Analysis
- max time kernel
115s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_94eb641c98d4c5b6f0f1663c5cb0b0a8_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_94eb641c98d4c5b6f0f1663c5cb0b0a8_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-20_94eb641c98d4c5b6f0f1663c5cb0b0a8_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260720-vvarrsht3m
- SHA256 53e75fb808bd0a2b669d048a63b98d62991e21c46fba2b86b61097c84119e47b
- MD5 94eb641c98d4c5b6f0f1663c5cb0b0a8
- SHA1 b2e3614bf6d4650b4555d343f25e7a036b7dd67f
- SHA512 ed3f3bdfcf27baf0a85ba3b24f9bda8182438dcd6df66d30562ec04ee37a2bec9de1df19301b1b06eaa55225da8ed6d3253d26818562b3347fb9cd46348c1068
- SSDEEP 12288:wU5rCOTeiD+4IH9RJKNb/y2DPdbCK2ZltKWiNZ+3/v+I9hUG2VA:wUQOJD+4YfKNm2DPdYDRiNGEA
- TLSH T13BE4D02173D88532E5FB037859B9E6614E7EBD326722D6DF2F80126E09B1BC09631763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6044 90FB.tmp 5136 9215.tmp 1200 93BA.tmp 4264 9522.tmp 2892 965A.tmp 5716 96F7.tmp 5108 9810.tmp 5700 990A.tmp 1708 9A33.tmp 4140 9B6B.tmp 5740 9C94.tmp 776 9D9E.tmp 5932 9EE6.tmp 5172 9FEF.tmp 2684 A0DA.tmp 2824 A1E3.tmp 2616 A30C.tmp 576 A3E7.tmp 1132 A4D1.tmp 1472 A61A.tmp 4972 A762.tmp 2564 A82D.tmp 5836 A908.tmp 5268 AA30.tmp 5872 AB3A.tmp 1956 AC73.tmp 4276 AD6D.tmp 3684 AEC4.tmp 4520 B00C.tmp 2560 B0F7.tmp 5904 B220.tmp 5696 B377.tmp 1680 B443.tmp 5504 B50E.tmp 4780 B5E8.tmp 2908 B685.tmp 1276 B731.tmp 5808 B7FC.tmp 1388 B8C7.tmp 3372 B953.tmp 1512 BA2E.tmp 5336 BAEA.tmp 3676 BBD4.tmp 4580 BC80.tmp 5704 BD0D.tmp 924 BD99.tmp 3248 BE84.tmp 2924 BF4F.tmp 4576 BFEB.tmp 4552 C087.tmp 5912 C114.tmp 3868 C1A0.tmp 2036 C21D.tmp 4128 C2AA.tmp 2472 C337.tmp 2464 C3D3.tmp 240 C460.tmp 1092 C4DD.tmp 2828 C569.tmp 3696 C5E6.tmp 1936 C654.tmp 4896 C6D1.tmp 4660 C74E.tmp 4300 C7CB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 494A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 853F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3171.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 710B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3559.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E33D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B96E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F33B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 6044 4316 2026-07-20_94eb641c98d4c5b6f0f1663c5cb0b0a8_elex_mafia_stealc_tofsee.exe 88 PID 6044 wrote to memory of 5136 6044 90FB.tmp 89 PID 5136 wrote to memory of 1200 5136 9215.tmp 90 PID 1200 wrote to memory of 4264 1200 93BA.tmp 91 PID 4264 wrote to memory of 2892 4264 9522.tmp 92 PID 2892 wrote to memory of 5716 2892 965A.tmp 93 PID 5716 wrote to memory of 5108 5716 96F7.tmp 94 PID 5108 wrote to memory of 5700 5108 9810.tmp 95 PID 5700 wrote to memory of 1708 5700 990A.tmp 96 PID 1708 wrote to memory of 4140 1708 9A33.tmp 97 PID 4140 wrote to memory of 5740 4140 9B6B.tmp 98 PID 5740 wrote to memory of 776 5740 9C94.tmp 99 PID 776 wrote to memory of 5932 776 9D9E.tmp 100 PID 5932 wrote to memory of 5172 5932 9EE6.tmp 101 PID 5172 wrote to memory of 2684 5172 9FEF.tmp 102 PID 2684 wrote to memory of 2824 2684 A0DA.tmp 103 PID 2824 wrote to memory of 2616 2824 A1E3.tmp 104 PID 2616 wrote to memory of 576 2616 A30C.tmp 105 PID 576 wrote to memory of 1132 576 A3E7.tmp 106 PID 1132 wrote to memory of 1472 1132 A4D1.tmp 107 PID 1472 wrote to memory of 4972 1472 A61A.tmp 108 PID 4972 wrote to memory of 2564 4972 A762.tmp 109 PID 2564 wrote to memory of 5836 2564 A82D.tmp 110 PID 5836 wrote to memory of 5268 5836 A908.tmp 111 PID 5268 wrote to memory of 5872 5268 AA30.tmp 112 PID 5872 wrote to memory of 1956 5872 AB3A.tmp 113 PID 1956 wrote to memory of 4276 1956 AC73.tmp 114 PID 4276 wrote to memory of 3684 4276 AD6D.tmp 115 PID 3684 wrote to memory of 4520 3684 AEC4.tmp 116 PID 4520 wrote to memory of 2560 4520 B00C.tmp 117 PID 2560 wrote to memory of 5904 2560 B0F7.tmp 118 PID 5904 wrote to memory of 5696 5904 B220.tmp 119 PID 5696 wrote to memory of 1680 5696 B377.tmp 120 PID 1680 wrote to memory of 5504 1680 B443.tmp 121 PID 5504 wrote to memory of 4780 5504 B50E.tmp 122 PID 4780 wrote to memory of 2908 4780 B5E8.tmp 123 PID 2908 wrote to memory of 1276 2908 B685.tmp 124 PID 1276 wrote to memory of 5808 1276 B731.tmp 125 PID 5808 wrote to memory of 1388 5808 B7FC.tmp 126 PID 1388 wrote to memory of 3372 1388 B8C7.tmp 127 PID 3372 wrote to memory of 1512 3372 B953.tmp 128 PID 1512 wrote to memory of 5336 1512 BA2E.tmp 129 PID 5336 wrote to memory of 3676 5336 BAEA.tmp 130 PID 3676 wrote to memory of 4580 3676 BBD4.tmp 131 PID 4580 wrote to memory of 5704 4580 BC80.tmp 132 PID 5704 wrote to memory of 924 5704 BD0D.tmp 133 PID 924 wrote to memory of 3248 924 BD99.tmp 134 PID 3248 wrote to memory of 2924 3248 BE84.tmp 135 PID 2924 wrote to memory of 4576 2924 BF4F.tmp 136 PID 4576 wrote to memory of 4552 4576 BFEB.tmp 137 PID 4552 wrote to memory of 5912 4552 C087.tmp 138 PID 5912 wrote to memory of 3868 5912 C114.tmp 139 PID 3868 wrote to memory of 2036 3868 C1A0.tmp 140 PID 2036 wrote to memory of 4128 2036 C21D.tmp 141 PID 4128 wrote to memory of 2472 4128 C2AA.tmp 142 PID 2472 wrote to memory of 2464 2472 C337.tmp 143 PID 2464 wrote to memory of 240 2464 C3D3.tmp 144 PID 240 wrote to memory of 1092 240 C460.tmp 145 PID 1092 wrote to memory of 2828 1092 C4DD.tmp 146 PID 2828 wrote to memory of 3696 2828 C569.tmp 147 PID 3696 wrote to memory of 1936 3696 C5E6.tmp 148 PID 1936 wrote to memory of 4896 1936 C654.tmp 149 PID 4896 wrote to memory of 4660 4896 C6D1.tmp 150 PID 4660 wrote to memory of 4300 4660 C74E.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_94eb641c98d4c5b6f0f1663c5cb0b0a8_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_94eb641c98d4c5b6f0f1663c5cb0b0a8_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\965A.tmp"C:\Users\Admin\AppData\Local\Temp\965A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\96F7.tmp"C:\Users\Admin\AppData\Local\Temp\96F7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\990A.tmp"C:\Users\Admin\AppData\Local\Temp\990A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\9C94.tmp"C:\Users\Admin\AppData\Local\Temp\9C94.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A1E3.tmp"C:\Users\Admin\AppData\Local\Temp\A1E3.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\A30C.tmp"C:\Users\Admin\AppData\Local\Temp\A30C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\A61A.tmp"C:\Users\Admin\AppData\Local\Temp\A61A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\A908.tmp"C:\Users\Admin\AppData\Local\Temp\A908.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\B443.tmp"C:\Users\Admin\AppData\Local\Temp\B443.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\B731.tmp"C:\Users\Admin\AppData\Local\Temp\B731.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\BC80.tmp"C:\Users\Admin\AppData\Local\Temp\BC80.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\C114.tmp"C:\Users\Admin\AppData\Local\Temp\C114.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\C21D.tmp"C:\Users\Admin\AppData\Local\Temp\C21D.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\C337.tmp"C:\Users\Admin\AppData\Local\Temp\C337.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"C:\Users\Admin\AppData\Local\Temp\C5E6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\C654.tmp"C:\Users\Admin\AppData\Local\Temp\C654.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\C74E.tmp"C:\Users\Admin\AppData\Local\Temp\C74E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"65⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\C838.tmp"C:\Users\Admin\AppData\Local\Temp\C838.tmp"66⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"67⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\C922.tmp"C:\Users\Admin\AppData\Local\Temp\C922.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"69⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"70⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"71⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"72⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"73⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"74⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"75⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"76⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"77⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\CE52.tmp"C:\Users\Admin\AppData\Local\Temp\CE52.tmp"78⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"79⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"80⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\D018.tmp"C:\Users\Admin\AppData\Local\Temp\D018.tmp"81⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"82⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"83⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\D19E.tmp"C:\Users\Admin\AppData\Local\Temp\D19E.tmp"84⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"85⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"86⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"87⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"89⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\D509.tmp"C:\Users\Admin\AppData\Local\Temp\D509.tmp"90⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"91⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D632.tmp"C:\Users\Admin\AppData\Local\Temp\D632.tmp"92⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"93⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\D74B.tmp"C:\Users\Admin\AppData\Local\Temp\D74B.tmp"94⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"96⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"97⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"98⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"99⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"100⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"101⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"102⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"103⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"104⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"105⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"106⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"107⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"108⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"109⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"110⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\E063.tmp"C:\Users\Admin\AppData\Local\Temp\E063.tmp"111⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"112⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\E17D.tmp"C:\Users\Admin\AppData\Local\Temp\E17D.tmp"113⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"115⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\E351.tmp"C:\Users\Admin\AppData\Local\Temp\E351.tmp"116⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"117⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"118⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"119⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"120⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"121⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"122⤵PID:5560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-