Analysis
- max time kernel
132s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_ebd571b6fc5e1e08d668f35d7ee73573_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 2026-08-27_ebd571b6fc5e1e08d668f35d7ee73573_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260828-dfdrfaen5t
- SHA256 429f2abc561ec3399653e615b11138624f41c44241017f85a0bf0ecb3006ed7a
- MD5 ebd571b6fc5e1e08d668f35d7ee73573
- SHA1 c90c8c0eab8f91ad1330712440f66ba74998c4c2
- SHA512 8e5b1ab42fadc0a7a383690935468dd5d7e42484f028d98b8eab9c73058d7a924315fe3f51ce3f07a489dab9f1a4ba4e37561e0d55799202cd69233de868b42f
- SSDEEP 12288:wU5rCOTeiDi+GIYvMHRt3Z43FWKJHzavB50+MCEmMNZ+3/v+I9hUG2VA:wUQOJDzGIYwnEWKpWXnMvmMNGEA
- TLSH T159E4D12177D88532E5FB037859B5F6654A7EBD226712D6CF6F8012BE0AB1BD08631323
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/5956-7-0x00000000009F0000-0x0000000000A73000-memory.dmp family_stealc_v3 - Executes dropped EXE 64 IoCs
pid Process 3792 DF79.tmp 4364 E0E0.tmp 3336 E2B5.tmp 2308 E351.tmp 632 E3AF.tmp 1440 E584.tmp 5324 E68E.tmp 5908 E768.tmp 4912 E862.tmp 5996 E94D.tmp 4308 EA47.tmp 2752 EB31.tmp 6084 EC0C.tmp 5068 ED35.tmp 3120 EE1F.tmp 1784 EF19.tmp 4972 F023.tmp 1084 F12C.tmp 5648 F236.tmp 6124 F340.tmp 5732 F42A.tmp 2204 F553.tmp 2200 F65C.tmp 3148 F776.tmp 5656 F850.tmp 5004 F94A.tmp 5936 FA25.tmp 4848 FB00.tmp 3724 FBBB.tmp 3712 FD13.tmp 1744 FE0D.tmp 2352 FEE8.tmp 4884 FFF2.tmp 2840 BD.tmp 4192 159.tmp 536 1F5.tmp 1648 2A1.tmp 2504 35D.tmp 5944 408.tmp 6064 4C4.tmp 6000 570.tmp 1416 60C.tmp 5160 6D7.tmp 4644 793.tmp 1200 85E.tmp 1740 8EA.tmp 4756 9A6.tmp 4336 A33.tmp 4436 A90.tmp 2936 B1D.tmp 2220 B8A.tmp 3096 C07.tmp 4588 C65.tmp 4952 CD2.tmp 1964 D40.tmp 2416 DBD.tmp 5672 E1B.tmp 1320 E98.tmp 2720 F15.tmp 4384 F82.tmp 4176 100F.tmp 2824 108C.tmp 4380 10F9.tmp 3532 1176.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 876C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 346A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D53E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D34F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE59.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5956 wrote to memory of 3792 5956 2026-08-27_ebd571b6fc5e1e08d668f35d7ee73573_elex_mafia_stealc_tofsee.exe 88 PID 3792 wrote to memory of 4364 3792 DF79.tmp 89 PID 4364 wrote to memory of 3336 4364 E0E0.tmp 90 PID 3336 wrote to memory of 2308 3336 E2B5.tmp 91 PID 2308 wrote to memory of 632 2308 E351.tmp 92 PID 632 wrote to memory of 1440 632 E3AF.tmp 93 PID 1440 wrote to memory of 5324 1440 E584.tmp 94 PID 5324 wrote to memory of 5908 5324 E68E.tmp 95 PID 5908 wrote to memory of 4912 5908 E768.tmp 96 PID 4912 wrote to memory of 5996 4912 E862.tmp 97 PID 5996 wrote to memory of 4308 5996 E94D.tmp 98 PID 4308 wrote to memory of 2752 4308 EA47.tmp 99 PID 2752 wrote to memory of 6084 2752 EB31.tmp 100 PID 6084 wrote to memory of 5068 6084 EC0C.tmp 101 PID 5068 wrote to memory of 3120 5068 ED35.tmp 102 PID 3120 wrote to memory of 1784 3120 EE1F.tmp 103 PID 1784 wrote to memory of 4972 1784 EF19.tmp 104 PID 4972 wrote to memory of 1084 4972 F023.tmp 105 PID 1084 wrote to memory of 5648 1084 F12C.tmp 106 PID 5648 wrote to memory of 6124 5648 F236.tmp 107 PID 6124 wrote to memory of 5732 6124 F340.tmp 108 PID 5732 wrote to memory of 2204 5732 F42A.tmp 109 PID 2204 wrote to memory of 2200 2204 F553.tmp 110 PID 2200 wrote to memory of 3148 2200 F65C.tmp 111 PID 3148 wrote to memory of 5656 3148 F776.tmp 112 PID 5656 wrote to memory of 5004 5656 F850.tmp 113 PID 5004 wrote to memory of 5936 5004 F94A.tmp 114 PID 5936 wrote to memory of 4848 5936 FA25.tmp 115 PID 4848 wrote to memory of 3724 4848 FB00.tmp 116 PID 3724 wrote to memory of 3712 3724 FBBB.tmp 117 PID 3712 wrote to memory of 1744 3712 FD13.tmp 118 PID 1744 wrote to memory of 2352 1744 FE0D.tmp 119 PID 2352 wrote to memory of 4884 2352 FEE8.tmp 120 PID 4884 wrote to memory of 2840 4884 FFF2.tmp 121 PID 2840 wrote to memory of 4192 2840 BD.tmp 122 PID 4192 wrote to memory of 536 4192 159.tmp 123 PID 536 wrote to memory of 1648 536 1F5.tmp 124 PID 1648 wrote to memory of 2504 1648 2A1.tmp 125 PID 2504 wrote to memory of 5944 2504 35D.tmp 126 PID 5944 wrote to memory of 6064 5944 408.tmp 127 PID 6064 wrote to memory of 6000 6064 4C4.tmp 128 PID 6000 wrote to memory of 1416 6000 570.tmp 129 PID 1416 wrote to memory of 5160 1416 60C.tmp 130 PID 5160 wrote to memory of 4644 5160 6D7.tmp 131 PID 4644 wrote to memory of 1200 4644 793.tmp 132 PID 1200 wrote to memory of 1740 1200 85E.tmp 133 PID 1740 wrote to memory of 4756 1740 8EA.tmp 134 PID 4756 wrote to memory of 4336 4756 9A6.tmp 135 PID 4336 wrote to memory of 4436 4336 A33.tmp 136 PID 4436 wrote to memory of 2936 4436 A90.tmp 137 PID 2936 wrote to memory of 2220 2936 B1D.tmp 138 PID 2220 wrote to memory of 3096 2220 B8A.tmp 139 PID 3096 wrote to memory of 4588 3096 C07.tmp 140 PID 4588 wrote to memory of 4952 4588 C65.tmp 141 PID 4952 wrote to memory of 1964 4952 CD2.tmp 142 PID 1964 wrote to memory of 2416 1964 D40.tmp 143 PID 2416 wrote to memory of 5672 2416 DBD.tmp 144 PID 5672 wrote to memory of 1320 5672 E1B.tmp 145 PID 1320 wrote to memory of 2720 1320 E98.tmp 146 PID 2720 wrote to memory of 4384 2720 F15.tmp 147 PID 4384 wrote to memory of 4176 4384 F82.tmp 148 PID 4176 wrote to memory of 2824 4176 100F.tmp 149 PID 2824 wrote to memory of 4380 2824 108C.tmp 150 PID 4380 wrote to memory of 3532 4380 10F9.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_ebd571b6fc5e1e08d668f35d7ee73573_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ebd571b6fc5e1e08d668f35d7ee73573_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\E351.tmp"C:\Users\Admin\AppData\Local\Temp\E351.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\E584.tmp"C:\Users\Admin\AppData\Local\Temp\E584.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\E768.tmp"C:\Users\Admin\AppData\Local\Temp\E768.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\EB31.tmp"C:\Users\Admin\AppData\Local\Temp\EB31.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\ED35.tmp"C:\Users\Admin\AppData\Local\Temp\ED35.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\F12C.tmp"C:\Users\Admin\AppData\Local\Temp\F12C.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\F340.tmp"C:\Users\Admin\AppData\Local\Temp\F340.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\F42A.tmp"C:\Users\Admin\AppData\Local\Temp\F42A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\F850.tmp"C:\Users\Admin\AppData\Local\Temp\F850.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\FB00.tmp"C:\Users\Admin\AppData\Local\Temp\FB00.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\BD.tmp"C:\Users\Admin\AppData\Local\Temp\BD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2A1.tmp"C:\Users\Admin\AppData\Local\Temp\2A1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\35D.tmp"C:\Users\Admin\AppData\Local\Temp\35D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\570.tmp"C:\Users\Admin\AppData\Local\Temp\570.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\6D7.tmp"C:\Users\Admin\AppData\Local\Temp\6D7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\793.tmp"C:\Users\Admin\AppData\Local\Temp\793.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\8EA.tmp"C:\Users\Admin\AppData\Local\Temp\8EA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\A33.tmp"C:\Users\Admin\AppData\Local\Temp\A33.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"65⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\11F3.tmp"C:\Users\Admin\AppData\Local\Temp\11F3.tmp"66⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\1270.tmp"C:\Users\Admin\AppData\Local\Temp\1270.tmp"67⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\12FD.tmp"C:\Users\Admin\AppData\Local\Temp\12FD.tmp"68⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"69⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\13F7.tmp"C:\Users\Admin\AppData\Local\Temp\13F7.tmp"70⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\1483.tmp"C:\Users\Admin\AppData\Local\Temp\1483.tmp"71⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"72⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"73⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"74⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"75⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\16D5.tmp"C:\Users\Admin\AppData\Local\Temp\16D5.tmp"76⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\1742.tmp"C:\Users\Admin\AppData\Local\Temp\1742.tmp"77⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\17CF.tmp"C:\Users\Admin\AppData\Local\Temp\17CF.tmp"78⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"79⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\18B9.tmp"C:\Users\Admin\AppData\Local\Temp\18B9.tmp"80⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1927.tmp"C:\Users\Admin\AppData\Local\Temp\1927.tmp"81⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"82⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"83⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"85⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"86⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1C05.tmp"C:\Users\Admin\AppData\Local\Temp\1C05.tmp"87⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\1C82.tmp"C:\Users\Admin\AppData\Local\Temp\1C82.tmp"88⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"89⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"90⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"91⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"92⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"93⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"94⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"95⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\200C.tmp"C:\Users\Admin\AppData\Local\Temp\200C.tmp"96⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\207A.tmp"C:\Users\Admin\AppData\Local\Temp\207A.tmp"97⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"98⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2145.tmp"C:\Users\Admin\AppData\Local\Temp\2145.tmp"99⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"100⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\222F.tmp"C:\Users\Admin\AppData\Local\Temp\222F.tmp"101⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"102⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"103⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"104⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"105⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"106⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"107⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"108⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"109⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"110⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"111⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"112⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\279E.tmp"C:\Users\Admin\AppData\Local\Temp\279E.tmp"113⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\282A.tmp"C:\Users\Admin\AppData\Local\Temp\282A.tmp"114⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\2888.tmp"C:\Users\Admin\AppData\Local\Temp\2888.tmp"115⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2905.tmp"C:\Users\Admin\AppData\Local\Temp\2905.tmp"116⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"117⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\29F0.tmp"C:\Users\Admin\AppData\Local\Temp\29F0.tmp"118⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2A5D.tmp"C:\Users\Admin\AppData\Local\Temp\2A5D.tmp"119⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"120⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\2B67.tmp"C:\Users\Admin\AppData\Local\Temp\2B67.tmp"121⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"122⤵PID:3908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-