Analysis
- max time kernel
121s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 01:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260723-bn1vtstyex
- SHA256 cc6c88b3a301f79821da47ba2fa89bbd3a705671d7ae1c7d9d383d39d94de4d0
- MD5 603ed39f49555476822481d989d07c56
- SHA1 64720148ddfd5d13f85ea2632a127650388a304a
- SHA512 bef8b88ee71df6d0b09b6d5cd1f0f97f6d90ff5eac5d728daec2dd1e5434ef7c03d1c3d91dbcb4ce8ff59de9d3fd4c0b6a256481f24154aeef9ab48cb10afdaf
- SSDEEP 12288:wU5rCOTeiDk3Evari+dfbpS0X7B+afNZ+3/v+I9hUG2VA:wUQOJDk0iuCRNGEA
- TLSH T118E4D12173D88532E9FB037859B5F6614DBEBD226722D6CF6B8412BE0971BC08A31753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4824 FA49.tmp 4080 FB14.tmp 4968 FC5C.tmp 5780 FDA5.tmp 4452 FE50.tmp 4916 FF1C.tmp 5200 35.tmp 3728 14E.tmp 3180 296.tmp 5640 390.tmp 3384 48A.tmp 3420 5B3.tmp 6116 6AD.tmp 1512 7B7.tmp 2580 8C0.tmp 2408 9CA.tmp 1284 AF3.tmp 468 C1C.tmp 2600 CF6.tmp 1032 E00.tmp 5420 F19.tmp 3500 1013.tmp 928 117B.tmp 1628 1265.tmp 5236 135F.tmp 4776 1459.tmp 6084 1592.tmp 1496 169B.tmp 2860 1795.tmp 5772 18CE.tmp 3052 1999.tmp 3828 1AD1.tmp 1304 1BCB.tmp 5312 1CB6.tmp 3796 1D62.tmp 5464 1E4C.tmp 2880 1F07.tmp 2272 1FF2.tmp 5000 20DC.tmp 5928 21C7.tmp 3936 2272.tmp 3212 233E.tmp 472 2409.tmp 2032 24C4.tmp 2388 259F.tmp 5696 266A.tmp 1908 26E7.tmp 1452 27D1.tmp 5720 285E.tmp 3672 28EB.tmp 4092 2997.tmp 3800 2A23.tmp 2292 2A91.tmp 1256 2B1D.tmp 5888 2C27.tmp 4520 2CD3.tmp 3392 2D6F.tmp 4484 2DFC.tmp 2204 2E79.tmp 6132 2EF6.tmp 2568 2F73.tmp 3764 2FFF.tmp 1996 30AB.tmp 3276 3128.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 169B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 925E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7262.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D78A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53BF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 4824 2820 2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe 89 PID 4824 wrote to memory of 4080 4824 FA49.tmp 90 PID 4080 wrote to memory of 4968 4080 FB14.tmp 91 PID 4968 wrote to memory of 5780 4968 FC5C.tmp 92 PID 5780 wrote to memory of 4452 5780 FDA5.tmp 93 PID 4452 wrote to memory of 4916 4452 FE50.tmp 94 PID 4916 wrote to memory of 5200 4916 FF1C.tmp 95 PID 5200 wrote to memory of 3728 5200 35.tmp 96 PID 3728 wrote to memory of 3180 3728 14E.tmp 97 PID 3180 wrote to memory of 5640 3180 296.tmp 98 PID 5640 wrote to memory of 3384 5640 390.tmp 99 PID 3384 wrote to memory of 3420 3384 48A.tmp 100 PID 3420 wrote to memory of 6116 3420 5B3.tmp 101 PID 6116 wrote to memory of 1512 6116 6AD.tmp 102 PID 1512 wrote to memory of 2580 1512 7B7.tmp 103 PID 2580 wrote to memory of 2408 2580 8C0.tmp 104 PID 2408 wrote to memory of 1284 2408 9CA.tmp 105 PID 1284 wrote to memory of 468 1284 AF3.tmp 106 PID 468 wrote to memory of 2600 468 C1C.tmp 107 PID 2600 wrote to memory of 1032 2600 CF6.tmp 108 PID 1032 wrote to memory of 5420 1032 E00.tmp 109 PID 5420 wrote to memory of 3500 5420 F19.tmp 110 PID 3500 wrote to memory of 928 3500 1013.tmp 111 PID 928 wrote to memory of 1628 928 117B.tmp 112 PID 1628 wrote to memory of 5236 1628 1265.tmp 113 PID 5236 wrote to memory of 4776 5236 135F.tmp 114 PID 4776 wrote to memory of 6084 4776 1459.tmp 115 PID 6084 wrote to memory of 1496 6084 1592.tmp 116 PID 1496 wrote to memory of 2860 1496 169B.tmp 117 PID 2860 wrote to memory of 5772 2860 1795.tmp 118 PID 5772 wrote to memory of 3052 5772 18CE.tmp 119 PID 3052 wrote to memory of 3828 3052 1999.tmp 120 PID 3828 wrote to memory of 1304 3828 1AD1.tmp 121 PID 1304 wrote to memory of 5312 1304 1BCB.tmp 122 PID 5312 wrote to memory of 3796 5312 1CB6.tmp 123 PID 3796 wrote to memory of 5464 3796 1D62.tmp 124 PID 5464 wrote to memory of 2880 5464 1E4C.tmp 125 PID 2880 wrote to memory of 2272 2880 1F07.tmp 126 PID 2272 wrote to memory of 5000 2272 1FF2.tmp 127 PID 5000 wrote to memory of 5928 5000 20DC.tmp 128 PID 5928 wrote to memory of 3936 5928 21C7.tmp 129 PID 3936 wrote to memory of 3212 3936 2272.tmp 130 PID 3212 wrote to memory of 472 3212 233E.tmp 131 PID 472 wrote to memory of 2032 472 2409.tmp 132 PID 2032 wrote to memory of 2388 2032 24C4.tmp 133 PID 2388 wrote to memory of 5696 2388 259F.tmp 134 PID 5696 wrote to memory of 1908 5696 266A.tmp 135 PID 1908 wrote to memory of 1452 1908 26E7.tmp 136 PID 1452 wrote to memory of 5720 1452 27D1.tmp 137 PID 5720 wrote to memory of 3672 5720 285E.tmp 138 PID 3672 wrote to memory of 4092 3672 28EB.tmp 139 PID 4092 wrote to memory of 3800 4092 2997.tmp 140 PID 3800 wrote to memory of 2292 3800 2A23.tmp 141 PID 2292 wrote to memory of 1256 2292 2A91.tmp 142 PID 5620 wrote to memory of 5888 5620 2BAA.tmp 144 PID 5888 wrote to memory of 4520 5888 2C27.tmp 145 PID 4520 wrote to memory of 3392 4520 2CD3.tmp 146 PID 3392 wrote to memory of 4484 3392 2D6F.tmp 147 PID 4484 wrote to memory of 2204 4484 2DFC.tmp 148 PID 2204 wrote to memory of 6132 2204 2E79.tmp 149 PID 6132 wrote to memory of 2568 6132 2EF6.tmp 150 PID 2568 wrote to memory of 3764 2568 2F73.tmp 151 PID 3764 wrote to memory of 1996 3764 2FFF.tmp 152 PID 1996 wrote to memory of 3276 1996 30AB.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_603ed39f49555476822481d989d07c56_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\FE50.tmp"C:\Users\Admin\AppData\Local\Temp\FE50.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\390.tmp"C:\Users\Admin\AppData\Local\Temp\390.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\5B3.tmp"C:\Users\Admin\AppData\Local\Temp\5B3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\CF6.tmp"C:\Users\Admin\AppData\Local\Temp\CF6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\E00.tmp"C:\Users\Admin\AppData\Local\Temp\E00.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1795.tmp"C:\Users\Admin\AppData\Local\Temp\1795.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\1D62.tmp"C:\Users\Admin\AppData\Local\Temp\1D62.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\233E.tmp"C:\Users\Admin\AppData\Local\Temp\233E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\285E.tmp"C:\Users\Admin\AppData\Local\Temp\285E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2A91.tmp"C:\Users\Admin\AppData\Local\Temp\2A91.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"55⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"56⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\2C27.tmp"C:\Users\Admin\AppData\Local\Temp\2C27.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\2D6F.tmp"C:\Users\Admin\AppData\Local\Temp\2D6F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\2E79.tmp"C:\Users\Admin\AppData\Local\Temp\2E79.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"66⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"68⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"69⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"70⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\3455.tmp"C:\Users\Admin\AppData\Local\Temp\3455.tmp"71⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"72⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\355E.tmp"C:\Users\Admin\AppData\Local\Temp\355E.tmp"73⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"74⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"75⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\3723.tmp"C:\Users\Admin\AppData\Local\Temp\3723.tmp"76⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\37B0.tmp"C:\Users\Admin\AppData\Local\Temp\37B0.tmp"77⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"78⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"79⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\3975.tmp"C:\Users\Admin\AppData\Local\Temp\3975.tmp"80⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"81⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"82⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"83⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"84⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\3C15.tmp"C:\Users\Admin\AppData\Local\Temp\3C15.tmp"85⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"86⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"87⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"88⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"89⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"90⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"91⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"92⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"93⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\4107.tmp"C:\Users\Admin\AppData\Local\Temp\4107.tmp"94⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"95⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"96⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"97⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"98⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"100⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"101⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"102⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\45E9.tmp"C:\Users\Admin\AppData\Local\Temp\45E9.tmp"103⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"104⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\47AE.tmp"C:\Users\Admin\AppData\Local\Temp\47AE.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"107⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\48A8.tmp"C:\Users\Admin\AppData\Local\Temp\48A8.tmp"108⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\4934.tmp"C:\Users\Admin\AppData\Local\Temp\4934.tmp"109⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"110⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"111⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"112⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"113⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"115⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"116⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"117⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\4E36.tmp"C:\Users\Admin\AppData\Local\Temp\4E36.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"119⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"120⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5049.tmp"C:\Users\Admin\AppData\Local\Temp\5049.tmp"121⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\50D5.tmp"C:\Users\Admin\AppData\Local\Temp\50D5.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:3720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-