Analysis
- max time kernel
94s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_bc3797db5dfdb59823cefea4b471023f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_bc3797db5dfdb59823cefea4b471023f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_bc3797db5dfdb59823cefea4b471023f_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260810-wxpjdaep7v
- SHA256 bf23f10979b1785ab9421acc8f37c4d86e9faf5e6b42310be308226be8b72553
- MD5 bc3797db5dfdb59823cefea4b471023f
- SHA1 b7b46d92cc6fe9569554aafe376f191bb2a16cf3
- SHA512 4fae9746322b7c1e5f43fa2fd005ab206cb6a1dbd0cd95770c77bc7044d9daf4d24f3c55a03fa9e2ddc8044569b3fa5c357a83eab4368bf9a4f2fff560ae3e60
- SSDEEP 12288:wU5rCOTeiDiwbVg8koFEp0Yem4cUlPNZ+3/v+I9hUG2VA:wUQOJDiwRbkaEp1emUlPNGEA
- TLSH T134E4D02177D8C532E9FB037859B5E6614D7EBD226721D6CF6F8012AE0971BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5072 526.tmp 1092 5E2.tmp 5092 68E.tmp 2492 72A.tmp 5940 7C6.tmp 4180 891.tmp 4288 93D.tmp 5200 9CA.tmp 4140 A85.tmp 5872 C5A.tmp 5652 D25.tmp 2452 E00.tmp 5788 ECB.tmp 2508 F77.tmp 4508 1013.tmp 2876 10B0.tmp 5792 115B.tmp 5420 11D8.tmp 108 1294.tmp 1540 1330.tmp 3428 13FB.tmp 1076 14B7.tmp 3272 15A1.tmp 4480 168C.tmp 4788 1766.tmp 3052 1880.tmp 3224 191C.tmp 2640 19E7.tmp 4352 1AA2.tmp 1856 1B3F.tmp 3420 1BEB.tmp 4732 1CB6.tmp 5924 1D62.tmp 1788 1DFE.tmp 2604 1E7B.tmp 4440 1F17.tmp 5644 1F94.tmp 616 2021.tmp 5836 20BD.tmp 4952 213A.tmp 3092 21B7.tmp 5124 2253.tmp 2360 22D0.tmp 2392 233E.tmp 4636 23DA.tmp 2672 2466.tmp 5712 2503.tmp 1116 259F.tmp 3776 262C.tmp 1160 26B8.tmp 4608 2774.tmp 4488 27F1.tmp 4692 287D.tmp 3404 290A.tmp 5588 2987.tmp 1692 2A04.tmp 5360 2A81.tmp 4524 2AFE.tmp 3556 2B9A.tmp 3880 2C17.tmp 2100 2C85.tmp 3236 2D02.tmp 4924 2D7F.tmp 5080 2E0B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 115B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D73C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4378.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A203.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 334B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C32.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5020 wrote to memory of 5072 5020 2026-08-10_bc3797db5dfdb59823cefea4b471023f_elex_mafia_stealc_tofsee.exe 89 PID 5072 wrote to memory of 1092 5072 526.tmp 90 PID 1092 wrote to memory of 5092 1092 5E2.tmp 91 PID 5092 wrote to memory of 2492 5092 68E.tmp 92 PID 2492 wrote to memory of 5940 2492 72A.tmp 93 PID 5940 wrote to memory of 4180 5940 7C6.tmp 94 PID 4180 wrote to memory of 4288 4180 891.tmp 95 PID 4288 wrote to memory of 5200 4288 93D.tmp 96 PID 5200 wrote to memory of 4140 5200 9CA.tmp 97 PID 4140 wrote to memory of 5872 4140 A85.tmp 98 PID 5872 wrote to memory of 5652 5872 C5A.tmp 99 PID 5652 wrote to memory of 2452 5652 D25.tmp 100 PID 2452 wrote to memory of 5788 2452 E00.tmp 101 PID 5788 wrote to memory of 2508 5788 ECB.tmp 102 PID 2508 wrote to memory of 4508 2508 F77.tmp 103 PID 4508 wrote to memory of 2876 4508 1013.tmp 104 PID 2876 wrote to memory of 5792 2876 10B0.tmp 105 PID 5792 wrote to memory of 5420 5792 115B.tmp 106 PID 5420 wrote to memory of 108 5420 11D8.tmp 107 PID 108 wrote to memory of 1540 108 1294.tmp 108 PID 1540 wrote to memory of 3428 1540 1330.tmp 109 PID 3428 wrote to memory of 1076 3428 13FB.tmp 110 PID 1076 wrote to memory of 3272 1076 14B7.tmp 111 PID 3272 wrote to memory of 4480 3272 15A1.tmp 112 PID 4480 wrote to memory of 4788 4480 168C.tmp 113 PID 4788 wrote to memory of 3052 4788 1766.tmp 114 PID 3052 wrote to memory of 3224 3052 1880.tmp 115 PID 3224 wrote to memory of 2640 3224 191C.tmp 116 PID 2640 wrote to memory of 4352 2640 19E7.tmp 117 PID 4352 wrote to memory of 1856 4352 1AA2.tmp 118 PID 1856 wrote to memory of 3420 1856 1B3F.tmp 119 PID 3420 wrote to memory of 4732 3420 1BEB.tmp 120 PID 4732 wrote to memory of 5924 4732 1CB6.tmp 121 PID 5924 wrote to memory of 1788 5924 1D62.tmp 122 PID 1788 wrote to memory of 2604 1788 1DFE.tmp 123 PID 2604 wrote to memory of 4440 2604 1E7B.tmp 124 PID 4440 wrote to memory of 5644 4440 1F17.tmp 125 PID 5644 wrote to memory of 616 5644 1F94.tmp 126 PID 616 wrote to memory of 5836 616 2021.tmp 127 PID 5836 wrote to memory of 4952 5836 20BD.tmp 128 PID 4952 wrote to memory of 3092 4952 213A.tmp 129 PID 3092 wrote to memory of 5124 3092 21B7.tmp 130 PID 5124 wrote to memory of 2360 5124 2253.tmp 131 PID 2360 wrote to memory of 2392 2360 22D0.tmp 132 PID 2392 wrote to memory of 4636 2392 233E.tmp 133 PID 4636 wrote to memory of 2672 4636 23DA.tmp 134 PID 2672 wrote to memory of 5712 2672 2466.tmp 135 PID 5712 wrote to memory of 1116 5712 2503.tmp 136 PID 1116 wrote to memory of 3776 1116 259F.tmp 137 PID 3776 wrote to memory of 1160 3776 262C.tmp 138 PID 1160 wrote to memory of 4608 1160 26B8.tmp 139 PID 4608 wrote to memory of 4488 4608 2774.tmp 140 PID 4488 wrote to memory of 4692 4488 27F1.tmp 141 PID 4692 wrote to memory of 3404 4692 287D.tmp 142 PID 3404 wrote to memory of 5588 3404 290A.tmp 143 PID 5588 wrote to memory of 1692 5588 2987.tmp 144 PID 1692 wrote to memory of 5360 1692 2A04.tmp 145 PID 5360 wrote to memory of 4524 5360 2A81.tmp 146 PID 4524 wrote to memory of 3556 4524 2AFE.tmp 147 PID 3556 wrote to memory of 3880 3556 2B9A.tmp 148 PID 3880 wrote to memory of 2100 3880 2C17.tmp 149 PID 2100 wrote to memory of 3236 2100 2C85.tmp 150 PID 3236 wrote to memory of 4924 3236 2D02.tmp 151 PID 4924 wrote to memory of 5080 4924 2D7F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_bc3797db5dfdb59823cefea4b471023f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bc3797db5dfdb59823cefea4b471023f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\72A.tmp"C:\Users\Admin\AppData\Local\Temp\72A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\891.tmp"C:\Users\Admin\AppData\Local\Temp\891.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\E00.tmp"C:\Users\Admin\AppData\Local\Temp\E00.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\115B.tmp"C:\Users\Admin\AppData\Local\Temp\115B.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\14B7.tmp"C:\Users\Admin\AppData\Local\Temp\14B7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\168C.tmp"C:\Users\Admin\AppData\Local\Temp\168C.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\1D62.tmp"C:\Users\Admin\AppData\Local\Temp\1D62.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1F17.tmp"C:\Users\Admin\AppData\Local\Temp\1F17.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\1F94.tmp"C:\Users\Admin\AppData\Local\Temp\1F94.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\213A.tmp"C:\Users\Admin\AppData\Local\Temp\213A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\22D0.tmp"C:\Users\Admin\AppData\Local\Temp\22D0.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\233E.tmp"C:\Users\Admin\AppData\Local\Temp\233E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\23DA.tmp"C:\Users\Admin\AppData\Local\Temp\23DA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2774.tmp"C:\Users\Admin\AppData\Local\Temp\2774.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\287D.tmp"C:\Users\Admin\AppData\Local\Temp\287D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2987.tmp"C:\Users\Admin\AppData\Local\Temp\2987.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2D02.tmp"C:\Users\Admin\AppData\Local\Temp\2D02.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"66⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"67⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"68⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:832 -
C:\Users\Admin\AppData\Local\Temp\307C.tmp"C:\Users\Admin\AppData\Local\Temp\307C.tmp"70⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\30F9.tmp"C:\Users\Admin\AppData\Local\Temp\30F9.tmp"71⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"72⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\31E4.tmp"C:\Users\Admin\AppData\Local\Temp\31E4.tmp"73⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3251.tmp"C:\Users\Admin\AppData\Local\Temp\3251.tmp"74⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\32CE.tmp"C:\Users\Admin\AppData\Local\Temp\32CE.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"77⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"78⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"79⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"80⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"81⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"82⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"83⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"84⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"85⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"86⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"87⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"89⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"90⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"91⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"92⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"93⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"95⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"96⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"97⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"98⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"99⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\4155.tmp"C:\Users\Admin\AppData\Local\Temp\4155.tmp"100⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"101⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"102⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"104⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"105⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"106⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\45E9.tmp"C:\Users\Admin\AppData\Local\Temp\45E9.tmp"107⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"109⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"110⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"111⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"112⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"113⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"114⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"115⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4B96.tmp"C:\Users\Admin\AppData\Local\Temp\4B96.tmp"116⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"117⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"118⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"119⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"120⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\4F4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F4F.tmp"122⤵PID:4300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-