Analysis
- max time kernel
119s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_404fed8e7456ded6e10d0f3ac4d063b7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_404fed8e7456ded6e10d0f3ac4d063b7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_404fed8e7456ded6e10d0f3ac4d063b7_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260803-ftmbvacd89
- SHA256 5fbaea987445561de81e40fc99ca6c4e0934f5ab4c50993cfde4506fbade3c58
- MD5 404fed8e7456ded6e10d0f3ac4d063b7
- SHA1 43f8dcc1864de353d4b0ab5940f2046a8ffa93f2
- SHA512 d31220d5b620867241b0d38b28255efa7d8b1525e028ef8cab7954e919ccf5ccb57f271fd30eb598f38620492f25689c67d282b9c64fe6bf125ae259c71cec73
- SSDEEP 12288:wU5rCOTeiDyVzqfCR5Uye+D9uNZ+3/v+I9hUG2VA:wUQOJDytqFyDuNGEA
- TLSH T1D3E4D02177D88632E5F7037859B5E6614D7EFD226722D6CF2F8025AE0A71BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5364 DD27.tmp 3708 DE60.tmp 4344 DF79.tmp 1476 E025.tmp 2236 E0C1.tmp 720 E2B5.tmp 3080 E371.tmp 3952 E4A9.tmp 2840 E5C2.tmp 2584 E68E.tmp 1712 E882.tmp 2324 E9D9.tmp 5092 EAE3.tmp 1448 EC2B.tmp 1672 ED73.tmp 5836 EEAC.tmp 5632 EF38.tmp 5220 F090.tmp 712 F1A9.tmp 2676 F2D2.tmp 2808 F3FB.tmp 4616 F543.tmp 1252 F65C.tmp 4916 F766.tmp 4728 F8AE.tmp 3092 F9D7.tmp 4520 FB10.tmp 4392 FC38.tmp 1560 FD42.tmp 5284 FE9A.tmp 4880 FFA3.tmp 1420 FB.tmp 4020 224.tmp 2396 30E.tmp 1316 408.tmp 2012 4D4.tmp 1804 5AE.tmp 4396 6B8.tmp 4788 7D1.tmp 1524 8AC.tmp 5052 9A6.tmp 5924 A52.tmp 3376 B1D.tmp 4920 BF8.tmp 6112 CF2.tmp 3928 DCC.tmp 5892 E98.tmp 2444 F43.tmp 2120 101E.tmp 5316 10BA.tmp 4892 1137.tmp 1164 11A5.tmp 4164 1231.tmp 5312 12FD.tmp 1408 1399.tmp 5128 1435.tmp 4860 14E1.tmp 572 157D.tmp 3180 1619.tmp 2460 1696.tmp 2208 1733.tmp 5716 17CF.tmp 5536 186B.tmp 2888 1907.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 851F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 101E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 252D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 638E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5763.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 5364 4580 2026-08-03_404fed8e7456ded6e10d0f3ac4d063b7_elex_mafia_stealc_tofsee.exe 88 PID 5364 wrote to memory of 3708 5364 DD27.tmp 89 PID 3708 wrote to memory of 4344 3708 DE60.tmp 90 PID 4344 wrote to memory of 1476 4344 DF79.tmp 91 PID 1476 wrote to memory of 2236 1476 E025.tmp 92 PID 2236 wrote to memory of 720 2236 E0C1.tmp 93 PID 720 wrote to memory of 3080 720 E2B5.tmp 94 PID 3080 wrote to memory of 3952 3080 E371.tmp 95 PID 3952 wrote to memory of 2840 3952 E4A9.tmp 96 PID 2840 wrote to memory of 2584 2840 E5C2.tmp 97 PID 2584 wrote to memory of 1712 2584 E68E.tmp 98 PID 1712 wrote to memory of 2324 1712 E882.tmp 99 PID 2324 wrote to memory of 5092 2324 E9D9.tmp 100 PID 5092 wrote to memory of 1448 5092 EAE3.tmp 101 PID 1448 wrote to memory of 1672 1448 EC2B.tmp 102 PID 1672 wrote to memory of 5836 1672 ED73.tmp 103 PID 5836 wrote to memory of 5632 5836 EEAC.tmp 104 PID 5632 wrote to memory of 5220 5632 EF38.tmp 105 PID 5220 wrote to memory of 712 5220 F090.tmp 106 PID 712 wrote to memory of 2676 712 F1A9.tmp 107 PID 2676 wrote to memory of 2808 2676 F2D2.tmp 108 PID 2808 wrote to memory of 4616 2808 F3FB.tmp 109 PID 4616 wrote to memory of 1252 4616 F543.tmp 110 PID 1252 wrote to memory of 4916 1252 F65C.tmp 111 PID 4916 wrote to memory of 4728 4916 F766.tmp 112 PID 4728 wrote to memory of 3092 4728 F8AE.tmp 113 PID 3092 wrote to memory of 4520 3092 F9D7.tmp 114 PID 4520 wrote to memory of 4392 4520 FB10.tmp 115 PID 4392 wrote to memory of 1560 4392 FC38.tmp 116 PID 1560 wrote to memory of 5284 1560 FD42.tmp 117 PID 5284 wrote to memory of 4880 5284 FE9A.tmp 118 PID 4880 wrote to memory of 1420 4880 FFA3.tmp 119 PID 1420 wrote to memory of 4020 1420 FB.tmp 120 PID 4020 wrote to memory of 2396 4020 224.tmp 121 PID 2396 wrote to memory of 1316 2396 30E.tmp 122 PID 1316 wrote to memory of 2012 1316 408.tmp 123 PID 2012 wrote to memory of 1804 2012 4D4.tmp 124 PID 1804 wrote to memory of 4396 1804 5AE.tmp 125 PID 4396 wrote to memory of 4788 4396 6B8.tmp 126 PID 4788 wrote to memory of 1524 4788 7D1.tmp 127 PID 1524 wrote to memory of 5052 1524 8AC.tmp 128 PID 5052 wrote to memory of 5924 5052 9A6.tmp 129 PID 5924 wrote to memory of 3376 5924 A52.tmp 130 PID 3376 wrote to memory of 4920 3376 B1D.tmp 131 PID 4920 wrote to memory of 6112 4920 BF8.tmp 132 PID 6112 wrote to memory of 3928 6112 CF2.tmp 133 PID 3928 wrote to memory of 5892 3928 DCC.tmp 134 PID 5892 wrote to memory of 2444 5892 E98.tmp 135 PID 2444 wrote to memory of 2120 2444 F43.tmp 136 PID 2120 wrote to memory of 5316 2120 101E.tmp 137 PID 5316 wrote to memory of 4892 5316 10BA.tmp 138 PID 4892 wrote to memory of 1164 4892 1137.tmp 139 PID 1164 wrote to memory of 4164 1164 11A5.tmp 140 PID 4164 wrote to memory of 5312 4164 1231.tmp 141 PID 5312 wrote to memory of 1408 5312 12FD.tmp 142 PID 1408 wrote to memory of 5128 1408 1399.tmp 143 PID 5128 wrote to memory of 4860 5128 1435.tmp 144 PID 4860 wrote to memory of 572 4860 14E1.tmp 145 PID 572 wrote to memory of 3180 572 157D.tmp 146 PID 3180 wrote to memory of 2460 3180 1619.tmp 147 PID 2460 wrote to memory of 2208 2460 1696.tmp 148 PID 2208 wrote to memory of 5716 2208 1733.tmp 149 PID 5716 wrote to memory of 5536 5716 17CF.tmp 150 PID 5536 wrote to memory of 2888 5536 186B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_404fed8e7456ded6e10d0f3ac4d063b7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_404fed8e7456ded6e10d0f3ac4d063b7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\DD27.tmp"C:\Users\Admin\AppData\Local\Temp\DD27.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\DE60.tmp"C:\Users\Admin\AppData\Local\Temp\DE60.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\F090.tmp"C:\Users\Admin\AppData\Local\Temp\F090.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\FB10.tmp"C:\Users\Admin\AppData\Local\Temp\FB10.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\FB.tmp"C:\Users\Admin\AppData\Local\Temp\FB.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\6B8.tmp"C:\Users\Admin\AppData\Local\Temp\6B8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\7D1.tmp"C:\Users\Admin\AppData\Local\Temp\7D1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8AC.tmp"C:\Users\Admin\AppData\Local\Temp\8AC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\A52.tmp"C:\Users\Admin\AppData\Local\Temp\A52.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\DCC.tmp"C:\Users\Admin\AppData\Local\Temp\DCC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\F43.tmp"C:\Users\Admin\AppData\Local\Temp\F43.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\10BA.tmp"C:\Users\Admin\AppData\Local\Temp\10BA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\1137.tmp"C:\Users\Admin\AppData\Local\Temp\1137.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\1231.tmp"C:\Users\Admin\AppData\Local\Temp\1231.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\12FD.tmp"C:\Users\Admin\AppData\Local\Temp\12FD.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\1399.tmp"C:\Users\Admin\AppData\Local\Temp\1399.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1733.tmp"C:\Users\Admin\AppData\Local\Temp\1733.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\17CF.tmp"C:\Users\Admin\AppData\Local\Temp\17CF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\186B.tmp"C:\Users\Admin\AppData\Local\Temp\186B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\1907.tmp"C:\Users\Admin\AppData\Local\Temp\1907.tmp"65⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"66⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\1A40.tmp"C:\Users\Admin\AppData\Local\Temp\1A40.tmp"67⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"68⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\1B69.tmp"C:\Users\Admin\AppData\Local\Temp\1B69.tmp"69⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"70⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"71⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"72⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"73⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\1E28.tmp"C:\Users\Admin\AppData\Local\Temp\1E28.tmp"74⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"75⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"76⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"77⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\20A9.tmp"C:\Users\Admin\AppData\Local\Temp\20A9.tmp"78⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"79⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"80⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"81⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"82⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2358.tmp"C:\Users\Admin\AppData\Local\Temp\2358.tmp"83⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"84⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"88⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"89⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\2750.tmp"C:\Users\Admin\AppData\Local\Temp\2750.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"91⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2859.tmp"C:\Users\Admin\AppData\Local\Temp\2859.tmp"92⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\28D6.tmp"C:\Users\Admin\AppData\Local\Temp\28D6.tmp"93⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2963.tmp"C:\Users\Admin\AppData\Local\Temp\2963.tmp"94⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"95⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"96⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"97⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"98⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2C51.tmp"C:\Users\Admin\AppData\Local\Temp\2C51.tmp"99⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"100⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2E06.tmp"C:\Users\Admin\AppData\Local\Temp\2E06.tmp"102⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"103⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"104⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"105⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\301A.tmp"C:\Users\Admin\AppData\Local\Temp\301A.tmp"106⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"107⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"108⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\31DF.tmp"C:\Users\Admin\AppData\Local\Temp\31DF.tmp"109⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\325C.tmp"C:\Users\Admin\AppData\Local\Temp\325C.tmp"110⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\32D9.tmp"C:\Users\Admin\AppData\Local\Temp\32D9.tmp"111⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3394.tmp"C:\Users\Admin\AppData\Local\Temp\3394.tmp"112⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3411.tmp"C:\Users\Admin\AppData\Local\Temp\3411.tmp"113⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\34AE.tmp"C:\Users\Admin\AppData\Local\Temp\34AE.tmp"114⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\353A.tmp"C:\Users\Admin\AppData\Local\Temp\353A.tmp"115⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\35E6.tmp"C:\Users\Admin\AppData\Local\Temp\35E6.tmp"116⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\3692.tmp"C:\Users\Admin\AppData\Local\Temp\3692.tmp"117⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\372E.tmp"C:\Users\Admin\AppData\Local\Temp\372E.tmp"118⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\37BB.tmp"C:\Users\Admin\AppData\Local\Temp\37BB.tmp"119⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\3867.tmp"C:\Users\Admin\AppData\Local\Temp\3867.tmp"120⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"121⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\39BE.tmp"C:\Users\Admin\AppData\Local\Temp\39BE.tmp"122⤵PID:5660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-