Analysis
- max time kernel
128s - max time network
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 05:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_d738642e9e8e2273418c2d3bd8fc2085_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_d738642e9e8e2273418c2d3bd8fc2085_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-14_d738642e9e8e2273418c2d3bd8fc2085_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260714-gpv9mae16j
- SHA256 076b03c8056bf77a2bb8baf85e99b5645c009ed14f72f5316e8e019985bad763
- MD5 d738642e9e8e2273418c2d3bd8fc2085
- SHA1 d3ac5a7ff9c37d45c839d6beb70768b52c9b6d6d
- SHA512 54a49b467c0195639370e2791b1b12ff02e7b8079269410bca9dd564230ef6321fd1e850da8ba6e58f04c85aa689ad295575362a54b0afc4a0d401f46295f369
- SSDEEP 12288:NU5rCOTeijXkBYE0nlYoNS5whZYkxeE2K4o2TZwlH:NUQOJjXk9kpKqR2KSTSlH
- TLSH T183B4E026B185C133E69202310EE6DBA2697FBD76572694C33B84666E2FB13E1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 464 D18F.tmp 2784 D23A.tmp 3444 D2F6.tmp 4152 D538.tmp 1896 D5C5.tmp 5264 D651.tmp 5492 D70D.tmp 2340 D7C8.tmp 2696 D874.tmp 4244 D98D.tmp 4224 DA1A.tmp 628 DAF5.tmp 2896 DBFE.tmp 1104 DC9B.tmp 5164 DD95.tmp 3028 DE6F.tmp 4536 DF69.tmp 5528 E025.tmp 5420 E11F.tmp 4984 E1BB.tmp 5392 E257.tmp 1736 E342.tmp 4764 E3CE.tmp 2816 E46B.tmp 4756 E517.tmp 1964 E5D2.tmp 2756 E67E.tmp 2928 E72A.tmp 2580 E7F5.tmp 2860 E891.tmp 3284 E95C.tmp 4848 EA27.tmp 1980 EAD3.tmp 2568 EB50.tmp 2648 EBBE.tmp 5396 EC3B.tmp 6088 ECD7.tmp 3092 ED54.tmp 6068 EDD1.tmp 2100 EE4E.tmp 3668 EECB.tmp 6096 EF67.tmp 3112 EFE4.tmp 2908 F061.tmp 2992 F0CF.tmp 3244 F14C.tmp 2356 F1E8.tmp 1280 F265.tmp 4776 F2E2.tmp 3032 F35F.tmp 5108 F3DC.tmp 1704 F459.tmp 1544 F4F5.tmp 1112 F562.tmp 2732 F5DF.tmp 2204 F66C.tmp 2200 F708.tmp 3424 F795.tmp 3372 F822.tmp 5412 F89F.tmp 5096 F92B.tmp 5956 F9C7.tmp 3968 FA73.tmp 3064 FAF0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D63D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 615B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B21B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C71A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 732E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4AB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 464 4960 2026-07-14_d738642e9e8e2273418c2d3bd8fc2085_elex_mafia_stealc_tofsee.exe 86 PID 464 wrote to memory of 2784 464 D18F.tmp 87 PID 2784 wrote to memory of 3444 2784 D23A.tmp 88 PID 3444 wrote to memory of 4152 3444 D2F6.tmp 89 PID 4152 wrote to memory of 1896 4152 D538.tmp 90 PID 1896 wrote to memory of 5264 1896 D5C5.tmp 91 PID 5264 wrote to memory of 5492 5264 D651.tmp 92 PID 5492 wrote to memory of 2340 5492 D70D.tmp 93 PID 2340 wrote to memory of 2696 2340 D7C8.tmp 94 PID 2696 wrote to memory of 4244 2696 D874.tmp 95 PID 4244 wrote to memory of 4224 4244 D98D.tmp 96 PID 4224 wrote to memory of 628 4224 DA1A.tmp 97 PID 628 wrote to memory of 2896 628 DAF5.tmp 98 PID 2896 wrote to memory of 1104 2896 DBFE.tmp 99 PID 1104 wrote to memory of 5164 1104 DC9B.tmp 100 PID 5164 wrote to memory of 3028 5164 DD95.tmp 101 PID 3028 wrote to memory of 4536 3028 DE6F.tmp 102 PID 4536 wrote to memory of 5528 4536 DF69.tmp 103 PID 5528 wrote to memory of 5420 5528 E025.tmp 104 PID 5420 wrote to memory of 4984 5420 E11F.tmp 105 PID 4984 wrote to memory of 5392 4984 E1BB.tmp 106 PID 5392 wrote to memory of 1736 5392 E257.tmp 107 PID 1736 wrote to memory of 4764 1736 E342.tmp 108 PID 4764 wrote to memory of 2816 4764 E3CE.tmp 109 PID 2816 wrote to memory of 4756 2816 E46B.tmp 110 PID 4756 wrote to memory of 1964 4756 E517.tmp 111 PID 1964 wrote to memory of 2756 1964 E5D2.tmp 112 PID 2756 wrote to memory of 2928 2756 E67E.tmp 113 PID 2928 wrote to memory of 2580 2928 E72A.tmp 114 PID 2580 wrote to memory of 2860 2580 E7F5.tmp 115 PID 2860 wrote to memory of 3284 2860 E891.tmp 116 PID 3284 wrote to memory of 4848 3284 E95C.tmp 117 PID 4848 wrote to memory of 1980 4848 EA27.tmp 118 PID 1980 wrote to memory of 2568 1980 EAD3.tmp 119 PID 2568 wrote to memory of 2648 2568 EB50.tmp 120 PID 2648 wrote to memory of 5396 2648 EBBE.tmp 121 PID 5396 wrote to memory of 6088 5396 EC3B.tmp 122 PID 6088 wrote to memory of 3092 6088 ECD7.tmp 123 PID 3092 wrote to memory of 6068 3092 ED54.tmp 124 PID 6068 wrote to memory of 2100 6068 EDD1.tmp 125 PID 2100 wrote to memory of 3668 2100 EE4E.tmp 126 PID 3668 wrote to memory of 6096 3668 EECB.tmp 127 PID 6096 wrote to memory of 3112 6096 EF67.tmp 128 PID 3112 wrote to memory of 2908 3112 EFE4.tmp 129 PID 2908 wrote to memory of 2992 2908 F061.tmp 130 PID 2992 wrote to memory of 3244 2992 F0CF.tmp 131 PID 3244 wrote to memory of 2356 3244 F14C.tmp 132 PID 2356 wrote to memory of 1280 2356 F1E8.tmp 133 PID 1280 wrote to memory of 4776 1280 F265.tmp 134 PID 4776 wrote to memory of 3032 4776 F2E2.tmp 135 PID 3032 wrote to memory of 5108 3032 F35F.tmp 136 PID 5108 wrote to memory of 1704 5108 F3DC.tmp 137 PID 1704 wrote to memory of 1544 1704 F459.tmp 138 PID 1544 wrote to memory of 1112 1544 F4F5.tmp 139 PID 1112 wrote to memory of 2732 1112 F562.tmp 140 PID 2732 wrote to memory of 2204 2732 F5DF.tmp 141 PID 2204 wrote to memory of 2200 2204 F66C.tmp 142 PID 2200 wrote to memory of 3424 2200 F708.tmp 143 PID 3424 wrote to memory of 3372 3424 F795.tmp 144 PID 3372 wrote to memory of 5412 3372 F822.tmp 145 PID 5412 wrote to memory of 5096 5412 F89F.tmp 146 PID 5096 wrote to memory of 5956 5096 F92B.tmp 147 PID 5956 wrote to memory of 3968 5956 F9C7.tmp 148 PID 3968 wrote to memory of 3064 3968 FA73.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_d738642e9e8e2273418c2d3bd8fc2085_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_d738642e9e8e2273418c2d3bd8fc2085_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\D23A.tmp"C:\Users\Admin\AppData\Local\Temp\D23A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\D651.tmp"C:\Users\Admin\AppData\Local\Temp\D651.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\DD95.tmp"C:\Users\Admin\AppData\Local\Temp\DD95.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E517.tmp"C:\Users\Admin\AppData\Local\Temp\E517.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\E95C.tmp"C:\Users\Admin\AppData\Local\Temp\E95C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\EECB.tmp"C:\Users\Admin\AppData\Local\Temp\EECB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\EF67.tmp"C:\Users\Admin\AppData\Local\Temp\EF67.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\F061.tmp"C:\Users\Admin\AppData\Local\Temp\F061.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\F562.tmp"C:\Users\Admin\AppData\Local\Temp\F562.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\F822.tmp"C:\Users\Admin\AppData\Local\Temp\F822.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\F89F.tmp"C:\Users\Admin\AppData\Local\Temp\F89F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\FA73.tmp"C:\Users\Admin\AppData\Local\Temp\FA73.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"65⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"66⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"67⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"68⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"69⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"70⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"71⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"72⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"73⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"74⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"75⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\6F.tmp"C:\Users\Admin\AppData\Local\Temp\6F.tmp"76⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"77⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"78⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"79⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"80⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"81⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\39B.tmp"C:\Users\Admin\AppData\Local\Temp\39B.tmp"82⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\428.tmp"C:\Users\Admin\AppData\Local\Temp\428.tmp"83⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"84⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"85⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"86⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\6E7.tmp"C:\Users\Admin\AppData\Local\Temp\6E7.tmp"88⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"89⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"90⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\8CB.tmp"C:\Users\Admin\AppData\Local\Temp\8CB.tmp"91⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"92⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\A04.tmp"C:\Users\Admin\AppData\Local\Temp\A04.tmp"93⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\A81.tmp"C:\Users\Admin\AppData\Local\Temp\A81.tmp"94⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"95⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\BC9.tmp"C:\Users\Admin\AppData\Local\Temp\BC9.tmp"96⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\C36.tmp"C:\Users\Admin\AppData\Local\Temp\C36.tmp"97⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"98⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\D4F.tmp"C:\Users\Admin\AppData\Local\Temp\D4F.tmp"99⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\DCC.tmp"C:\Users\Admin\AppData\Local\Temp\DCC.tmp"100⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\E69.tmp"C:\Users\Admin\AppData\Local\Temp\E69.tmp"101⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"102⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"103⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\103D.tmp"C:\Users\Admin\AppData\Local\Temp\103D.tmp"104⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"105⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"106⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\1195.tmp"C:\Users\Admin\AppData\Local\Temp\1195.tmp"107⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\12BE.tmp"C:\Users\Admin\AppData\Local\Temp\12BE.tmp"109⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\133B.tmp"C:\Users\Admin\AppData\Local\Temp\133B.tmp"110⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\13D7.tmp"C:\Users\Admin\AppData\Local\Temp\13D7.tmp"111⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"112⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"113⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"114⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"115⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"116⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"117⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"118⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\17CF.tmp"C:\Users\Admin\AppData\Local\Temp\17CF.tmp"119⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"120⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"121⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\1975.tmp"C:\Users\Admin\AppData\Local\Temp\1975.tmp"122⤵PID:5968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-