Analysis
- max time kernel
111s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_41fc8b2aa870c99f5dc7384bb2b14693_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_41fc8b2aa870c99f5dc7384bb2b14693_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_41fc8b2aa870c99f5dc7384bb2b14693_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260728-239pdscd68
- SHA256 8704b0320035f32abf56e07fa6d96c8f55333410f2d26ed8de56bdec8cda527f
- MD5 41fc8b2aa870c99f5dc7384bb2b14693
- SHA1 235d0323f1049d76c7a8b644019a139a0f835404
- SHA512 ef2a8c893040e7f3829247b9400b7371c0f3e15dba81a73eaf05c59f4702a0d41fc46a5be81d278bffc08c46bdfe2952e304187f5dfa5f67c6f876ce3b62e567
- SSDEEP 12288:HU5rCOTeiJXEHZVyPa4n8pUi0xYjtf6MlNiPNZ:HUQOJJ2Pmam8pUIyMlNiPN
- TLSH T113B4F1257585C036E59312350EE6EFB2297A7C714722A4CB3BC0762E6EB52E1E375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5244 E6DC.tmp 4000 E7B6.tmp 3192 E8B0.tmp 4048 E96C.tmp 4680 EA66.tmp 4012 EAE3.tmp 4444 EB7F.tmp 4880 EC1B.tmp 2932 ED06.tmp 4512 EDF0.tmp 4448 EE4E.tmp 1144 EF19.tmp 3852 EFC5.tmp 4244 F0A0.tmp 4304 F14C.tmp 2000 F1E8.tmp 1140 F284.tmp 1440 F35F.tmp 5960 F3EB.tmp 3260 F478.tmp 3052 F524.tmp 436 F5B1.tmp 2292 F65C.tmp 4204 F708.tmp 2684 F795.tmp 5768 F860.tmp 5456 F91C.tmp 4296 F9E7.tmp 2284 FA83.tmp 4384 FB1F.tmp 4628 FC0A.tmp 4904 FCC5.tmp 2720 FD61.tmp 8 FDEE.tmp 5468 FE6B.tmp 5744 FED8.tmp 5172 FF65.tmp 4432 FFE2.tmp 3032 7E.tmp 4688 10B.tmp 5676 197.tmp 3212 205.tmp 1520 272.tmp 4580 30E.tmp 1188 38B.tmp 3336 408.tmp 5748 4B4.tmp 4316 560.tmp 5284 5DD.tmp 4248 65A.tmp 352 6E7.tmp 4844 764.tmp 5852 800.tmp 6076 88D.tmp 2544 929.tmp 4140 9A6.tmp 2316 A42.tmp 4620 ABF.tmp 3820 B2D.tmp 4616 BB9.tmp 4344 C36.tmp 2532 CC3.tmp 6080 D30.tmp 1460 DAD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 680D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 323D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 199F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B15F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5620 wrote to memory of 5244 5620 2026-07-28_41fc8b2aa870c99f5dc7384bb2b14693_elex_mafia_stealc_tofsee.exe 88 PID 5244 wrote to memory of 4000 5244 E6DC.tmp 89 PID 4000 wrote to memory of 3192 4000 E7B6.tmp 90 PID 3192 wrote to memory of 4048 3192 E8B0.tmp 91 PID 4048 wrote to memory of 4680 4048 E96C.tmp 92 PID 4680 wrote to memory of 4012 4680 EA66.tmp 93 PID 4012 wrote to memory of 4444 4012 EAE3.tmp 94 PID 4444 wrote to memory of 4880 4444 EB7F.tmp 95 PID 4880 wrote to memory of 2932 4880 EC1B.tmp 96 PID 2932 wrote to memory of 4512 2932 ED06.tmp 97 PID 4512 wrote to memory of 4448 4512 EDF0.tmp 98 PID 4448 wrote to memory of 1144 4448 EE4E.tmp 99 PID 1144 wrote to memory of 3852 1144 EF19.tmp 100 PID 3852 wrote to memory of 4244 3852 EFC5.tmp 101 PID 4244 wrote to memory of 4304 4244 F0A0.tmp 102 PID 4304 wrote to memory of 2000 4304 F14C.tmp 103 PID 2000 wrote to memory of 1140 2000 F1E8.tmp 104 PID 1140 wrote to memory of 1440 1140 F284.tmp 105 PID 1440 wrote to memory of 5960 1440 F35F.tmp 106 PID 5960 wrote to memory of 3260 5960 F3EB.tmp 107 PID 3260 wrote to memory of 3052 3260 F478.tmp 108 PID 3052 wrote to memory of 436 3052 F524.tmp 109 PID 436 wrote to memory of 2292 436 F5B1.tmp 110 PID 2292 wrote to memory of 4204 2292 F65C.tmp 111 PID 4204 wrote to memory of 2684 4204 F708.tmp 112 PID 2684 wrote to memory of 5768 2684 F795.tmp 113 PID 5768 wrote to memory of 5456 5768 F860.tmp 114 PID 5456 wrote to memory of 4296 5456 F91C.tmp 115 PID 4296 wrote to memory of 2284 4296 F9E7.tmp 116 PID 2284 wrote to memory of 4384 2284 FA83.tmp 117 PID 4384 wrote to memory of 4628 4384 FB1F.tmp 118 PID 4628 wrote to memory of 4904 4628 FC0A.tmp 119 PID 4904 wrote to memory of 2720 4904 FCC5.tmp 120 PID 2720 wrote to memory of 8 2720 FD61.tmp 121 PID 8 wrote to memory of 5468 8 FDEE.tmp 122 PID 5468 wrote to memory of 5744 5468 FE6B.tmp 123 PID 5744 wrote to memory of 5172 5744 FED8.tmp 124 PID 5172 wrote to memory of 4432 5172 FF65.tmp 125 PID 4432 wrote to memory of 3032 4432 FFE2.tmp 126 PID 3032 wrote to memory of 4688 3032 7E.tmp 127 PID 4688 wrote to memory of 5676 4688 10B.tmp 128 PID 5676 wrote to memory of 3212 5676 197.tmp 129 PID 3212 wrote to memory of 1520 3212 205.tmp 130 PID 1520 wrote to memory of 4580 1520 272.tmp 131 PID 4580 wrote to memory of 1188 4580 30E.tmp 132 PID 1188 wrote to memory of 3336 1188 38B.tmp 133 PID 3336 wrote to memory of 5748 3336 408.tmp 134 PID 5748 wrote to memory of 4316 5748 4B4.tmp 135 PID 4316 wrote to memory of 5284 4316 560.tmp 136 PID 5284 wrote to memory of 4248 5284 5DD.tmp 137 PID 4248 wrote to memory of 352 4248 65A.tmp 138 PID 352 wrote to memory of 4844 352 6E7.tmp 139 PID 4844 wrote to memory of 5852 4844 764.tmp 140 PID 5852 wrote to memory of 6076 5852 800.tmp 141 PID 6076 wrote to memory of 2544 6076 88D.tmp 142 PID 2544 wrote to memory of 4140 2544 929.tmp 143 PID 4140 wrote to memory of 2316 4140 9A6.tmp 144 PID 2316 wrote to memory of 4620 2316 A42.tmp 145 PID 4620 wrote to memory of 3820 4620 ABF.tmp 146 PID 3820 wrote to memory of 4616 3820 B2D.tmp 147 PID 4616 wrote to memory of 4344 4616 BB9.tmp 148 PID 4344 wrote to memory of 2532 4344 C36.tmp 149 PID 2532 wrote to memory of 6080 2532 CC3.tmp 150 PID 6080 wrote to memory of 1460 6080 D30.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_41fc8b2aa870c99f5dc7384bb2b14693_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_41fc8b2aa870c99f5dc7384bb2b14693_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\E96C.tmp"C:\Users\Admin\AppData\Local\Temp\E96C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\EA66.tmp"C:\Users\Admin\AppData\Local\Temp\EA66.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\F860.tmp"C:\Users\Admin\AppData\Local\Temp\F860.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\205.tmp"C:\Users\Admin\AppData\Local\Temp\205.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\560.tmp"C:\Users\Admin\AppData\Local\Temp\560.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\5DD.tmp"C:\Users\Admin\AppData\Local\Temp\5DD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\6E7.tmp"C:\Users\Admin\AppData\Local\Temp\6E7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\ABF.tmp"C:\Users\Admin\AppData\Local\Temp\ABF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\B2D.tmp"C:\Users\Admin\AppData\Local\Temp\B2D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\BB9.tmp"C:\Users\Admin\AppData\Local\Temp\BB9.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\C36.tmp"C:\Users\Admin\AppData\Local\Temp\C36.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\D30.tmp"C:\Users\Admin\AppData\Local\Temp\D30.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\E3A.tmp"C:\Users\Admin\AppData\Local\Temp\E3A.tmp"66⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\EC6.tmp"C:\Users\Admin\AppData\Local\Temp\EC6.tmp"67⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\F43.tmp"C:\Users\Admin\AppData\Local\Temp\F43.tmp"68⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\FC0.tmp"C:\Users\Admin\AppData\Local\Temp\FC0.tmp"69⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\103D.tmp"C:\Users\Admin\AppData\Local\Temp\103D.tmp"70⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"71⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\1137.tmp"C:\Users\Admin\AppData\Local\Temp\1137.tmp"72⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\11B4.tmp"C:\Users\Admin\AppData\Local\Temp\11B4.tmp"73⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"74⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\12ED.tmp"C:\Users\Admin\AppData\Local\Temp\12ED.tmp"75⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\137A.tmp"C:\Users\Admin\AppData\Local\Temp\137A.tmp"76⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1483.tmp"C:\Users\Admin\AppData\Local\Temp\1483.tmp"78⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\1500.tmp"C:\Users\Admin\AppData\Local\Temp\1500.tmp"79⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"80⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\15FA.tmp"C:\Users\Admin\AppData\Local\Temp\15FA.tmp"81⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"82⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\1704.tmp"C:\Users\Admin\AppData\Local\Temp\1704.tmp"83⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"84⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"85⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\187B.tmp"C:\Users\Admin\AppData\Local\Temp\187B.tmp"86⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\1907.tmp"C:\Users\Admin\AppData\Local\Temp\1907.tmp"87⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\1984.tmp"C:\Users\Admin\AppData\Local\Temp\1984.tmp"88⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\1A11.tmp"C:\Users\Admin\AppData\Local\Temp\1A11.tmp"89⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"91⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\1C82.tmp"C:\Users\Admin\AppData\Local\Temp\1C82.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"94⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"95⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"96⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"97⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"98⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\1F70.tmp"C:\Users\Admin\AppData\Local\Temp\1F70.tmp"99⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"100⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2089.tmp"C:\Users\Admin\AppData\Local\Temp\2089.tmp"101⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"102⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2174.tmp"C:\Users\Admin\AppData\Local\Temp\2174.tmp"103⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\21F1.tmp"C:\Users\Admin\AppData\Local\Temp\21F1.tmp"104⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\227D.tmp"C:\Users\Admin\AppData\Local\Temp\227D.tmp"105⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"106⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"107⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\2471.tmp"C:\Users\Admin\AppData\Local\Temp\2471.tmp"109⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\258B.tmp"C:\Users\Admin\AppData\Local\Temp\258B.tmp"111⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"112⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"113⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\2750.tmp"C:\Users\Admin\AppData\Local\Temp\2750.tmp"114⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\27CD.tmp"C:\Users\Admin\AppData\Local\Temp\27CD.tmp"115⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\284A.tmp"C:\Users\Admin\AppData\Local\Temp\284A.tmp"116⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\28C7.tmp"C:\Users\Admin\AppData\Local\Temp\28C7.tmp"117⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"118⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\29D0.tmp"C:\Users\Admin\AppData\Local\Temp\29D0.tmp"119⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"120⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"121⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2B57.tmp"C:\Users\Admin\AppData\Local\Temp\2B57.tmp"122⤵PID:5984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-