Analysis
- max time kernel
120s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_0377d4cdfd852b4598678c18f9e3ef38_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_0377d4cdfd852b4598678c18f9e3ef38_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-11_0377d4cdfd852b4598678c18f9e3ef38_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260811-eknymsfp2t
- SHA256 afb9c27a6f67d5d8656a1e9f7f4377a9b95f5e07f0779c2048eb25ee87769d34
- MD5 0377d4cdfd852b4598678c18f9e3ef38
- SHA1 fb37c9825530a79ad7b553ab21a5e87392de08f3
- SHA512 05f0bd54ab9c8890b2b288747ad10bb3dd65ecac4327bacfe6341b79adb5d8e8ba31fd28926e60e312c4ab3e328499816572b550cdbc7fb664e1ae030b02d76e
- SSDEEP 12288:NU5rCOTeij7Wz5P/ABadfIGoidqAFTZwlH:NUQOJjyz53usfoqqAFTSlH
- TLSH T12FB4F025BA85C032E69301714ED6EBB2693B7D355726A8C32B84676E2FB13D1D379303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3320 EB50.tmp 2400 ECA8.tmp 3436 ED83.tmp 2168 EE4E.tmp 1528 EEFA.tmp 2256 EFE4.tmp 2360 F17A.tmp 1964 F255.tmp 1768 F2E2.tmp 5392 F3FB.tmp 4144 F4D6.tmp 4004 F5C0.tmp 2020 F66C.tmp 3984 F766.tmp 2808 F87F.tmp 5044 F96A.tmp 3960 FA25.tmp 4124 FB1F.tmp 3972 FC48.tmp 4228 FD61.tmp 5032 FE0D.tmp 2116 FEB9.tmp 2776 FF84.tmp 4764 8E.tmp 2100 159.tmp 3460 253.tmp 1484 31E.tmp 5840 408.tmp 4832 4C4.tmp 708 5AE.tmp 3796 65A.tmp 4436 6F6.tmp 5356 7B2.tmp 1688 81F.tmp 5092 8AC.tmp 5596 977.tmp 2228 A04.tmp 992 AA0.tmp 2264 B1D.tmp 5060 BB9.tmp 1620 C55.tmp 4560 CE2.tmp 4156 D6F.tmp 480 DFB.tmp 4556 EB7.tmp 484 F53.tmp 1668 FEF.tmp 2332 10AB.tmp 5752 1147.tmp 1148 11D4.tmp 4768 1270.tmp 1232 132B.tmp 5492 13B8.tmp 2604 1445.tmp 5056 14D1.tmp 1356 157D.tmp 5952 1619.tmp 4396 16A6.tmp 4188 1723.tmp 944 17DF.tmp 2672 184C.tmp 4008 18E8.tmp 3644 1984.tmp 3936 1A21.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A535.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 184C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A75D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 539F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 218E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C564.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 3320 4140 2026-08-11_0377d4cdfd852b4598678c18f9e3ef38_elex_mafia_stealc_tofsee.exe 88 PID 3320 wrote to memory of 2400 3320 EB50.tmp 90 PID 2400 wrote to memory of 3436 2400 ECA8.tmp 91 PID 3436 wrote to memory of 2168 3436 ED83.tmp 92 PID 2168 wrote to memory of 1528 2168 EE4E.tmp 93 PID 1528 wrote to memory of 2256 1528 EEFA.tmp 94 PID 2256 wrote to memory of 2360 2256 EFE4.tmp 95 PID 2360 wrote to memory of 1964 2360 F17A.tmp 96 PID 1964 wrote to memory of 1768 1964 F255.tmp 97 PID 1768 wrote to memory of 5392 1768 F2E2.tmp 98 PID 5392 wrote to memory of 4144 5392 F3FB.tmp 99 PID 4144 wrote to memory of 4004 4144 F4D6.tmp 100 PID 4004 wrote to memory of 2020 4004 F5C0.tmp 101 PID 2020 wrote to memory of 3984 2020 F66C.tmp 102 PID 3984 wrote to memory of 2808 3984 F766.tmp 103 PID 2808 wrote to memory of 5044 2808 F87F.tmp 104 PID 5044 wrote to memory of 3960 5044 F96A.tmp 105 PID 3960 wrote to memory of 4124 3960 FA25.tmp 106 PID 4124 wrote to memory of 3972 4124 FB1F.tmp 107 PID 3972 wrote to memory of 4228 3972 FC48.tmp 108 PID 4228 wrote to memory of 5032 4228 FD61.tmp 109 PID 5032 wrote to memory of 2116 5032 FE0D.tmp 110 PID 2116 wrote to memory of 2776 2116 FEB9.tmp 111 PID 2776 wrote to memory of 4764 2776 FF84.tmp 112 PID 4764 wrote to memory of 2100 4764 8E.tmp 113 PID 2100 wrote to memory of 3460 2100 159.tmp 114 PID 3460 wrote to memory of 1484 3460 253.tmp 115 PID 1484 wrote to memory of 5840 1484 31E.tmp 116 PID 5840 wrote to memory of 4832 5840 408.tmp 117 PID 4832 wrote to memory of 708 4832 4C4.tmp 118 PID 708 wrote to memory of 3796 708 5AE.tmp 119 PID 3796 wrote to memory of 4436 3796 65A.tmp 120 PID 4436 wrote to memory of 5356 4436 6F6.tmp 121 PID 5356 wrote to memory of 1688 5356 7B2.tmp 122 PID 1688 wrote to memory of 5092 1688 81F.tmp 123 PID 5092 wrote to memory of 5596 5092 8AC.tmp 124 PID 5596 wrote to memory of 2228 5596 977.tmp 125 PID 2228 wrote to memory of 992 2228 A04.tmp 126 PID 992 wrote to memory of 2264 992 AA0.tmp 127 PID 2264 wrote to memory of 5060 2264 B1D.tmp 128 PID 5060 wrote to memory of 1620 5060 BB9.tmp 129 PID 1620 wrote to memory of 4560 1620 C55.tmp 130 PID 4560 wrote to memory of 4156 4560 CE2.tmp 131 PID 4156 wrote to memory of 480 4156 D6F.tmp 132 PID 480 wrote to memory of 4556 480 DFB.tmp 133 PID 4556 wrote to memory of 484 4556 EB7.tmp 134 PID 484 wrote to memory of 1668 484 F53.tmp 135 PID 1668 wrote to memory of 2332 1668 FEF.tmp 136 PID 2332 wrote to memory of 5752 2332 10AB.tmp 137 PID 5752 wrote to memory of 1148 5752 1147.tmp 138 PID 1148 wrote to memory of 4768 1148 11D4.tmp 139 PID 4768 wrote to memory of 1232 4768 1270.tmp 140 PID 1232 wrote to memory of 5492 1232 132B.tmp 141 PID 5492 wrote to memory of 2604 5492 13B8.tmp 142 PID 2604 wrote to memory of 5056 2604 1445.tmp 143 PID 5056 wrote to memory of 1356 5056 14D1.tmp 144 PID 1356 wrote to memory of 5952 1356 157D.tmp 145 PID 5952 wrote to memory of 4396 5952 1619.tmp 146 PID 4396 wrote to memory of 4188 4396 16A6.tmp 147 PID 4188 wrote to memory of 944 4188 1723.tmp 148 PID 944 wrote to memory of 2672 944 17DF.tmp 149 PID 2672 wrote to memory of 4008 2672 184C.tmp 150 PID 4008 wrote to memory of 3644 4008 18E8.tmp 151 PID 3644 wrote to memory of 3936 3644 1984.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_0377d4cdfd852b4598678c18f9e3ef38_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_0377d4cdfd852b4598678c18f9e3ef38_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\F17A.tmp"C:\Users\Admin\AppData\Local\Temp\F17A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F255.tmp"C:\Users\Admin\AppData\Local\Temp\F255.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F96A.tmp"C:\Users\Admin\AppData\Local\Temp\F96A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\8E.tmp"C:\Users\Admin\AppData\Local\Temp\8E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\253.tmp"C:\Users\Admin\AppData\Local\Temp\253.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\6F6.tmp"C:\Users\Admin\AppData\Local\Temp\6F6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\7B2.tmp"C:\Users\Admin\AppData\Local\Temp\7B2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\8AC.tmp"C:\Users\Admin\AppData\Local\Temp\8AC.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\A04.tmp"C:\Users\Admin\AppData\Local\Temp\A04.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\AA0.tmp"C:\Users\Admin\AppData\Local\Temp\AA0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\BB9.tmp"C:\Users\Admin\AppData\Local\Temp\BB9.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C55.tmp"C:\Users\Admin\AppData\Local\Temp\C55.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\D6F.tmp"C:\Users\Admin\AppData\Local\Temp\D6F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\F53.tmp"C:\Users\Admin\AppData\Local\Temp\F53.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\FEF.tmp"C:\Users\Admin\AppData\Local\Temp\FEF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1270.tmp"C:\Users\Admin\AppData\Local\Temp\1270.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\132B.tmp"C:\Users\Admin\AppData\Local\Temp\132B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\16A6.tmp"C:\Users\Admin\AppData\Local\Temp\16A6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\1984.tmp"C:\Users\Admin\AppData\Local\Temp\1984.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"65⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"66⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\1B78.tmp"C:\Users\Admin\AppData\Local\Temp\1B78.tmp"67⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"68⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"69⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\1D4D.tmp"C:\Users\Admin\AppData\Local\Temp\1D4D.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"71⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"72⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"73⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"74⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"75⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"77⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\225E.tmp"C:\Users\Admin\AppData\Local\Temp\225E.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"79⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"80⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"82⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"83⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"84⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"85⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\2721.tmp"C:\Users\Admin\AppData\Local\Temp\2721.tmp"86⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"87⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"88⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2915.tmp"C:\Users\Admin\AppData\Local\Temp\2915.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\29D0.tmp"C:\Users\Admin\AppData\Local\Temp\29D0.tmp"90⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"91⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"92⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\2B57.tmp"C:\Users\Admin\AppData\Local\Temp\2B57.tmp"93⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2C12.tmp"C:\Users\Admin\AppData\Local\Temp\2C12.tmp"94⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"95⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"96⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"97⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2E55.tmp"C:\Users\Admin\AppData\Local\Temp\2E55.tmp"98⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"99⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\2F6E.tmp"C:\Users\Admin\AppData\Local\Temp\2F6E.tmp"100⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\300A.tmp"C:\Users\Admin\AppData\Local\Temp\300A.tmp"101⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\30B6.tmp"C:\Users\Admin\AppData\Local\Temp\30B6.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\3171.tmp"C:\Users\Admin\AppData\Local\Temp\3171.tmp"103⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\321D.tmp"C:\Users\Admin\AppData\Local\Temp\321D.tmp"104⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\32BA.tmp"C:\Users\Admin\AppData\Local\Temp\32BA.tmp"105⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\3346.tmp"C:\Users\Admin\AppData\Local\Temp\3346.tmp"106⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\33D3.tmp"C:\Users\Admin\AppData\Local\Temp\33D3.tmp"107⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\345F.tmp"C:\Users\Admin\AppData\Local\Temp\345F.tmp"108⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\351B.tmp"C:\Users\Admin\AppData\Local\Temp\351B.tmp"109⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\35D6.tmp"C:\Users\Admin\AppData\Local\Temp\35D6.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\3653.tmp"C:\Users\Admin\AppData\Local\Temp\3653.tmp"111⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\36F0.tmp"C:\Users\Admin\AppData\Local\Temp\36F0.tmp"112⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\376D.tmp"C:\Users\Admin\AppData\Local\Temp\376D.tmp"113⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\37F9.tmp"C:\Users\Admin\AppData\Local\Temp\37F9.tmp"114⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\3886.tmp"C:\Users\Admin\AppData\Local\Temp\3886.tmp"115⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\38F3.tmp"C:\Users\Admin\AppData\Local\Temp\38F3.tmp"116⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\3970.tmp"C:\Users\Admin\AppData\Local\Temp\3970.tmp"117⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\3A1C.tmp"C:\Users\Admin\AppData\Local\Temp\3A1C.tmp"118⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\3AA9.tmp"C:\Users\Admin\AppData\Local\Temp\3AA9.tmp"119⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\3B84.tmp"C:\Users\Admin\AppData\Local\Temp\3B84.tmp"120⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3C10.tmp"C:\Users\Admin\AppData\Local\Temp\3C10.tmp"121⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"122⤵PID:1556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-