Analysis
- max time kernel
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_a73ad83e454c71c0afecd1f4861d573c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_a73ad83e454c71c0afecd1f4861d573c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-23_a73ad83e454c71c0afecd1f4861d573c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260723-qmtsfsbb55
- SHA256 9eafed2c7d614c3bd5cd29a731cebc3681b543600bd961a3978cf0d8641e0d15
- MD5 a73ad83e454c71c0afecd1f4861d573c
- SHA1 b37fecd18e6839fc9b003012b75de5f8053fa65f
- SHA512 2fd9e21f3b76daafd64cf0ad6c945afd25e3ce6d5807930bdd24c0d5f1086af8dfea2bdafd8152bd9260b3efe99b295a700f45597c41ea81927c5525b8452e23
- SSDEEP 12288:wU5rCOTeiDi6YZgMs2ernsEVv4iTR1tiW/vNZ+3/v+I9hUG2VA:wUQOJDi6YZo2erns4pTR1TNGEA
- TLSH T1D7E4D12073D88536E5FB037859B5E6614D7EBD326722D6CF2F8016AE0AB1BC09631763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3980 455C.tmp 3176 46F2.tmp 3228 480B.tmp 5528 4944.tmp 3384 4ABB.tmp 4536 4CBF.tmp 3476 4DB9.tmp 2496 4EE1.tmp 5976 5068.tmp 3372 51A1.tmp 5088 529B.tmp 5912 53A4.tmp 52 54FC.tmp 2372 5625.tmp 4860 579C.tmp 5616 58C5.tmp 3016 5A0D.tmp 2556 5B26.tmp 5392 5CDC.tmp 5484 5E14.tmp 4768 5F2D.tmp 3380 6027.tmp 1184 6131.tmp 1496 623B.tmp 2812 6392.tmp 3252 64DA.tmp 4740 6623.tmp 2860 674B.tmp 4516 6884.tmp 3720 699D.tmp 1716 6AB6.tmp 636 6BD0.tmp 5948 6D47.tmp 3644 6E21.tmp 1768 6EBE.tmp 2976 6FB8.tmp 1936 7044.tmp 1476 711F.tmp 5352 7209.tmp 3420 7303.tmp 3788 741D.tmp 1172 7526.tmp 5956 75F1.tmp 4440 76AD.tmp 1320 7759.tmp 1208 7805.tmp 3212 78DF.tmp 2316 798B.tmp 1464 7A66.tmp 2868 7B02.tmp 4072 7B9F.tmp 5740 7C2B.tmp 3820 7CC7.tmp 4236 7D54.tmp 5256 7DF0.tmp 3388 7E6D.tmp 3808 7F0A.tmp 2724 7FA6.tmp 3136 8042.tmp 5156 80EE.tmp 3596 818A.tmp 1360 8207.tmp 2440 8284.tmp 3740 8311.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E36C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 393D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C67E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E30E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1EF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3752 wrote to memory of 3980 3752 2026-07-23_a73ad83e454c71c0afecd1f4861d573c_elex_mafia_stealc_tofsee.exe 89 PID 3980 wrote to memory of 3176 3980 455C.tmp 90 PID 3176 wrote to memory of 3228 3176 46F2.tmp 91 PID 3228 wrote to memory of 5528 3228 480B.tmp 92 PID 5528 wrote to memory of 3384 5528 4944.tmp 93 PID 3384 wrote to memory of 4536 3384 4ABB.tmp 94 PID 4536 wrote to memory of 3476 4536 4CBF.tmp 95 PID 3476 wrote to memory of 2496 3476 4DB9.tmp 96 PID 2496 wrote to memory of 5976 2496 4EE1.tmp 97 PID 5976 wrote to memory of 3372 5976 5068.tmp 98 PID 3372 wrote to memory of 5088 3372 51A1.tmp 99 PID 5088 wrote to memory of 5912 5088 529B.tmp 100 PID 5912 wrote to memory of 52 5912 53A4.tmp 101 PID 52 wrote to memory of 2372 52 54FC.tmp 102 PID 2372 wrote to memory of 4860 2372 5625.tmp 103 PID 4860 wrote to memory of 5616 4860 579C.tmp 104 PID 5616 wrote to memory of 3016 5616 58C5.tmp 105 PID 3016 wrote to memory of 2556 3016 5A0D.tmp 106 PID 2556 wrote to memory of 5392 2556 5B26.tmp 107 PID 5392 wrote to memory of 5484 5392 5CDC.tmp 108 PID 5484 wrote to memory of 4768 5484 5E14.tmp 109 PID 4768 wrote to memory of 3380 4768 5F2D.tmp 110 PID 3380 wrote to memory of 1184 3380 6027.tmp 111 PID 1184 wrote to memory of 1496 1184 6131.tmp 112 PID 1496 wrote to memory of 2812 1496 623B.tmp 113 PID 2812 wrote to memory of 3252 2812 6392.tmp 114 PID 3252 wrote to memory of 4740 3252 64DA.tmp 115 PID 4740 wrote to memory of 2860 4740 6623.tmp 116 PID 2860 wrote to memory of 4516 2860 674B.tmp 117 PID 4516 wrote to memory of 3720 4516 6884.tmp 118 PID 3720 wrote to memory of 1716 3720 699D.tmp 119 PID 1716 wrote to memory of 636 1716 6AB6.tmp 120 PID 636 wrote to memory of 5948 636 6BD0.tmp 121 PID 5948 wrote to memory of 3644 5948 6D47.tmp 122 PID 3644 wrote to memory of 1768 3644 6E21.tmp 123 PID 1768 wrote to memory of 2976 1768 6EBE.tmp 124 PID 2976 wrote to memory of 1936 2976 6FB8.tmp 125 PID 1936 wrote to memory of 1476 1936 7044.tmp 126 PID 1476 wrote to memory of 5352 1476 711F.tmp 127 PID 5352 wrote to memory of 3420 5352 7209.tmp 128 PID 3420 wrote to memory of 3788 3420 7303.tmp 129 PID 3788 wrote to memory of 1172 3788 741D.tmp 130 PID 1172 wrote to memory of 5956 1172 7526.tmp 131 PID 5956 wrote to memory of 4440 5956 75F1.tmp 132 PID 4440 wrote to memory of 1320 4440 76AD.tmp 133 PID 1320 wrote to memory of 1208 1320 7759.tmp 134 PID 1208 wrote to memory of 3212 1208 7805.tmp 135 PID 3212 wrote to memory of 2316 3212 78DF.tmp 136 PID 2316 wrote to memory of 1464 2316 798B.tmp 137 PID 1464 wrote to memory of 2868 1464 7A66.tmp 138 PID 2868 wrote to memory of 4072 2868 7B02.tmp 139 PID 4072 wrote to memory of 5740 4072 7B9F.tmp 140 PID 5740 wrote to memory of 3820 5740 7C2B.tmp 141 PID 3820 wrote to memory of 4236 3820 7CC7.tmp 142 PID 4236 wrote to memory of 5256 4236 7D54.tmp 143 PID 5256 wrote to memory of 3388 5256 7DF0.tmp 144 PID 3388 wrote to memory of 3808 3388 7E6D.tmp 145 PID 3808 wrote to memory of 2724 3808 7F0A.tmp 146 PID 2724 wrote to memory of 3136 2724 7FA6.tmp 147 PID 3136 wrote to memory of 5156 3136 8042.tmp 148 PID 5156 wrote to memory of 3596 5156 80EE.tmp 149 PID 3596 wrote to memory of 1360 3596 818A.tmp 150 PID 1360 wrote to memory of 2440 1360 8207.tmp 151 PID 2440 wrote to memory of 3740 2440 8284.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_a73ad83e454c71c0afecd1f4861d573c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_a73ad83e454c71c0afecd1f4861d573c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\46F2.tmp"C:\Users\Admin\AppData\Local\Temp\46F2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\53A4.tmp"C:\Users\Admin\AppData\Local\Temp\53A4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\54FC.tmp"C:\Users\Admin\AppData\Local\Temp\54FC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\5625.tmp"C:\Users\Admin\AppData\Local\Temp\5625.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\579C.tmp"C:\Users\Admin\AppData\Local\Temp\579C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\5E14.tmp"C:\Users\Admin\AppData\Local\Temp\5E14.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\6131.tmp"C:\Users\Admin\AppData\Local\Temp\6131.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\6884.tmp"C:\Users\Admin\AppData\Local\Temp\6884.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\699D.tmp"C:\Users\Admin\AppData\Local\Temp\699D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6BD0.tmp"C:\Users\Admin\AppData\Local\Temp\6BD0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\6D47.tmp"C:\Users\Admin\AppData\Local\Temp\6D47.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\6E21.tmp"C:\Users\Admin\AppData\Local\Temp\6E21.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\6EBE.tmp"C:\Users\Admin\AppData\Local\Temp\6EBE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\711F.tmp"C:\Users\Admin\AppData\Local\Temp\711F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\7209.tmp"C:\Users\Admin\AppData\Local\Temp\7209.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\7303.tmp"C:\Users\Admin\AppData\Local\Temp\7303.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\7759.tmp"C:\Users\Admin\AppData\Local\Temp\7759.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7805.tmp"C:\Users\Admin\AppData\Local\Temp\7805.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7A66.tmp"C:\Users\Admin\AppData\Local\Temp\7A66.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7B02.tmp"C:\Users\Admin\AppData\Local\Temp\7B02.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\80EE.tmp"C:\Users\Admin\AppData\Local\Temp\80EE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\818A.tmp"C:\Users\Admin\AppData\Local\Temp\818A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8207.tmp"C:\Users\Admin\AppData\Local\Temp\8207.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8284.tmp"C:\Users\Admin\AppData\Local\Temp\8284.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"65⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"66⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"67⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\84C6.tmp"C:\Users\Admin\AppData\Local\Temp\84C6.tmp"68⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\8553.tmp"C:\Users\Admin\AppData\Local\Temp\8553.tmp"69⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"70⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"71⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\86E9.tmp"C:\Users\Admin\AppData\Local\Temp\86E9.tmp"72⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"73⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"74⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\888F.tmp"C:\Users\Admin\AppData\Local\Temp\888F.tmp"75⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"76⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\89A8.tmp"C:\Users\Admin\AppData\Local\Temp\89A8.tmp"77⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"78⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"79⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"80⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"81⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"82⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\8D81.tmp"C:\Users\Admin\AppData\Local\Temp\8D81.tmp"83⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"84⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"85⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"86⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"89⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"90⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"91⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\9253.tmp"C:\Users\Admin\AppData\Local\Temp\9253.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\92D0.tmp"C:\Users\Admin\AppData\Local\Temp\92D0.tmp"93⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"94⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\9409.tmp"C:\Users\Admin\AppData\Local\Temp\9409.tmp"95⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"97⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\958F.tmp"C:\Users\Admin\AppData\Local\Temp\958F.tmp"98⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\961C.tmp"C:\Users\Admin\AppData\Local\Temp\961C.tmp"99⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\9699.tmp"C:\Users\Admin\AppData\Local\Temp\9699.tmp"100⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"101⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\97B2.tmp"C:\Users\Admin\AppData\Local\Temp\97B2.tmp"102⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\982F.tmp"C:\Users\Admin\AppData\Local\Temp\982F.tmp"103⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"104⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"105⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\99D5.tmp"C:\Users\Admin\AppData\Local\Temp\99D5.tmp"106⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\9ABF.tmp"C:\Users\Admin\AppData\Local\Temp\9ABF.tmp"107⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"109⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\9C65.tmp"C:\Users\Admin\AppData\Local\Temp\9C65.tmp"110⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\9D11.tmp"C:\Users\Admin\AppData\Local\Temp\9D11.tmp"111⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"112⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"113⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"114⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"115⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"116⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"117⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"118⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"119⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"120⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"121⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"122⤵PID:1536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-