Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 06:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_ee7d6c99e4095c1f77c93ecb44aeabbb_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_ee7d6c99e4095c1f77c93ecb44aeabbb_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-16_ee7d6c99e4095c1f77c93ecb44aeabbb_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260416-hcwv3acs21
- SHA256 8262a44aba15e47ddc3c4b33ca8701f0cdd52fbc08aa0f1db3a4194cbaecfba7
- MD5 ee7d6c99e4095c1f77c93ecb44aeabbb
- SHA1 65e47af877a9af5c66973dd3b528a8a7b59b508c
- SHA512 2f6daaf9b1c14c3ea509866227f72b8880f786da1c24cf5b91fdfbff7d76f510072e76921412a6b25d9cedae93516e4f9c8907070c8d8f70ca12a37dfc9ec0e6
- SSDEEP 12288:NU5rCOTeijRfggcAdNRoqgVWInEE0bu+WxWPTZwlH:NUQOJjh8kNBb0GTSlH
- TLSH T1C8B4F1267684C132E2D202314FDADBA16A3EBC75172694C73B94627E2BB53E0D375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2068 4755.tmp 5004 4801.tmp 1104 48AC.tmp 3584 4939.tmp 5020 4997.tmp 4192 49F5.tmp 3244 4A62.tmp 1196 4B0E.tmp 3772 4B7B.tmp 3216 4C08.tmp 4112 4C94.tmp 3972 4D40.tmp 5240 4DDD.tmp 1796 4E88.tmp 4292 4F25.tmp 4808 4FB1.tmp 3924 500F.tmp 5960 50AB.tmp 4984 50F9.tmp 1236 51A5.tmp 3728 5213.tmp 5452 529F.tmp 4868 531C.tmp 5580 53A9.tmp 1352 5407.tmp 3264 5474.tmp 6000 54D2.tmp 3376 5530.tmp 1052 559D.tmp 2460 55FB.tmp 1768 5687.tmp 4008 5714.tmp 1692 57B0.tmp 2440 581E.tmp 1604 58AA.tmp 4728 58F8.tmp 6116 5956.tmp 4556 59B4.tmp 4020 5A21.tmp 2300 5A6F.tmp 3448 5ACD.tmp 3352 5B2B.tmp 4664 5B79.tmp 836 5BC7.tmp 2216 5C34.tmp 4404 5CA2.tmp 948 5CF0.tmp 668 5D5D.tmp 5904 5DBB.tmp 5576 5E19.tmp 5508 5E77.tmp 5640 5EC5.tmp 5980 5F13.tmp 3952 5F71.tmp 5652 5FBF.tmp 1924 600D.tmp 808 606B.tmp 3356 60C8.tmp 5052 6136.tmp 1828 6184.tmp 5124 61D2.tmp 5252 6230.tmp 4764 629D.tmp 3332 62FB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 386B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B78E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7088.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6453.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C32C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D16F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5948 wrote to memory of 2068 5948 2026-04-16_ee7d6c99e4095c1f77c93ecb44aeabbb_elex_mafia_stealc_tofsee.exe 79 PID 2068 wrote to memory of 5004 2068 4755.tmp 80 PID 5004 wrote to memory of 1104 5004 4801.tmp 81 PID 1104 wrote to memory of 3584 1104 48AC.tmp 82 PID 3584 wrote to memory of 5020 3584 4939.tmp 83 PID 5020 wrote to memory of 4192 5020 4997.tmp 84 PID 4192 wrote to memory of 3244 4192 49F5.tmp 85 PID 3244 wrote to memory of 1196 3244 4A62.tmp 86 PID 1196 wrote to memory of 3772 1196 4B0E.tmp 87 PID 3772 wrote to memory of 3216 3772 4B7B.tmp 88 PID 3216 wrote to memory of 4112 3216 4C08.tmp 89 PID 4112 wrote to memory of 3972 4112 4C94.tmp 90 PID 3972 wrote to memory of 5240 3972 4D40.tmp 91 PID 5240 wrote to memory of 1796 5240 4DDD.tmp 92 PID 1796 wrote to memory of 4292 1796 4E88.tmp 93 PID 4292 wrote to memory of 4808 4292 4F25.tmp 94 PID 4808 wrote to memory of 3924 4808 4FB1.tmp 95 PID 3924 wrote to memory of 5960 3924 500F.tmp 96 PID 5960 wrote to memory of 4984 5960 50AB.tmp 97 PID 4984 wrote to memory of 1236 4984 50F9.tmp 98 PID 1236 wrote to memory of 3728 1236 51A5.tmp 99 PID 3728 wrote to memory of 5452 3728 5213.tmp 100 PID 5452 wrote to memory of 4868 5452 529F.tmp 101 PID 4868 wrote to memory of 5580 4868 531C.tmp 102 PID 5580 wrote to memory of 1352 5580 53A9.tmp 103 PID 1352 wrote to memory of 3264 1352 5407.tmp 104 PID 3264 wrote to memory of 6000 3264 5474.tmp 105 PID 6000 wrote to memory of 3376 6000 54D2.tmp 106 PID 3376 wrote to memory of 1052 3376 5530.tmp 107 PID 1052 wrote to memory of 2460 1052 559D.tmp 108 PID 2460 wrote to memory of 1768 2460 55FB.tmp 109 PID 1768 wrote to memory of 4008 1768 5687.tmp 110 PID 4008 wrote to memory of 1692 4008 5714.tmp 111 PID 1692 wrote to memory of 2440 1692 57B0.tmp 112 PID 2440 wrote to memory of 1604 2440 581E.tmp 113 PID 1604 wrote to memory of 4728 1604 58AA.tmp 114 PID 4728 wrote to memory of 6116 4728 58F8.tmp 115 PID 6116 wrote to memory of 4556 6116 5956.tmp 116 PID 4556 wrote to memory of 4020 4556 59B4.tmp 117 PID 4020 wrote to memory of 2300 4020 5A21.tmp 118 PID 2300 wrote to memory of 3448 2300 5A6F.tmp 119 PID 3448 wrote to memory of 3352 3448 5ACD.tmp 120 PID 3352 wrote to memory of 4664 3352 5B2B.tmp 121 PID 4664 wrote to memory of 836 4664 5B79.tmp 122 PID 836 wrote to memory of 2216 836 5BC7.tmp 123 PID 2216 wrote to memory of 4404 2216 5C34.tmp 124 PID 4404 wrote to memory of 948 4404 5CA2.tmp 125 PID 948 wrote to memory of 668 948 5CF0.tmp 126 PID 668 wrote to memory of 5904 668 5D5D.tmp 127 PID 5904 wrote to memory of 5576 5904 5DBB.tmp 128 PID 5576 wrote to memory of 5508 5576 5E19.tmp 129 PID 5508 wrote to memory of 5640 5508 5E77.tmp 130 PID 5640 wrote to memory of 5980 5640 5EC5.tmp 131 PID 5980 wrote to memory of 3952 5980 5F13.tmp 132 PID 3952 wrote to memory of 5652 3952 5F71.tmp 133 PID 5652 wrote to memory of 1924 5652 5FBF.tmp 134 PID 1924 wrote to memory of 808 1924 600D.tmp 135 PID 808 wrote to memory of 3356 808 606B.tmp 136 PID 3356 wrote to memory of 5052 3356 60C8.tmp 137 PID 5052 wrote to memory of 1828 5052 6136.tmp 138 PID 1828 wrote to memory of 5124 1828 6184.tmp 139 PID 5124 wrote to memory of 5252 5124 61D2.tmp 140 PID 5252 wrote to memory of 4764 5252 6230.tmp 141 PID 4764 wrote to memory of 3332 4764 629D.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_ee7d6c99e4095c1f77c93ecb44aeabbb_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_ee7d6c99e4095c1f77c93ecb44aeabbb_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"65⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\6378.tmp"C:\Users\Admin\AppData\Local\Temp\6378.tmp"66⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"67⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:412 -
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"70⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"71⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"72⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"73⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"74⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"75⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"76⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"77⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"79⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"80⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"81⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"82⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"83⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"84⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"85⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"86⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"87⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"88⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"89⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"90⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"91⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"92⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"93⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\6F11.tmp"C:\Users\Admin\AppData\Local\Temp\6F11.tmp"94⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"95⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"96⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"97⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"100⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"101⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"102⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"103⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"104⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"105⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"106⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"107⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"108⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"109⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"110⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"111⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"112⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"113⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"114⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"115⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"116⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"117⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"118⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"119⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"120⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7923.tmp"C:\Users\Admin\AppData\Local\Temp\7923.tmp"121⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-