Analysis
- max time kernel
117s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 01:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_2c8dbbec542c61ee364eb37db3caf63d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_2c8dbbec542c61ee364eb37db3caf63d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-23_2c8dbbec542c61ee364eb37db3caf63d_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260723-brv4rack8z
- SHA256 8c7bcc4c79b15bfd908ee270e2db989f79fbc8f2b004ef37a668ef588771871f
- MD5 2c8dbbec542c61ee364eb37db3caf63d
- SHA1 e2721e0d3f6912749aa841fa950dcf62d96c5084
- SHA512 cf90cb03c6d7d0016f6bb0ee53e3c29b50a0bac9d34542231ab06b678982076ada28090e0cacbce57ee7087ed9c8ea25ed1f7d7b907c1c15e5b6017e342b07f5
- SSDEEP 12288:NU5rCOTeijkrrbtMz09wbe0azdkTZwlH:NUQOJjQ6g0TSlH
- TLSH T1E6B4F026B685C133E29202700EEAEBB16A3A7D355736A4C33794A33D2E712E1D775347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1564 68E2.tmp 4984 698E.tmp 4852 6A39.tmp 2088 6B05.tmp 4616 6BC0.tmp 6056 6C6C.tmp 2116 6D56.tmp 5312 6E02.tmp 5492 6F1B.tmp 4344 6FF6.tmp 2564 7092.tmp 5152 717D.tmp 3464 7238.tmp 1844 72F4.tmp 4948 73BF.tmp 768 746B.tmp 2504 7517.tmp 5236 75D2.tmp 4544 765F.tmp 2772 76EB.tmp 4524 77A7.tmp 1220 78A1.tmp 4608 796C.tmp 4972 7A56.tmp 4340 7B41.tmp 4736 7C0C.tmp 4272 7CA8.tmp 2064 7D44.tmp 1576 7EAC.tmp 5240 7F58.tmp 2808 8032.tmp 2540 810D.tmp 2400 81B9.tmp 4464 8246.tmp 4380 82D2.tmp 1920 834F.tmp 2108 83DC.tmp 4940 843A.tmp 4840 84A7.tmp 3500 8534.tmp 2520 85B1.tmp 2304 863D.tmp 5892 86BA.tmp 4572 8747.tmp 3132 87C4.tmp 2972 8841.tmp 908 88AE.tmp 5112 893B.tmp 4556 89E7.tmp 4236 8A73.tmp 1320 8AF0.tmp 4780 8B8D.tmp 4724 8C19.tmp 5632 8C87.tmp 3928 8D13.tmp 4652 8DA0.tmp 3104 8E1D.tmp 5548 8EB9.tmp 4644 8F55.tmp 5484 8FD2.tmp 3344 907E.tmp 3180 910B.tmp 2940 9198.tmp 124 9205.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 612C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F732.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 152A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 698E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A29A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4108 wrote to memory of 1564 4108 2026-07-23_2c8dbbec542c61ee364eb37db3caf63d_elex_mafia_stealc_tofsee.exe 90 PID 1564 wrote to memory of 4984 1564 68E2.tmp 91 PID 4984 wrote to memory of 4852 4984 698E.tmp 92 PID 4852 wrote to memory of 2088 4852 6A39.tmp 93 PID 2088 wrote to memory of 4616 2088 6B05.tmp 94 PID 4616 wrote to memory of 6056 4616 6BC0.tmp 95 PID 6056 wrote to memory of 2116 6056 6C6C.tmp 96 PID 2116 wrote to memory of 5312 2116 6D56.tmp 97 PID 5312 wrote to memory of 5492 5312 6E02.tmp 98 PID 5492 wrote to memory of 4344 5492 6F1B.tmp 99 PID 4344 wrote to memory of 2564 4344 6FF6.tmp 100 PID 2564 wrote to memory of 5152 2564 7092.tmp 101 PID 5152 wrote to memory of 3464 5152 717D.tmp 102 PID 3464 wrote to memory of 1844 3464 7238.tmp 103 PID 1844 wrote to memory of 4948 1844 72F4.tmp 104 PID 4948 wrote to memory of 768 4948 73BF.tmp 105 PID 768 wrote to memory of 2504 768 746B.tmp 106 PID 2504 wrote to memory of 5236 2504 7517.tmp 107 PID 5236 wrote to memory of 4544 5236 75D2.tmp 108 PID 4544 wrote to memory of 2772 4544 765F.tmp 109 PID 2772 wrote to memory of 4524 2772 76EB.tmp 110 PID 4524 wrote to memory of 1220 4524 77A7.tmp 111 PID 1220 wrote to memory of 4608 1220 78A1.tmp 112 PID 4608 wrote to memory of 4972 4608 796C.tmp 113 PID 4972 wrote to memory of 4340 4972 7A56.tmp 114 PID 4340 wrote to memory of 4736 4340 7B41.tmp 115 PID 4736 wrote to memory of 4272 4736 7C0C.tmp 116 PID 4272 wrote to memory of 2064 4272 7CA8.tmp 117 PID 2064 wrote to memory of 1576 2064 7D44.tmp 118 PID 1576 wrote to memory of 5240 1576 7EAC.tmp 119 PID 5240 wrote to memory of 2808 5240 7F58.tmp 120 PID 2808 wrote to memory of 2540 2808 8032.tmp 121 PID 2540 wrote to memory of 2400 2540 810D.tmp 122 PID 2400 wrote to memory of 4464 2400 81B9.tmp 123 PID 4464 wrote to memory of 4380 4464 8246.tmp 124 PID 4380 wrote to memory of 1920 4380 82D2.tmp 125 PID 1920 wrote to memory of 2108 1920 834F.tmp 126 PID 2108 wrote to memory of 4940 2108 83DC.tmp 127 PID 4940 wrote to memory of 4840 4940 843A.tmp 128 PID 4840 wrote to memory of 3500 4840 84A7.tmp 129 PID 3500 wrote to memory of 2520 3500 8534.tmp 130 PID 2520 wrote to memory of 2304 2520 85B1.tmp 131 PID 2304 wrote to memory of 5892 2304 863D.tmp 132 PID 5892 wrote to memory of 4572 5892 86BA.tmp 133 PID 4572 wrote to memory of 3132 4572 8747.tmp 134 PID 3132 wrote to memory of 2972 3132 87C4.tmp 135 PID 2972 wrote to memory of 908 2972 8841.tmp 136 PID 908 wrote to memory of 5112 908 88AE.tmp 137 PID 5112 wrote to memory of 4556 5112 893B.tmp 138 PID 4556 wrote to memory of 4236 4556 89E7.tmp 139 PID 4236 wrote to memory of 1320 4236 8A73.tmp 140 PID 1320 wrote to memory of 4780 1320 8AF0.tmp 141 PID 4780 wrote to memory of 4724 4780 8B8D.tmp 142 PID 4724 wrote to memory of 5632 4724 8C19.tmp 143 PID 5632 wrote to memory of 3928 5632 8C87.tmp 144 PID 3928 wrote to memory of 4652 3928 8D13.tmp 145 PID 4652 wrote to memory of 3104 4652 8DA0.tmp 146 PID 3104 wrote to memory of 5548 3104 8E1D.tmp 147 PID 5548 wrote to memory of 4644 5548 8EB9.tmp 148 PID 4644 wrote to memory of 5484 4644 8F55.tmp 149 PID 5484 wrote to memory of 3344 5484 8FD2.tmp 150 PID 3344 wrote to memory of 3180 3344 907E.tmp 151 PID 3180 wrote to memory of 2940 3180 910B.tmp 152 PID 2940 wrote to memory of 124 2940 9198.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_2c8dbbec542c61ee364eb37db3caf63d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_2c8dbbec542c61ee364eb37db3caf63d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\6D56.tmp"C:\Users\Admin\AppData\Local\Temp\6D56.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\6E02.tmp"C:\Users\Admin\AppData\Local\Temp\6E02.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\73BF.tmp"C:\Users\Admin\AppData\Local\Temp\73BF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\76EB.tmp"C:\Users\Admin\AppData\Local\Temp\76EB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\78A1.tmp"C:\Users\Admin\AppData\Local\Temp\78A1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\7B41.tmp"C:\Users\Admin\AppData\Local\Temp\7B41.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\7D44.tmp"C:\Users\Admin\AppData\Local\Temp\7D44.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\8032.tmp"C:\Users\Admin\AppData\Local\Temp\8032.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\810D.tmp"C:\Users\Admin\AppData\Local\Temp\810D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\81B9.tmp"C:\Users\Admin\AppData\Local\Temp\81B9.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8246.tmp"C:\Users\Admin\AppData\Local\Temp\8246.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\82D2.tmp"C:\Users\Admin\AppData\Local\Temp\82D2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\893B.tmp"C:\Users\Admin\AppData\Local\Temp\893B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\907E.tmp"C:\Users\Admin\AppData\Local\Temp\907E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:124 -
C:\Users\Admin\AppData\Local\Temp\9282.tmp"C:\Users\Admin\AppData\Local\Temp\9282.tmp"66⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"67⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"68⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"69⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\94C4.tmp"C:\Users\Admin\AppData\Local\Temp\94C4.tmp"70⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"71⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"72⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\965A.tmp"C:\Users\Admin\AppData\Local\Temp\965A.tmp"73⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"74⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"75⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\981F.tmp"C:\Users\Admin\AppData\Local\Temp\981F.tmp"76⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"77⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"78⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"79⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"80⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"81⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"C:\Users\Admin\AppData\Local\Temp\9B2D.tmp"82⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"83⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"84⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"85⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\9D30.tmp"C:\Users\Admin\AppData\Local\Temp\9D30.tmp"86⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"87⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"88⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"89⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9F82.tmp"C:\Users\Admin\AppData\Local\Temp\9F82.tmp"90⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"91⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\A09B.tmp"C:\Users\Admin\AppData\Local\Temp\A09B.tmp"92⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"93⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"94⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"95⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"96⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"C:\Users\Admin\AppData\Local\Temp\A2FD.tmp"97⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A37A.tmp"C:\Users\Admin\AppData\Local\Temp\A37A.tmp"98⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"99⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\A483.tmp"C:\Users\Admin\AppData\Local\Temp\A483.tmp"100⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\A53F.tmp"C:\Users\Admin\AppData\Local\Temp\A53F.tmp"101⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"102⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"103⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"104⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A7BF.tmp"C:\Users\Admin\AppData\Local\Temp\A7BF.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"106⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"107⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"108⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"109⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"110⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"111⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\AB4A.tmp"C:\Users\Admin\AppData\Local\Temp\AB4A.tmp"112⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"113⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"114⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"115⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"116⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"117⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"118⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"119⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\AF51.tmp"C:\Users\Admin\AppData\Local\Temp\AF51.tmp"120⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"121⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-