Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-08_5a5d70e6e835a209f5f6960dc4f3630e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-08_5a5d70e6e835a209f5f6960dc4f3630e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-08_5a5d70e6e835a209f5f6960dc4f3630e_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample261009-reybcayv2k
- SHA256 504ff3ed0c7eededd229001b25f08ba45af49f8bae5e881f758e777625b2f036
- MD5 5a5d70e6e835a209f5f6960dc4f3630e
- SHA1 aa310420086f2f24bf8d62766e88064875928155
- SHA512 e6ab0913159883e575e67ca7b7ab0833cf3df8fc538e6f5b514c23d3b96ab8ac80cbcf3fe3da456baa73e807bcd1c9d0c3c4cb4075160214cab646b00be021cc
- SSDEEP 12288:wU5rCOTeiDrzyh7jd8sDeyCbym9RBX54rTIxuCNZ+3/v+I9hUG2VA:wUQOJDrxdL4rTIxuCNGEA
- TLSH T1DBE4D02173D88536E9F7037859B5F661497EBD326722D6CF2F9016AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4204 44CF.tmp 3212 4627.tmp 3368 477F.tmp 5676 48D7.tmp 4616 49E0.tmp 360 4B86.tmp 4496 4C51.tmp 4208 4D8A.tmp 4808 4EC2.tmp 3144 4FBC.tmp 4564 50C6.tmp 1640 51CF.tmp 1480 52E9.tmp 5380 53E3.tmp 4664 54FC.tmp 1424 5615.tmp 2224 5700.tmp 2096 5838.tmp 3232 5942.tmp 4480 5A2C.tmp 4200 5B26.tmp 3920 5C30.tmp 5688 5DB6.tmp 2064 5ED0.tmp 5028 6037.tmp 1064 6150.tmp 548 623B.tmp 1052 63B2.tmp 3484 6538.tmp 6000 6661.tmp 1780 67A9.tmp 4176 68A3.tmp 4188 69AD.tmp 3780 6A59.tmp 4712 6B14.tmp 2124 6C0E.tmp 6024 6CF9.tmp 5872 6D95.tmp 2244 6E70.tmp 5092 6F4A.tmp 2572 6FF6.tmp 3408 70B2.tmp 6084 716D.tmp 2720 7258.tmp 2796 72E4.tmp 5652 73BF.tmp 4088 746B.tmp 3952 74F7.tmp 2472 7584.tmp 5552 75F1.tmp 2480 765F.tmp 4740 76EB.tmp 5616 7797.tmp 3080 7824.tmp 4460 78B1.tmp 3428 792E.tmp 3652 79CA.tmp 3260 7A56.tmp 5244 7AD3.tmp 3104 7B7F.tmp 4092 7BFC.tmp 2528 7C79.tmp 2088 7CF6.tmp 2992 7D93.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 792E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A71E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C13E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B329.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5776 wrote to memory of 4204 5776 2026-10-08_5a5d70e6e835a209f5f6960dc4f3630e_elex_mafia_stealc_tofsee.exe 89 PID 4204 wrote to memory of 3212 4204 44CF.tmp 90 PID 3212 wrote to memory of 3368 3212 4627.tmp 91 PID 3368 wrote to memory of 5676 3368 477F.tmp 92 PID 5676 wrote to memory of 4616 5676 48D7.tmp 93 PID 4616 wrote to memory of 360 4616 49E0.tmp 94 PID 360 wrote to memory of 4496 360 4B86.tmp 95 PID 4496 wrote to memory of 4208 4496 4C51.tmp 96 PID 4208 wrote to memory of 4808 4208 4D8A.tmp 97 PID 4808 wrote to memory of 3144 4808 4EC2.tmp 98 PID 3144 wrote to memory of 4564 3144 4FBC.tmp 99 PID 4564 wrote to memory of 1640 4564 50C6.tmp 100 PID 1640 wrote to memory of 1480 1640 51CF.tmp 101 PID 1480 wrote to memory of 5380 1480 52E9.tmp 102 PID 5380 wrote to memory of 4664 5380 53E3.tmp 103 PID 4664 wrote to memory of 1424 4664 54FC.tmp 104 PID 1424 wrote to memory of 2224 1424 5615.tmp 105 PID 2224 wrote to memory of 2096 2224 5700.tmp 106 PID 2096 wrote to memory of 3232 2096 5838.tmp 107 PID 3232 wrote to memory of 4480 3232 5942.tmp 108 PID 4480 wrote to memory of 4200 4480 5A2C.tmp 109 PID 4200 wrote to memory of 3920 4200 5B26.tmp 110 PID 3920 wrote to memory of 5688 3920 5C30.tmp 111 PID 5688 wrote to memory of 2064 5688 5DB6.tmp 112 PID 2064 wrote to memory of 5028 2064 5ED0.tmp 113 PID 5028 wrote to memory of 1064 5028 6037.tmp 114 PID 1064 wrote to memory of 548 1064 6150.tmp 115 PID 548 wrote to memory of 1052 548 623B.tmp 116 PID 1052 wrote to memory of 3484 1052 63B2.tmp 117 PID 3484 wrote to memory of 6000 3484 6538.tmp 118 PID 6000 wrote to memory of 1780 6000 6661.tmp 119 PID 1780 wrote to memory of 4176 1780 67A9.tmp 120 PID 4176 wrote to memory of 4188 4176 68A3.tmp 121 PID 4188 wrote to memory of 3780 4188 69AD.tmp 122 PID 3780 wrote to memory of 4712 3780 6A59.tmp 123 PID 4712 wrote to memory of 2124 4712 6B14.tmp 124 PID 2124 wrote to memory of 6024 2124 6C0E.tmp 125 PID 6024 wrote to memory of 5872 6024 6CF9.tmp 126 PID 5872 wrote to memory of 2244 5872 6D95.tmp 127 PID 2244 wrote to memory of 5092 2244 6E70.tmp 128 PID 5092 wrote to memory of 2572 5092 6F4A.tmp 129 PID 2572 wrote to memory of 3408 2572 6FF6.tmp 130 PID 3408 wrote to memory of 6084 3408 70B2.tmp 131 PID 6084 wrote to memory of 2720 6084 716D.tmp 132 PID 2720 wrote to memory of 2796 2720 7258.tmp 133 PID 2796 wrote to memory of 5652 2796 72E4.tmp 134 PID 5652 wrote to memory of 4088 5652 73BF.tmp 135 PID 4088 wrote to memory of 3952 4088 746B.tmp 136 PID 3952 wrote to memory of 2472 3952 74F7.tmp 137 PID 2472 wrote to memory of 5552 2472 7584.tmp 138 PID 5552 wrote to memory of 2480 5552 75F1.tmp 139 PID 2480 wrote to memory of 4740 2480 765F.tmp 140 PID 4740 wrote to memory of 5616 4740 76EB.tmp 141 PID 5616 wrote to memory of 3080 5616 7797.tmp 142 PID 3080 wrote to memory of 4460 3080 7824.tmp 143 PID 4460 wrote to memory of 3428 4460 78B1.tmp 144 PID 3428 wrote to memory of 3652 3428 792E.tmp 145 PID 3652 wrote to memory of 3260 3652 79CA.tmp 146 PID 3260 wrote to memory of 5244 3260 7A56.tmp 147 PID 5244 wrote to memory of 3104 5244 7AD3.tmp 148 PID 3104 wrote to memory of 4092 3104 7B7F.tmp 149 PID 4092 wrote to memory of 2528 4092 7BFC.tmp 150 PID 2528 wrote to memory of 2088 2528 7C79.tmp 151 PID 2088 wrote to memory of 2992 2088 7CF6.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-08_5a5d70e6e835a209f5f6960dc4f3630e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-08_5a5d70e6e835a209f5f6960dc4f3630e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\49E0.tmp"C:\Users\Admin\AppData\Local\Temp\49E0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\50C6.tmp"C:\Users\Admin\AppData\Local\Temp\50C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\51CF.tmp"C:\Users\Admin\AppData\Local\Temp\51CF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\53E3.tmp"C:\Users\Admin\AppData\Local\Temp\53E3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\54FC.tmp"C:\Users\Admin\AppData\Local\Temp\54FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5615.tmp"C:\Users\Admin\AppData\Local\Temp\5615.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5700.tmp"C:\Users\Admin\AppData\Local\Temp\5700.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5838.tmp"C:\Users\Admin\AppData\Local\Temp\5838.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\5942.tmp"C:\Users\Admin\AppData\Local\Temp\5942.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5A2C.tmp"C:\Users\Admin\AppData\Local\Temp\5A2C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\63B2.tmp"C:\Users\Admin\AppData\Local\Temp\63B2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\68A3.tmp"C:\Users\Admin\AppData\Local\Temp\68A3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\6A59.tmp"C:\Users\Admin\AppData\Local\Temp\6A59.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\6D95.tmp"C:\Users\Admin\AppData\Local\Temp\6D95.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\70B2.tmp"C:\Users\Admin\AppData\Local\Temp\70B2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\716D.tmp"C:\Users\Admin\AppData\Local\Temp\716D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\72E4.tmp"C:\Users\Admin\AppData\Local\Temp\72E4.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\73BF.tmp"C:\Users\Admin\AppData\Local\Temp\73BF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\7584.tmp"C:\Users\Admin\AppData\Local\Temp\7584.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\76EB.tmp"C:\Users\Admin\AppData\Local\Temp\76EB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\7797.tmp"C:\Users\Admin\AppData\Local\Temp\7797.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\7824.tmp"C:\Users\Admin\AppData\Local\Temp\7824.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\78B1.tmp"C:\Users\Admin\AppData\Local\Temp\78B1.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\792E.tmp"C:\Users\Admin\AppData\Local\Temp\792E.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\79CA.tmp"C:\Users\Admin\AppData\Local\Temp\79CA.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"65⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"66⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"67⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\7F29.tmp"C:\Users\Admin\AppData\Local\Temp\7F29.tmp"68⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"69⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"70⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\80CF.tmp"C:\Users\Admin\AppData\Local\Temp\80CF.tmp"71⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"72⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\81B9.tmp"C:\Users\Admin\AppData\Local\Temp\81B9.tmp"73⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\8246.tmp"C:\Users\Admin\AppData\Local\Temp\8246.tmp"74⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\82B3.tmp"C:\Users\Admin\AppData\Local\Temp\82B3.tmp"75⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\8340.tmp"C:\Users\Admin\AppData\Local\Temp\8340.tmp"76⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"77⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"78⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"79⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"80⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"81⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"82⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\86DA.tmp"C:\Users\Admin\AppData\Local\Temp\86DA.tmp"83⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"84⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"85⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"86⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\88DD.tmp"C:\Users\Admin\AppData\Local\Temp\88DD.tmp"87⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"88⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"89⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"90⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"91⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"92⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"93⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"94⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"95⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"96⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"97⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"98⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\8F17.tmp"C:\Users\Admin\AppData\Local\Temp\8F17.tmp"99⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"100⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\905F.tmp"C:\Users\Admin\AppData\Local\Temp\905F.tmp"101⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"102⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\9178.tmp"C:\Users\Admin\AppData\Local\Temp\9178.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"104⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\92C0.tmp"C:\Users\Admin\AppData\Local\Temp\92C0.tmp"105⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"106⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"107⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"108⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"109⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"110⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"112⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"113⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\9783.tmp"C:\Users\Admin\AppData\Local\Temp\9783.tmp"114⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\97F1.tmp"C:\Users\Admin\AppData\Local\Temp\97F1.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"116⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\98DB.tmp"C:\Users\Admin\AppData\Local\Temp\98DB.tmp"117⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\9958.tmp"C:\Users\Admin\AppData\Local\Temp\9958.tmp"118⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"119⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"120⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"122⤵PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-