Analysis
- max time kernel
121s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 14:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_e82de7bf1a295d100d471fe30d1139e6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_e82de7bf1a295d100d471fe30d1139e6_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-11_e82de7bf1a295d100d471fe30d1139e6_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260711-sa2cwaey21
- SHA256 2891d19683bcbe9fdff4c6367436d6d0cf7e77d8fda5e7a5e42195d3597b418a
- MD5 e82de7bf1a295d100d471fe30d1139e6
- SHA1 9c7a6a2edb6da4725a5a948ecef5ba4649fd35b4
- SHA512 326a95605cb0ec8d7321b82f58fec2affe0d0c0b765b4e749e1a22f12f05339e1d3d61e05bac05958b0309c59592fa44b6d64b80b764123415033b51080c4f18
- SSDEEP 12288:9U5rCOTei6ww7Nx5R0ssLISrsxFduSvf1qZoXWjdqpby1grA70G+o:9UQOJ6wwv56Rsj9qqGh4yATXo
- TLSH T1CCE402257981C032EAD212304EE5EBB1196A7D355722A4CB3BC4776E6FB42E1E339317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4884 5C10.tmp 4248 5D0A.tmp 5720 5E04.tmp 4620 5EDF.tmp 2792 5F8B.tmp 3744 6066.tmp 2256 6112.tmp 4388 61EC.tmp 4840 62E6.tmp 5124 640F.tmp 3908 64BB.tmp 4648 6577.tmp 1244 6642.tmp 4684 670D.tmp 4512 67F7.tmp 4836 68D2.tmp 2052 69BC.tmp 4952 6A88.tmp 6004 6B43.tmp 3360 6C0E.tmp 5248 6CF9.tmp 2372 6DE3.tmp 5876 6E9E.tmp 416 6F5A.tmp 4928 7025.tmp 5760 70F0.tmp 3692 71FA.tmp 6032 72C5.tmp 6092 73AF.tmp 3036 746B.tmp 1804 7555.tmp 6072 75F1.tmp 4376 76AD.tmp 852 772A.tmp 3064 77A7.tmp 940 7853.tmp 5644 78EF.tmp 5096 799B.tmp 1376 7A08.tmp 4192 7A95.tmp 1552 7B12.tmp 3464 7BAE.tmp 4540 7C2B.tmp 3520 7CC7.tmp 4160 7D54.tmp 4212 7DE1.tmp 1164 7E5E.tmp 2012 7EFA.tmp 3384 7F96.tmp 4176 8023.tmp 1824 80A0.tmp 4592 813C.tmp 3532 81A9.tmp 4704 8236.tmp 4120 82B3.tmp 1796 8330.tmp 2140 83AD.tmp 1248 842A.tmp 5784 84B7.tmp 4256 8534.tmp 5316 85C0.tmp 1556 863D.tmp 4708 86CA.tmp 5996 8737.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B44D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 345F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4884 4956 2026-07-11_e82de7bf1a295d100d471fe30d1139e6_elex_mafia_stealc_tofsee.exe 87 PID 4884 wrote to memory of 4248 4884 5C10.tmp 88 PID 4248 wrote to memory of 5720 4248 5D0A.tmp 89 PID 5720 wrote to memory of 4620 5720 5E04.tmp 90 PID 4620 wrote to memory of 2792 4620 5EDF.tmp 91 PID 2792 wrote to memory of 3744 2792 5F8B.tmp 92 PID 3744 wrote to memory of 2256 3744 6066.tmp 93 PID 2256 wrote to memory of 4388 2256 6112.tmp 94 PID 4388 wrote to memory of 4840 4388 61EC.tmp 95 PID 4840 wrote to memory of 5124 4840 62E6.tmp 96 PID 5124 wrote to memory of 3908 5124 640F.tmp 97 PID 3908 wrote to memory of 4648 3908 64BB.tmp 98 PID 4648 wrote to memory of 1244 4648 6577.tmp 99 PID 1244 wrote to memory of 4684 1244 6642.tmp 100 PID 4684 wrote to memory of 4512 4684 670D.tmp 101 PID 4512 wrote to memory of 4836 4512 67F7.tmp 102 PID 4836 wrote to memory of 2052 4836 68D2.tmp 103 PID 2052 wrote to memory of 4952 2052 69BC.tmp 104 PID 4952 wrote to memory of 6004 4952 6A88.tmp 105 PID 6004 wrote to memory of 3360 6004 6B43.tmp 106 PID 3360 wrote to memory of 5248 3360 6C0E.tmp 107 PID 5248 wrote to memory of 2372 5248 6CF9.tmp 108 PID 2372 wrote to memory of 5876 2372 6DE3.tmp 109 PID 5876 wrote to memory of 416 5876 6E9E.tmp 110 PID 416 wrote to memory of 4928 416 6F5A.tmp 111 PID 4928 wrote to memory of 5760 4928 7025.tmp 112 PID 5760 wrote to memory of 3692 5760 70F0.tmp 113 PID 3692 wrote to memory of 6032 3692 71FA.tmp 114 PID 6032 wrote to memory of 6092 6032 72C5.tmp 115 PID 6092 wrote to memory of 3036 6092 73AF.tmp 116 PID 3036 wrote to memory of 1804 3036 746B.tmp 117 PID 1804 wrote to memory of 6072 1804 7555.tmp 118 PID 6072 wrote to memory of 4376 6072 75F1.tmp 119 PID 4376 wrote to memory of 852 4376 76AD.tmp 120 PID 852 wrote to memory of 3064 852 772A.tmp 121 PID 3064 wrote to memory of 940 3064 77A7.tmp 122 PID 940 wrote to memory of 5644 940 7853.tmp 123 PID 5644 wrote to memory of 5096 5644 78EF.tmp 124 PID 5096 wrote to memory of 1376 5096 799B.tmp 125 PID 1376 wrote to memory of 4192 1376 7A08.tmp 126 PID 4192 wrote to memory of 1552 4192 7A95.tmp 127 PID 1552 wrote to memory of 3464 1552 7B12.tmp 128 PID 3464 wrote to memory of 4540 3464 7BAE.tmp 129 PID 4540 wrote to memory of 3520 4540 7C2B.tmp 130 PID 3520 wrote to memory of 4160 3520 7CC7.tmp 131 PID 4160 wrote to memory of 4212 4160 7D54.tmp 132 PID 4212 wrote to memory of 1164 4212 7DE1.tmp 133 PID 1164 wrote to memory of 2012 1164 7E5E.tmp 134 PID 2012 wrote to memory of 3384 2012 7EFA.tmp 135 PID 3384 wrote to memory of 4176 3384 7F96.tmp 136 PID 4176 wrote to memory of 1824 4176 8023.tmp 137 PID 1824 wrote to memory of 4592 1824 80A0.tmp 138 PID 4592 wrote to memory of 3532 4592 813C.tmp 139 PID 3532 wrote to memory of 4704 3532 81A9.tmp 140 PID 4704 wrote to memory of 4120 4704 8236.tmp 141 PID 4120 wrote to memory of 1796 4120 82B3.tmp 142 PID 1796 wrote to memory of 2140 1796 8330.tmp 143 PID 2140 wrote to memory of 1248 2140 83AD.tmp 144 PID 1248 wrote to memory of 5784 1248 842A.tmp 145 PID 5784 wrote to memory of 4256 5784 84B7.tmp 146 PID 4256 wrote to memory of 5316 4256 8534.tmp 147 PID 5316 wrote to memory of 1556 5316 85C0.tmp 148 PID 1556 wrote to memory of 4708 1556 863D.tmp 149 PID 4708 wrote to memory of 5996 4708 86CA.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_e82de7bf1a295d100d471fe30d1139e6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_e82de7bf1a295d100d471fe30d1139e6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\5C10.tmp"C:\Users\Admin\AppData\Local\Temp\5C10.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\6066.tmp"C:\Users\Admin\AppData\Local\Temp\6066.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\6112.tmp"C:\Users\Admin\AppData\Local\Temp\6112.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\61EC.tmp"C:\Users\Admin\AppData\Local\Temp\61EC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\62E6.tmp"C:\Users\Admin\AppData\Local\Temp\62E6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\64BB.tmp"C:\Users\Admin\AppData\Local\Temp\64BB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\68D2.tmp"C:\Users\Admin\AppData\Local\Temp\68D2.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\69BC.tmp"C:\Users\Admin\AppData\Local\Temp\69BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6B43.tmp"C:\Users\Admin\AppData\Local\Temp\6B43.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\71FA.tmp"C:\Users\Admin\AppData\Local\Temp\71FA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\72C5.tmp"C:\Users\Admin\AppData\Local\Temp\72C5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\73AF.tmp"C:\Users\Admin\AppData\Local\Temp\73AF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\772A.tmp"C:\Users\Admin\AppData\Local\Temp\772A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\799B.tmp"C:\Users\Admin\AppData\Local\Temp\799B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7A08.tmp"C:\Users\Admin\AppData\Local\Temp\7A08.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7A95.tmp"C:\Users\Admin\AppData\Local\Temp\7A95.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\7F96.tmp"C:\Users\Admin\AppData\Local\Temp\7F96.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\80A0.tmp"C:\Users\Admin\AppData\Local\Temp\80A0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\82B3.tmp"C:\Users\Admin\AppData\Local\Temp\82B3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\8330.tmp"C:\Users\Admin\AppData\Local\Temp\8330.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\842A.tmp"C:\Users\Admin\AppData\Local\Temp\842A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8737.tmp"C:\Users\Admin\AppData\Local\Temp\8737.tmp"65⤵
- Executes dropped EXE
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\890C.tmp"C:\Users\Admin\AppData\Local\Temp\890C.tmp"68⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\89A8.tmp"C:\Users\Admin\AppData\Local\Temp\89A8.tmp"69⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"70⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"71⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"72⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"73⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"74⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"75⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"76⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"77⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"78⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"79⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\8F75.tmp"C:\Users\Admin\AppData\Local\Temp\8F75.tmp"80⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\907E.tmp"C:\Users\Admin\AppData\Local\Temp\907E.tmp"82⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"83⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\91C6.tmp"C:\Users\Admin\AppData\Local\Temp\91C6.tmp"84⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"85⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"86⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"87⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\9428.tmp"C:\Users\Admin\AppData\Local\Temp\9428.tmp"88⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\94B4.tmp"C:\Users\Admin\AppData\Local\Temp\94B4.tmp"89⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"90⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"91⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"92⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"93⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"94⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\97D1.tmp"C:\Users\Admin\AppData\Local\Temp\97D1.tmp"95⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\985E.tmp"C:\Users\Admin\AppData\Local\Temp\985E.tmp"96⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"97⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"98⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"99⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\9ABF.tmp"C:\Users\Admin\AppData\Local\Temp\9ABF.tmp"100⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"101⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"102⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"103⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"104⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"105⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"107⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\9F34.tmp"C:\Users\Admin\AppData\Local\Temp\9F34.tmp"108⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"109⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\A05D.tmp"C:\Users\Admin\AppData\Local\Temp\A05D.tmp"110⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"111⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"112⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"113⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"114⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"115⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"116⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"117⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"118⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"119⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\A648.tmp"C:\Users\Admin\AppData\Local\Temp\A648.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"122⤵PID:3432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-