Analysis
- max time kernel
122s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample261027-v4v43aeb62
- SHA256 7c2dbac6ba5c6fbbc6ce4ac1ccec544ca2161acac2b18b168508968474cdab1d
- MD5 51a1bfd3a778525c22cef28769b62a0c
- SHA1 51e6e81112a45a71b94b5510cabac494dcf8010f
- SHA512 1a5584993f4b59fd6a06640816472b5353f30426cf6deb45bf9ff8903901df905f30a5e1e0ad760c5f10805072b67c22364d5347201585bd680d922c87d75082
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLNzhA5+8+emxjA20tfVwa78NB9OW9qobEXN2a:NU5rCOTeijMc6+/9OW9k92yaVTZwlH
- TLSH T1D8B4E025B589C132E59301710ED6EBA22E3A7D74572294C73B94633E2FB13E1E3B5346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2592 21B2.tmp 1416 223F.tmp 248 22FA.tmp 1064 2387.tmp 956 2442.tmp 3988 25B9.tmp 1804 2636.tmp 5200 26C3.tmp 2504 275F.tmp 4808 280B.tmp 3680 28D6.tmp 1196 2982.tmp 2840 29FF.tmp 5764 2A6D.tmp 1976 2B09.tmp 3956 2BA5.tmp 5976 2C41.tmp 480 2CBE.tmp 5328 2D2C.tmp 2416 2DD8.tmp 6096 2E93.tmp 1484 2F2F.tmp 3984 2FDB.tmp 2356 3058.tmp 4024 3123.tmp 2464 31A0.tmp 4508 321D.tmp 2400 329A.tmp 4152 3327.tmp 1500 33F2.tmp 3508 34CD.tmp 2040 3559.tmp 3932 3605.tmp 3172 3692.tmp 5552 371F.tmp 3028 378C.tmp 3264 37F9.tmp 720 3886.tmp 4860 3913.tmp 1340 3990.tmp 3096 39ED.tmp 6140 3A6A.tmp 3624 3AE7.tmp 6044 3B55.tmp 4728 3BD2.tmp 5788 3C5E.tmp 3880 3CDB.tmp 3356 3D78.tmp 2728 3DE5.tmp 5924 3E72.tmp 1168 3EEF.tmp 3016 3F7B.tmp 3684 3FE9.tmp 5904 4056.tmp 476 40C3.tmp 3112 4150.tmp 5064 41CD.tmp 5988 422B.tmp 2516 4298.tmp 4288 4315.tmp 5224 43A2.tmp 2052 441F.tmp 4216 44CB.tmp 5608 4538.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 690C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E36C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C370.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 422B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C13E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 999D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 215F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E698.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB85.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3656 wrote to memory of 2592 3656 2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe 88 PID 2592 wrote to memory of 1416 2592 21B2.tmp 89 PID 1416 wrote to memory of 248 1416 223F.tmp 90 PID 248 wrote to memory of 1064 248 22FA.tmp 91 PID 1064 wrote to memory of 956 1064 2387.tmp 92 PID 956 wrote to memory of 3988 956 2442.tmp 93 PID 3988 wrote to memory of 1804 3988 25B9.tmp 94 PID 1804 wrote to memory of 5200 1804 2636.tmp 95 PID 5200 wrote to memory of 2504 5200 26C3.tmp 96 PID 2504 wrote to memory of 4808 2504 275F.tmp 97 PID 4808 wrote to memory of 3680 4808 280B.tmp 98 PID 3680 wrote to memory of 1196 3680 28D6.tmp 99 PID 1196 wrote to memory of 2840 1196 2982.tmp 100 PID 2840 wrote to memory of 5764 2840 29FF.tmp 101 PID 5764 wrote to memory of 1976 5764 2A6D.tmp 102 PID 1976 wrote to memory of 3956 1976 2B09.tmp 103 PID 3956 wrote to memory of 5976 3956 2BA5.tmp 104 PID 5976 wrote to memory of 480 5976 2C41.tmp 105 PID 480 wrote to memory of 5328 480 2CBE.tmp 106 PID 5328 wrote to memory of 2416 5328 2D2C.tmp 107 PID 2416 wrote to memory of 6096 2416 2DD8.tmp 108 PID 6096 wrote to memory of 1484 6096 2E93.tmp 109 PID 1484 wrote to memory of 3984 1484 2F2F.tmp 110 PID 3984 wrote to memory of 2356 3984 2FDB.tmp 111 PID 2356 wrote to memory of 4024 2356 3058.tmp 112 PID 4024 wrote to memory of 2464 4024 3123.tmp 113 PID 2464 wrote to memory of 4508 2464 31A0.tmp 114 PID 4508 wrote to memory of 2400 4508 321D.tmp 115 PID 2400 wrote to memory of 4152 2400 329A.tmp 116 PID 4152 wrote to memory of 1500 4152 3327.tmp 117 PID 1500 wrote to memory of 3508 1500 33F2.tmp 118 PID 3508 wrote to memory of 2040 3508 34CD.tmp 119 PID 2040 wrote to memory of 3932 2040 3559.tmp 120 PID 3932 wrote to memory of 3172 3932 3605.tmp 121 PID 3172 wrote to memory of 5552 3172 3692.tmp 122 PID 5552 wrote to memory of 3028 5552 371F.tmp 123 PID 3028 wrote to memory of 3264 3028 378C.tmp 124 PID 3264 wrote to memory of 720 3264 37F9.tmp 125 PID 720 wrote to memory of 4860 720 3886.tmp 126 PID 4860 wrote to memory of 1340 4860 3913.tmp 127 PID 1340 wrote to memory of 3096 1340 3990.tmp 128 PID 3096 wrote to memory of 6140 3096 39ED.tmp 129 PID 6140 wrote to memory of 3624 6140 3A6A.tmp 130 PID 3624 wrote to memory of 6044 3624 3AE7.tmp 131 PID 6044 wrote to memory of 4728 6044 3B55.tmp 132 PID 4728 wrote to memory of 5788 4728 3BD2.tmp 133 PID 5788 wrote to memory of 3880 5788 3C5E.tmp 134 PID 3880 wrote to memory of 3356 3880 3CDB.tmp 135 PID 3356 wrote to memory of 2728 3356 3D78.tmp 136 PID 2728 wrote to memory of 5924 2728 3DE5.tmp 137 PID 5924 wrote to memory of 1168 5924 3E72.tmp 138 PID 1168 wrote to memory of 3016 1168 3EEF.tmp 139 PID 3016 wrote to memory of 3684 3016 3F7B.tmp 140 PID 3684 wrote to memory of 5904 3684 3FE9.tmp 141 PID 5904 wrote to memory of 476 5904 4056.tmp 142 PID 476 wrote to memory of 3112 476 40C3.tmp 143 PID 3112 wrote to memory of 5064 3112 4150.tmp 144 PID 5064 wrote to memory of 5988 5064 41CD.tmp 145 PID 5988 wrote to memory of 2516 5988 422B.tmp 146 PID 2516 wrote to memory of 4288 2516 4298.tmp 147 PID 4288 wrote to memory of 5224 4288 4315.tmp 148 PID 5224 wrote to memory of 2052 5224 43A2.tmp 149 PID 2052 wrote to memory of 4216 2052 441F.tmp 150 PID 4216 wrote to memory of 5608 4216 44CB.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_51a1bfd3a778525c22cef28769b62a0c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2442.tmp"C:\Users\Admin\AppData\Local\Temp\2442.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\280B.tmp"C:\Users\Admin\AppData\Local\Temp\280B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\28D6.tmp"C:\Users\Admin\AppData\Local\Temp\28D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\2B09.tmp"C:\Users\Admin\AppData\Local\Temp\2B09.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2C41.tmp"C:\Users\Admin\AppData\Local\Temp\2C41.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"C:\Users\Admin\AppData\Local\Temp\2D2C.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\31A0.tmp"C:\Users\Admin\AppData\Local\Temp\31A0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\321D.tmp"C:\Users\Admin\AppData\Local\Temp\321D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\329A.tmp"C:\Users\Admin\AppData\Local\Temp\329A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3327.tmp"C:\Users\Admin\AppData\Local\Temp\3327.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\33F2.tmp"C:\Users\Admin\AppData\Local\Temp\33F2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\34CD.tmp"C:\Users\Admin\AppData\Local\Temp\34CD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\3559.tmp"C:\Users\Admin\AppData\Local\Temp\3559.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3605.tmp"C:\Users\Admin\AppData\Local\Temp\3605.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\3692.tmp"C:\Users\Admin\AppData\Local\Temp\3692.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\371F.tmp"C:\Users\Admin\AppData\Local\Temp\371F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\378C.tmp"C:\Users\Admin\AppData\Local\Temp\378C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\37F9.tmp"C:\Users\Admin\AppData\Local\Temp\37F9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\3886.tmp"C:\Users\Admin\AppData\Local\Temp\3886.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\3913.tmp"C:\Users\Admin\AppData\Local\Temp\3913.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3990.tmp"C:\Users\Admin\AppData\Local\Temp\3990.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\39ED.tmp"C:\Users\Admin\AppData\Local\Temp\39ED.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\3B55.tmp"C:\Users\Admin\AppData\Local\Temp\3B55.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\3BD2.tmp"C:\Users\Admin\AppData\Local\Temp\3BD2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3C5E.tmp"C:\Users\Admin\AppData\Local\Temp\3C5E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3D78.tmp"C:\Users\Admin\AppData\Local\Temp\3D78.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3E72.tmp"C:\Users\Admin\AppData\Local\Temp\3E72.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\4056.tmp"C:\Users\Admin\AppData\Local\Temp\4056.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\40C3.tmp"C:\Users\Admin\AppData\Local\Temp\40C3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\4150.tmp"C:\Users\Admin\AppData\Local\Temp\4150.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\41CD.tmp"C:\Users\Admin\AppData\Local\Temp\41CD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\422B.tmp"C:\Users\Admin\AppData\Local\Temp\422B.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\4298.tmp"C:\Users\Admin\AppData\Local\Temp\4298.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4315.tmp"C:\Users\Admin\AppData\Local\Temp\4315.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\43A2.tmp"C:\Users\Admin\AppData\Local\Temp\43A2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\441F.tmp"C:\Users\Admin\AppData\Local\Temp\441F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\44CB.tmp"C:\Users\Admin\AppData\Local\Temp\44CB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4538.tmp"C:\Users\Admin\AppData\Local\Temp\4538.tmp"65⤵
- Executes dropped EXE
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\45A5.tmp"C:\Users\Admin\AppData\Local\Temp\45A5.tmp"66⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"67⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\4690.tmp"C:\Users\Admin\AppData\Local\Temp\4690.tmp"68⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\470D.tmp"C:\Users\Admin\AppData\Local\Temp\470D.tmp"69⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\477A.tmp"C:\Users\Admin\AppData\Local\Temp\477A.tmp"70⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\47F7.tmp"C:\Users\Admin\AppData\Local\Temp\47F7.tmp"71⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\4864.tmp"C:\Users\Admin\AppData\Local\Temp\4864.tmp"72⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\48E1.tmp"C:\Users\Admin\AppData\Local\Temp\48E1.tmp"73⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\493F.tmp"C:\Users\Admin\AppData\Local\Temp\493F.tmp"74⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\49DB.tmp"C:\Users\Admin\AppData\Local\Temp\49DB.tmp"75⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\4A58.tmp"C:\Users\Admin\AppData\Local\Temp\4A58.tmp"76⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"77⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"78⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\4C3D.tmp"C:\Users\Admin\AppData\Local\Temp\4C3D.tmp"80⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\4CBA.tmp"C:\Users\Admin\AppData\Local\Temp\4CBA.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\4D37.tmp"C:\Users\Admin\AppData\Local\Temp\4D37.tmp"82⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"83⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\4E40.tmp"C:\Users\Admin\AppData\Local\Temp\4E40.tmp"84⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"85⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"86⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"87⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\5063.tmp"C:\Users\Admin\AppData\Local\Temp\5063.tmp"88⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\50E0.tmp"C:\Users\Admin\AppData\Local\Temp\50E0.tmp"89⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\515D.tmp"C:\Users\Admin\AppData\Local\Temp\515D.tmp"90⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\51CB.tmp"C:\Users\Admin\AppData\Local\Temp\51CB.tmp"91⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5248.tmp"C:\Users\Admin\AppData\Local\Temp\5248.tmp"92⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\52C5.tmp"C:\Users\Admin\AppData\Local\Temp\52C5.tmp"93⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\5332.tmp"C:\Users\Admin\AppData\Local\Temp\5332.tmp"94⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\539F.tmp"C:\Users\Admin\AppData\Local\Temp\539F.tmp"95⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\53FD.tmp"C:\Users\Admin\AppData\Local\Temp\53FD.tmp"96⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\547A.tmp"C:\Users\Admin\AppData\Local\Temp\547A.tmp"97⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\54F7.tmp"C:\Users\Admin\AppData\Local\Temp\54F7.tmp"98⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5574.tmp"C:\Users\Admin\AppData\Local\Temp\5574.tmp"99⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\55D2.tmp"C:\Users\Admin\AppData\Local\Temp\55D2.tmp"100⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\565F.tmp"C:\Users\Admin\AppData\Local\Temp\565F.tmp"101⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\56FB.tmp"C:\Users\Admin\AppData\Local\Temp\56FB.tmp"102⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5768.tmp"C:\Users\Admin\AppData\Local\Temp\5768.tmp"103⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\5804.tmp"C:\Users\Admin\AppData\Local\Temp\5804.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5891.tmp"C:\Users\Admin\AppData\Local\Temp\5891.tmp"105⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\58FE.tmp"C:\Users\Admin\AppData\Local\Temp\58FE.tmp"106⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\597B.tmp"C:\Users\Admin\AppData\Local\Temp\597B.tmp"107⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5A08.tmp"C:\Users\Admin\AppData\Local\Temp\5A08.tmp"108⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\5A95.tmp"C:\Users\Admin\AppData\Local\Temp\5A95.tmp"109⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\5B12.tmp"C:\Users\Admin\AppData\Local\Temp\5B12.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5B8F.tmp"C:\Users\Admin\AppData\Local\Temp\5B8F.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"112⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\5C79.tmp"C:\Users\Admin\AppData\Local\Temp\5C79.tmp"113⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"114⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\5D54.tmp"C:\Users\Admin\AppData\Local\Temp\5D54.tmp"115⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"116⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"117⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\5ECB.tmp"C:\Users\Admin\AppData\Local\Temp\5ECB.tmp"118⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\5F67.tmp"C:\Users\Admin\AppData\Local\Temp\5F67.tmp"119⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"120⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\6080.tmp"C:\Users\Admin\AppData\Local\Temp\6080.tmp"121⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\60FD.tmp"C:\Users\Admin\AppData\Local\Temp\60FD.tmp"122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-