Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_a76733f3ec86433980aa060867e86d66_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_a76733f3ec86433980aa060867e86d66_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-26_a76733f3ec86433980aa060867e86d66_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260629-qmy26sf14q
- SHA256 2e69fd88ee31a5549243989f1cae4ef97970dcb6bc325f9ce781628adeed4c33
- MD5 a76733f3ec86433980aa060867e86d66
- SHA1 298a56db50c294f020d021fd50887371086cd1f1
- SHA512 91f1e4c2998b4976d0057daee07e3d7fd401320fb4448a914daf2796e53b890ba124ed236b2b019cf3cb1373697693189f722de1620122102658abaa827160d2
- SSDEEP 12288:NU5rCOTeijdkXeLgvOqJiv81hwtGi96u+Rj4TZwlH4Hp:NUQOJjdkusvO0iynC6ucj4TSlH4Hp
- TLSH T1A5B4F029B289C233E59302311AD6EBE23A3B7C35572694C73B94626D2F717E1D375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5924 7D78.tmp 4300 7E05.tmp 6096 7EA1.tmp 6984 7F0E.tmp 7036 8095.tmp 2912 8112.tmp 5068 818F.tmp 2692 820C.tmp 1300 82A8.tmp 3000 8335.tmp 5280 83B2.tmp 1696 843E.tmp 1384 84CB.tmp 3428 8567.tmp 3760 8613.tmp 6704 8681.tmp 1972 86FE.tmp 2140 878A.tmp 6980 8807.tmp 7136 8865.tmp 2896 8911.tmp 2592 89DC.tmp 1476 8A3A.tmp 5328 8AC6.tmp 7164 8B43.tmp 5492 8BD0.tmp 6344 8C6C.tmp 6036 8CF9.tmp 6296 8DA5.tmp 5380 8E31.tmp 4588 8EAE.tmp 7008 8F5A.tmp 4804 9016.tmp 5048 90A2.tmp 4736 911F.tmp 3792 917D.tmp 4756 91FA.tmp 5764 9277.tmp 4444 92E4.tmp 3308 9352.tmp 2736 93CF.tmp 6448 943C.tmp 1656 94AA.tmp 6712 9527.tmp 4068 9594.tmp 1120 9601.tmp 4708 966F.tmp 1264 96DC.tmp 2484 9749.tmp 6976 97B7.tmp 6560 9824.tmp 3424 9892.tmp 4248 98FF.tmp 6964 996C.tmp 1688 99CA.tmp 3408 9A37.tmp 5168 9A95.tmp 6264 9B03.tmp 3788 9B80.tmp 1528 9BDD.tmp 3960 9C3B.tmp 1708 9C99.tmp 252 9CF7.tmp 1424 9D54.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8275.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C407.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 917D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5820 wrote to memory of 5924 5820 2026-06-26_a76733f3ec86433980aa060867e86d66_elex_mafia_stealc_tofsee.exe 87 PID 5924 wrote to memory of 4300 5924 7D78.tmp 88 PID 4300 wrote to memory of 6096 4300 7E05.tmp 89 PID 6096 wrote to memory of 6984 6096 7EA1.tmp 90 PID 6984 wrote to memory of 7036 6984 7F0E.tmp 91 PID 7036 wrote to memory of 2912 7036 8095.tmp 92 PID 2912 wrote to memory of 5068 2912 8112.tmp 93 PID 5068 wrote to memory of 2692 5068 818F.tmp 94 PID 2692 wrote to memory of 1300 2692 820C.tmp 95 PID 1300 wrote to memory of 3000 1300 82A8.tmp 96 PID 3000 wrote to memory of 5280 3000 8335.tmp 97 PID 5280 wrote to memory of 1696 5280 83B2.tmp 98 PID 1696 wrote to memory of 1384 1696 843E.tmp 99 PID 1384 wrote to memory of 3428 1384 84CB.tmp 100 PID 3428 wrote to memory of 3760 3428 8567.tmp 101 PID 3760 wrote to memory of 6704 3760 8613.tmp 102 PID 6704 wrote to memory of 1972 6704 8681.tmp 103 PID 1972 wrote to memory of 2140 1972 86FE.tmp 104 PID 2140 wrote to memory of 6980 2140 878A.tmp 105 PID 6980 wrote to memory of 7136 6980 8807.tmp 106 PID 7136 wrote to memory of 2896 7136 8865.tmp 107 PID 2896 wrote to memory of 2592 2896 8911.tmp 108 PID 2592 wrote to memory of 1476 2592 89DC.tmp 109 PID 1476 wrote to memory of 5328 1476 8A3A.tmp 110 PID 5328 wrote to memory of 7164 5328 8AC6.tmp 111 PID 7164 wrote to memory of 5492 7164 8B43.tmp 112 PID 5492 wrote to memory of 6344 5492 8BD0.tmp 113 PID 6344 wrote to memory of 6036 6344 8C6C.tmp 114 PID 6036 wrote to memory of 6296 6036 8CF9.tmp 115 PID 6296 wrote to memory of 5380 6296 8DA5.tmp 116 PID 5380 wrote to memory of 4588 5380 8E31.tmp 117 PID 4588 wrote to memory of 7008 4588 8EAE.tmp 118 PID 7008 wrote to memory of 4804 7008 8F5A.tmp 119 PID 4804 wrote to memory of 5048 4804 9016.tmp 120 PID 5048 wrote to memory of 4736 5048 90A2.tmp 121 PID 4736 wrote to memory of 3792 4736 911F.tmp 122 PID 3792 wrote to memory of 4756 3792 917D.tmp 123 PID 4756 wrote to memory of 5764 4756 91FA.tmp 124 PID 5764 wrote to memory of 4444 5764 9277.tmp 125 PID 4444 wrote to memory of 3308 4444 92E4.tmp 126 PID 3308 wrote to memory of 2736 3308 9352.tmp 127 PID 2736 wrote to memory of 6448 2736 93CF.tmp 128 PID 6448 wrote to memory of 1656 6448 943C.tmp 129 PID 1656 wrote to memory of 6712 1656 94AA.tmp 130 PID 6712 wrote to memory of 4068 6712 9527.tmp 131 PID 4068 wrote to memory of 1120 4068 9594.tmp 132 PID 1120 wrote to memory of 4708 1120 9601.tmp 133 PID 4708 wrote to memory of 1264 4708 966F.tmp 134 PID 1264 wrote to memory of 2484 1264 96DC.tmp 135 PID 2484 wrote to memory of 6976 2484 9749.tmp 136 PID 6976 wrote to memory of 6560 6976 97B7.tmp 137 PID 6560 wrote to memory of 3424 6560 9824.tmp 138 PID 3424 wrote to memory of 4248 3424 9892.tmp 139 PID 4248 wrote to memory of 6964 4248 98FF.tmp 140 PID 6964 wrote to memory of 1688 6964 996C.tmp 141 PID 1688 wrote to memory of 3408 1688 99CA.tmp 142 PID 3408 wrote to memory of 5168 3408 9A37.tmp 143 PID 5168 wrote to memory of 6264 5168 9A95.tmp 144 PID 6264 wrote to memory of 3788 6264 9B03.tmp 145 PID 3788 wrote to memory of 1528 3788 9B80.tmp 146 PID 1528 wrote to memory of 3960 1528 9BDD.tmp 147 PID 3960 wrote to memory of 1708 3960 9C3B.tmp 148 PID 1708 wrote to memory of 252 1708 9C99.tmp 149 PID 252 wrote to memory of 1424 252 9CF7.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_a76733f3ec86433980aa060867e86d66_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_a76733f3ec86433980aa060867e86d66_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6984 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7036 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\83B2.tmp"C:\Users\Admin\AppData\Local\Temp\83B2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6704 -
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6980 -
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7136 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\89DC.tmp"C:\Users\Admin\AppData\Local\Temp\89DC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7164 -
C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6344 -
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6296 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7008 -
C:\Users\Admin\AppData\Local\Temp\9016.tmp"C:\Users\Admin\AppData\Local\Temp\9016.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6448 -
C:\Users\Admin\AppData\Local\Temp\94AA.tmp"C:\Users\Admin\AppData\Local\Temp\94AA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6712 -
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\966F.tmp"C:\Users\Admin\AppData\Local\Temp\966F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\96DC.tmp"C:\Users\Admin\AppData\Local\Temp\96DC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6976 -
C:\Users\Admin\AppData\Local\Temp\9824.tmp"C:\Users\Admin\AppData\Local\Temp\9824.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6560 -
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\98FF.tmp"C:\Users\Admin\AppData\Local\Temp\98FF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\996C.tmp"C:\Users\Admin\AppData\Local\Temp\996C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6964 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6264 -
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\9C99.tmp"C:\Users\Admin\AppData\Local\Temp\9C99.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"65⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"66⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"67⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"68⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"69⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\9F58.tmp"C:\Users\Admin\AppData\Local\Temp\9F58.tmp"70⤵PID:6656
-
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"71⤵PID:7068
-
C:\Users\Admin\AppData\Local\Temp\A013.tmp"C:\Users\Admin\AppData\Local\Temp\A013.tmp"72⤵PID:6800
-
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A0DF.tmp"C:\Users\Admin\AppData\Local\Temp\A0DF.tmp"74⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"75⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\A19A.tmp"C:\Users\Admin\AppData\Local\Temp\A19A.tmp"76⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"77⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\A265.tmp"C:\Users\Admin\AppData\Local\Temp\A265.tmp"78⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"79⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\A321.tmp"C:\Users\Admin\AppData\Local\Temp\A321.tmp"80⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"81⤵PID:7108
-
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"82⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\A459.tmp"C:\Users\Admin\AppData\Local\Temp\A459.tmp"83⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"84⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\A524.tmp"C:\Users\Admin\AppData\Local\Temp\A524.tmp"85⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"86⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"87⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"88⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"89⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"90⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\A786.tmp"C:\Users\Admin\AppData\Local\Temp\A786.tmp"91⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"92⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"93⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"94⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"95⤵PID:6160
-
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"96⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"97⤵PID:6348
-
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"98⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"99⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\AB00.tmp"C:\Users\Admin\AppData\Local\Temp\AB00.tmp"100⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"101⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"102⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\AC39.tmp"C:\Users\Admin\AppData\Local\Temp\AC39.tmp"103⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\AC97.tmp"C:\Users\Admin\AppData\Local\Temp\AC97.tmp"104⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"105⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"106⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"107⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"108⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"109⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\AF17.tmp"C:\Users\Admin\AppData\Local\Temp\AF17.tmp"110⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\AF94.tmp"C:\Users\Admin\AppData\Local\Temp\AF94.tmp"111⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"112⤵PID:6224
-
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"113⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"114⤵PID:6484
-
C:\Users\Admin\AppData\Local\Temp\B13A.tmp"C:\Users\Admin\AppData\Local\Temp\B13A.tmp"115⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"116⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"117⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"118⤵PID:6336
-
C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"119⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"121⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-