Analysis
- max time kernel
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_85af5483c085c299ef4d27c7cb06bf81_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_85af5483c085c299ef4d27c7cb06bf81_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-15_85af5483c085c299ef4d27c7cb06bf81_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260715-vd64msg15q
- SHA256 82f59bc65909e2e7b72ad292f409bf173a5db63f9406b1a60af342a012d0819d
- MD5 85af5483c085c299ef4d27c7cb06bf81
- SHA1 c4d35952423096b7753d2117b4b879a9e718fb2d
- SHA512 f2f76f5d16d45e0d09acc336c94b9701d4639f67800d8dfbf09ab0c6540cb0da091a3053acec4ad17eece8d6930703bacf1755751569371ceb927549d897b5e3
- SSDEEP 12288:HU5rCOTeiJ9jjubLyiDowbshDUbP3qANZ:HUQOJJ9eLgGshOCAN
- TLSH T1C8B4E021B546C032E59212314EE6EBB11D3B7D714B26A4C73B80777E6EB52E2E7B4306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3840 17C4.tmp 1588 18BE.tmp 3200 197A.tmp 4312 1A06.tmp 2832 1AA2.tmp 4132 1B6E.tmp 2276 1C0A.tmp 552 1CC5.tmp 1160 1D90.tmp 4176 1E2D.tmp 616 1F84.tmp 4860 2040.tmp 2636 210B.tmp 3860 21C7.tmp 4260 2263.tmp 1776 22EF.tmp 5792 237C.tmp 4248 2438.tmp 4352 2512.tmp 404 25AF.tmp 5104 266A.tmp 5976 2754.tmp 1152 2810.tmp 916 28FA.tmp 3656 2968.tmp 2044 2A52.tmp 2612 2AEE.tmp 1264 2BE8.tmp 4184 2C85.tmp 1808 2D40.tmp 5196 2E0B.tmp 3092 2ED6.tmp 5244 2F73.tmp 2076 2FFF.tmp 1664 307C.tmp 1084 3109.tmp 3664 3186.tmp 6004 3203.tmp 2816 3270.tmp 1744 32ED.tmp 2848 336A.tmp 5044 33E7.tmp 4800 3455.tmp 800 34C2.tmp 3788 353F.tmp 1788 35CC.tmp 1732 3639.tmp 5972 36A6.tmp 2928 3723.tmp 4300 37B0.tmp 4204 383D.tmp 2924 38BA.tmp 4564 3937.tmp 4972 39C3.tmp 4852 3A5F.tmp 3084 3ACD.tmp 5524 3B4A.tmp 4688 3BE6.tmp 4732 3C53.tmp 6008 3CF0.tmp 5532 3D8C.tmp 4784 3E28.tmp 5040 3EA5.tmp 1928 3F13.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F15B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 716D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 793D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2438.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 891C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D45D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1296 wrote to memory of 3840 1296 2026-07-15_85af5483c085c299ef4d27c7cb06bf81_elex_mafia_stealc_tofsee.exe 88 PID 3840 wrote to memory of 1588 3840 17C4.tmp 89 PID 1588 wrote to memory of 3200 1588 18BE.tmp 90 PID 3200 wrote to memory of 4312 3200 197A.tmp 91 PID 4312 wrote to memory of 2832 4312 1A06.tmp 92 PID 2832 wrote to memory of 4132 2832 1AA2.tmp 93 PID 4132 wrote to memory of 2276 4132 1B6E.tmp 94 PID 2276 wrote to memory of 552 2276 1C0A.tmp 95 PID 552 wrote to memory of 1160 552 1CC5.tmp 96 PID 1160 wrote to memory of 4176 1160 1D90.tmp 97 PID 4176 wrote to memory of 616 4176 1E2D.tmp 98 PID 616 wrote to memory of 4860 616 1F84.tmp 99 PID 4860 wrote to memory of 2636 4860 2040.tmp 100 PID 2636 wrote to memory of 3860 2636 210B.tmp 101 PID 3860 wrote to memory of 4260 3860 21C7.tmp 102 PID 4260 wrote to memory of 1776 4260 2263.tmp 103 PID 1776 wrote to memory of 5792 1776 22EF.tmp 104 PID 5792 wrote to memory of 4248 5792 237C.tmp 105 PID 4248 wrote to memory of 4352 4248 2438.tmp 106 PID 4352 wrote to memory of 404 4352 2512.tmp 107 PID 404 wrote to memory of 5104 404 25AF.tmp 108 PID 5104 wrote to memory of 5976 5104 266A.tmp 109 PID 5976 wrote to memory of 1152 5976 2754.tmp 110 PID 1152 wrote to memory of 916 1152 2810.tmp 111 PID 916 wrote to memory of 3656 916 28FA.tmp 112 PID 3656 wrote to memory of 2044 3656 2968.tmp 113 PID 2044 wrote to memory of 2612 2044 2A52.tmp 114 PID 2612 wrote to memory of 1264 2612 2AEE.tmp 115 PID 1264 wrote to memory of 4184 1264 2BE8.tmp 116 PID 4184 wrote to memory of 1808 4184 2C85.tmp 117 PID 1808 wrote to memory of 5196 1808 2D40.tmp 118 PID 5196 wrote to memory of 3092 5196 2E0B.tmp 119 PID 3092 wrote to memory of 5244 3092 2ED6.tmp 120 PID 5244 wrote to memory of 2076 5244 2F73.tmp 121 PID 2076 wrote to memory of 1664 2076 2FFF.tmp 122 PID 1664 wrote to memory of 1084 1664 307C.tmp 123 PID 1084 wrote to memory of 3664 1084 3109.tmp 124 PID 3664 wrote to memory of 6004 3664 3186.tmp 125 PID 6004 wrote to memory of 2816 6004 3203.tmp 126 PID 2816 wrote to memory of 1744 2816 3270.tmp 127 PID 1744 wrote to memory of 2848 1744 32ED.tmp 128 PID 2848 wrote to memory of 5044 2848 336A.tmp 129 PID 5044 wrote to memory of 4800 5044 33E7.tmp 130 PID 4800 wrote to memory of 800 4800 3455.tmp 131 PID 800 wrote to memory of 3788 800 34C2.tmp 132 PID 3788 wrote to memory of 1788 3788 353F.tmp 133 PID 1788 wrote to memory of 1732 1788 35CC.tmp 134 PID 1732 wrote to memory of 5972 1732 3639.tmp 135 PID 5972 wrote to memory of 2928 5972 36A6.tmp 136 PID 2928 wrote to memory of 4300 2928 3723.tmp 137 PID 4300 wrote to memory of 4204 4300 37B0.tmp 138 PID 4204 wrote to memory of 2924 4204 383D.tmp 139 PID 2924 wrote to memory of 4564 2924 38BA.tmp 140 PID 4564 wrote to memory of 4972 4564 3937.tmp 141 PID 4972 wrote to memory of 4852 4972 39C3.tmp 142 PID 4852 wrote to memory of 3084 4852 3A5F.tmp 143 PID 3084 wrote to memory of 5524 3084 3ACD.tmp 144 PID 5524 wrote to memory of 4688 5524 3B4A.tmp 145 PID 4688 wrote to memory of 4732 4688 3BE6.tmp 146 PID 4732 wrote to memory of 6008 4732 3C53.tmp 147 PID 6008 wrote to memory of 5532 6008 3CF0.tmp 148 PID 5532 wrote to memory of 4784 5532 3D8C.tmp 149 PID 4784 wrote to memory of 5040 4784 3E28.tmp 150 PID 5040 wrote to memory of 1928 5040 3EA5.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_85af5483c085c299ef4d27c7cb06bf81_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_85af5483c085c299ef4d27c7cb06bf81_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\1E2D.tmp"C:\Users\Admin\AppData\Local\Temp\1E2D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\2040.tmp"C:\Users\Admin\AppData\Local\Temp\2040.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\2263.tmp"C:\Users\Admin\AppData\Local\Temp\2263.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\2438.tmp"C:\Users\Admin\AppData\Local\Temp\2438.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\25AF.tmp"C:\Users\Admin\AppData\Local\Temp\25AF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\307C.tmp"C:\Users\Admin\AppData\Local\Temp\307C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3109.tmp"C:\Users\Admin\AppData\Local\Temp\3109.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\3203.tmp"C:\Users\Admin\AppData\Local\Temp\3203.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3455.tmp"C:\Users\Admin\AppData\Local\Temp\3455.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\34C2.tmp"C:\Users\Admin\AppData\Local\Temp\34C2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\36A6.tmp"C:\Users\Admin\AppData\Local\Temp\36A6.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\3723.tmp"C:\Users\Admin\AppData\Local\Temp\3723.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\37B0.tmp"C:\Users\Admin\AppData\Local\Temp\37B0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\3B4A.tmp"C:\Users\Admin\AppData\Local\Temp\3B4A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\3E28.tmp"C:\Users\Admin\AppData\Local\Temp\3E28.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"65⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"66⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"67⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"69⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"70⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\41D2.tmp"C:\Users\Admin\AppData\Local\Temp\41D2.tmp"71⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"72⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"73⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"74⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"75⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"76⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"77⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"78⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"80⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\4685.tmp"C:\Users\Admin\AppData\Local\Temp\4685.tmp"81⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\46E3.tmp"C:\Users\Admin\AppData\Local\Temp\46E3.tmp"82⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"84⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"85⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"86⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"87⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"88⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"90⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"91⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"92⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"93⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"94⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"95⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\4E36.tmp"C:\Users\Admin\AppData\Local\Temp\4E36.tmp"96⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"97⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"99⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"100⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\50E5.tmp"C:\Users\Admin\AppData\Local\Temp\50E5.tmp"101⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\5143.tmp"C:\Users\Admin\AppData\Local\Temp\5143.tmp"102⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\51B0.tmp"C:\Users\Admin\AppData\Local\Temp\51B0.tmp"103⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"104⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"105⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"106⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"107⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"108⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"109⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\54EC.tmp"C:\Users\Admin\AppData\Local\Temp\54EC.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\555A.tmp"C:\Users\Admin\AppData\Local\Temp\555A.tmp"111⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\55B7.tmp"C:\Users\Admin\AppData\Local\Temp\55B7.tmp"112⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\5644.tmp"C:\Users\Admin\AppData\Local\Temp\5644.tmp"113⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\56D1.tmp"C:\Users\Admin\AppData\Local\Temp\56D1.tmp"114⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\574E.tmp"C:\Users\Admin\AppData\Local\Temp\574E.tmp"115⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"116⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5819.tmp"C:\Users\Admin\AppData\Local\Temp\5819.tmp"117⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"118⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"119⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"120⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"121⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"122⤵PID:4604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-