
- max time kernel
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 09:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_c23bdb0b153e02847b27810dec52d84b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_c23bdb0b153e02847b27810dec52d84b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-20_c23bdb0b153e02847b27810dec52d84b_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260820-llcqbstfja
- SHA256 019ba8c0bb0a6911351538c0d8aef8956c2df0a6b3048e1996af47cb6fd8c518
- MD5 c23bdb0b153e02847b27810dec52d84b
- SHA1 3f0d994a6cdab18fced8d2f19bd538b3e0e095c5
- SHA512 9885ae450ad557feeb603cab3b4430e19ab680562b1929ac40080c07a2f9a92f41420d18cde2bf0c74b3c25524a1965797b8d45fd209862b2b99379971583c74
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLKeThjUHuQSTYW3GJlv29tdvXKUvuCS+zxOrE:NU5rCOTeij9dUJzSc0dfPusOrFTZwlH
- TLSH T194B4E026B685C133E5D202710AE7EBB2693A7C71972264C73B94677E2FB12D09379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5240 A9E2.tmp 5728 AADC.tmp 1872 ABB7.tmp 1284 ACB1.tmp 824 ADAB.tmp 5076 AE95.tmp 4352 AF61.tmp 3468 B02C.tmp 5572 B0B8.tmp 5612 B155.tmp 1836 B1E1.tmp 4860 B2AC.tmp 2452 B377.tmp 4304 B452.tmp 2096 B4EE.tmp 5028 B57B.tmp 796 B656.tmp 4368 B6E2.tmp 3664 B77F.tmp 1136 B81B.tmp 2076 B8C7.tmp 1740 B963.tmp 5684 BA0F.tmp 5864 BACA.tmp 2400 BB76.tmp 3960 BC32.tmp 5664 BCAF.tmp 4440 BD3B.tmp 424 BE26.tmp 1956 BF01.tmp 2732 BFBC.tmp 5568 C0B6.tmp 5712 C143.tmp 3736 C1C0.tmp 480 C22D.tmp 5628 C29A.tmp 4264 C327.tmp 1948 C3A4.tmp 996 C421.tmp 2712 C4BD.tmp 1196 C54A.tmp 2972 C5F6.tmp 3448 C692.tmp 2608 C72E.tmp 2128 C7EA.tmp 4316 C867.tmp 5088 C8F3.tmp 4700 C961.tmp 1264 C9DE.tmp 6080 CA6A.tmp 5024 CAF7.tmp 1396 CB74.tmp 3784 CC10.tmp 4200 CCBC.tmp 3828 CD49.tmp 2716 CDF5.tmp 5580 CE81.tmp 3132 CEFE.tmp 4100 CF7B.tmp 4600 CFF8.tmp 2480 D0A4.tmp 5196 D140.tmp 1184 D1AE.tmp 5944 D23A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 590E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6127.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 709D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B57B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C29A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 5240 3952 2026-08-20_c23bdb0b153e02847b27810dec52d84b_elex_mafia_stealc_tofsee.exe 88 PID 5240 wrote to memory of 5728 5240 A9E2.tmp 89 PID 5728 wrote to memory of 1872 5728 AADC.tmp 90 PID 1872 wrote to memory of 1284 1872 ABB7.tmp 91 PID 1284 wrote to memory of 824 1284 ACB1.tmp 92 PID 824 wrote to memory of 5076 824 ADAB.tmp 93 PID 5076 wrote to memory of 4352 5076 AE95.tmp 94 PID 4352 wrote to memory of 3468 4352 AF61.tmp 95 PID 3468 wrote to memory of 5572 3468 B02C.tmp 96 PID 5572 wrote to memory of 5612 5572 B0B8.tmp 97 PID 5612 wrote to memory of 1836 5612 B155.tmp 98 PID 1836 wrote to memory of 4860 1836 B1E1.tmp 99 PID 4860 wrote to memory of 2452 4860 B2AC.tmp 100 PID 2452 wrote to memory of 4304 2452 B377.tmp 101 PID 4304 wrote to memory of 2096 4304 B452.tmp 102 PID 2096 wrote to memory of 5028 2096 B4EE.tmp 103 PID 5028 wrote to memory of 796 5028 B57B.tmp 104 PID 796 wrote to memory of 4368 796 B656.tmp 105 PID 4368 wrote to memory of 3664 4368 B6E2.tmp 106 PID 3664 wrote to memory of 1136 3664 B77F.tmp 107 PID 1136 wrote to memory of 2076 1136 B81B.tmp 108 PID 2076 wrote to memory of 1740 2076 B8C7.tmp 109 PID 1740 wrote to memory of 5684 1740 B963.tmp 110 PID 5684 wrote to memory of 5864 5684 BA0F.tmp 111 PID 5864 wrote to memory of 2400 5864 BACA.tmp 112 PID 2400 wrote to memory of 3960 2400 BB76.tmp 113 PID 3960 wrote to memory of 5664 3960 BC32.tmp 114 PID 5664 wrote to memory of 4440 5664 BCAF.tmp 115 PID 4440 wrote to memory of 424 4440 BD3B.tmp 116 PID 424 wrote to memory of 1956 424 BE26.tmp 117 PID 1956 wrote to memory of 2732 1956 BF01.tmp 118 PID 2732 wrote to memory of 5568 2732 BFBC.tmp 119 PID 5568 wrote to memory of 5712 5568 C0B6.tmp 120 PID 5712 wrote to memory of 3736 5712 C143.tmp 121 PID 3736 wrote to memory of 480 3736 C1C0.tmp 122 PID 480 wrote to memory of 5628 480 C22D.tmp 123 PID 5628 wrote to memory of 4264 5628 C29A.tmp 124 PID 4264 wrote to memory of 1948 4264 C327.tmp 125 PID 1948 wrote to memory of 996 1948 C3A4.tmp 126 PID 996 wrote to memory of 2712 996 C421.tmp 127 PID 2712 wrote to memory of 1196 2712 C4BD.tmp 128 PID 1196 wrote to memory of 2972 1196 C54A.tmp 129 PID 2972 wrote to memory of 3448 2972 C5F6.tmp 130 PID 3448 wrote to memory of 2608 3448 C692.tmp 131 PID 2608 wrote to memory of 2128 2608 C72E.tmp 132 PID 2128 wrote to memory of 4316 2128 C7EA.tmp 133 PID 4316 wrote to memory of 5088 4316 C867.tmp 134 PID 5088 wrote to memory of 4700 5088 C8F3.tmp 135 PID 4700 wrote to memory of 1264 4700 C961.tmp 136 PID 1264 wrote to memory of 6080 1264 C9DE.tmp 137 PID 6080 wrote to memory of 5024 6080 CA6A.tmp 138 PID 5024 wrote to memory of 1396 5024 CAF7.tmp 139 PID 1396 wrote to memory of 3784 1396 CB74.tmp 140 PID 3784 wrote to memory of 4200 3784 CC10.tmp 141 PID 4200 wrote to memory of 3828 4200 CCBC.tmp 142 PID 3828 wrote to memory of 2716 3828 CD49.tmp 143 PID 2716 wrote to memory of 5580 2716 CDF5.tmp 144 PID 5580 wrote to memory of 3132 5580 CE81.tmp 145 PID 3132 wrote to memory of 4100 3132 CEFE.tmp 146 PID 4100 wrote to memory of 4600 4100 CF7B.tmp 147 PID 4600 wrote to memory of 2480 4600 CFF8.tmp 148 PID 2480 wrote to memory of 5196 2480 D0A4.tmp 149 PID 5196 wrote to memory of 1184 5196 D140.tmp 150 PID 1184 wrote to memory of 5944 1184 D1AE.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_c23bdb0b153e02847b27810dec52d84b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c23bdb0b153e02847b27810dec52d84b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\AF61.tmp"C:\Users\Admin\AppData\Local\Temp\AF61.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B57B.tmp"C:\Users\Admin\AppData\Local\Temp\B57B.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\B6E2.tmp"C:\Users\Admin\AppData\Local\Temp\B6E2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\B77F.tmp"C:\Users\Admin\AppData\Local\Temp\B77F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\B81B.tmp"C:\Users\Admin\AppData\Local\Temp\B81B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\C143.tmp"C:\Users\Admin\AppData\Local\Temp\C143.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\C29A.tmp"C:\Users\Admin\AppData\Local\Temp\C29A.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\C327.tmp"C:\Users\Admin\AppData\Local\Temp\C327.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\C421.tmp"C:\Users\Admin\AppData\Local\Temp\C421.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\C692.tmp"C:\Users\Admin\AppData\Local\Temp\C692.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\C72E.tmp"C:\Users\Admin\AppData\Local\Temp\C72E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\CB74.tmp"C:\Users\Admin\AppData\Local\Temp\CB74.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CE81.tmp"C:\Users\Admin\AppData\Local\Temp\CE81.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\D23A.tmp"C:\Users\Admin\AppData\Local\Temp\D23A.tmp"65⤵
- Executes dropped EXE
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"67⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"68⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"69⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"70⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"71⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"72⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\D651.tmp"C:\Users\Admin\AppData\Local\Temp\D651.tmp"73⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"74⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"75⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"76⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"78⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"79⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"80⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"81⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"82⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"83⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"84⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"85⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"86⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\DD75.tmp"C:\Users\Admin\AppData\Local\Temp\DD75.tmp"87⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\DE02.tmp"C:\Users\Admin\AppData\Local\Temp\DE02.tmp"88⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"89⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"90⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"91⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"92⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"93⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"94⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"95⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\E286.tmp"C:\Users\Admin\AppData\Local\Temp\E286.tmp"96⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"97⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"98⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"99⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"100⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"102⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\E66E.tmp"C:\Users\Admin\AppData\Local\Temp\E66E.tmp"103⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"104⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"105⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\E853.tmp"C:\Users\Admin\AppData\Local\Temp\E853.tmp"106⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"107⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"108⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"109⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"110⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"111⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\EB60.tmp"C:\Users\Admin\AppData\Local\Temp\EB60.tmp"112⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"113⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"114⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"115⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"116⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"117⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"118⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"119⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\F052.tmp"C:\Users\Admin\AppData\Local\Temp\F052.tmp"121⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\F10D.tmp"C:\Users\Admin\AppData\Local\Temp\F10D.tmp"122⤵PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-