Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260928-e1f8qsvs3j
- SHA256 8c80204d81efd2aa45dda97158ccec1e05774deddaeab9d15e48020ec1cd0ef4
- MD5 7709f8e58e4705ac1ce5522becfa2999
- SHA1 0a17f353d0d0cad4f77a0c93cc55044fc12408fd
- SHA512 59a05347af6b1796ae1fb9f66d1ca7972175c701c7c44678510cf0232ca7fa98bf863e14ac84f640bc6c44aed10319387623bfc6d6968e5e7d2ef2e629adbc78
- SSDEEP 12288:NU5rCOTeijLGZG154NGRhfGjV3yIlO7JXTZwlH:NUQOJjLFVhOp3g5TSlH
- TLSH T1A4B4E026B684C133E69202750AE6EBB22D3B7D35172694C32BD4627D2FB07E2D775306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3352 3399.tmp 3540 3435.tmp 3748 3510.tmp 5544 357D.tmp 4536 3629.tmp 4492 36C6.tmp 3256 3781.tmp 4100 380E.tmp 6124 38AA.tmp 3468 3937.tmp 3284 39B4.tmp 1204 3A6F.tmp 3140 3B2B.tmp 4944 3BC7.tmp 204 3C34.tmp 252 3CD0.tmp 2888 3D7C.tmp 3940 3DF9.tmp 5828 3E76.tmp 6028 3EF3.tmp 5552 3FBE.tmp 2868 405B.tmp 5428 40E7.tmp 3276 4164.tmp 840 41F1.tmp 1552 428D.tmp 752 42FB.tmp 1720 4387.tmp 1236 4443.tmp 3800 451D.tmp 1172 45F8.tmp 1580 46E3.tmp 2656 47CD.tmp 5784 485A.tmp 2556 48C7.tmp 5388 4954.tmp 1888 49B1.tmp 2356 4A3E.tmp 4680 4AAB.tmp 4212 4B38.tmp 2380 4BA5.tmp 1548 4C32.tmp 4292 4C9F.tmp 2732 4D2C.tmp 4068 4DA9.tmp 3056 4E26.tmp 1660 4E93.tmp 4704 4F10.tmp 2932 4F8D.tmp 1448 500A.tmp 1440 5097.tmp 3572 5124.tmp 4652 51A1.tmp 2192 51FE.tmp 5816 526C.tmp 3928 52E9.tmp 1416 5366.tmp 2740 53D3.tmp 4264 5440.tmp 4360 54BD.tmp 5508 552B.tmp 772 5598.tmp 2328 5634.tmp 1728 56A2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 610D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 733D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 121D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E97C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 3352 2012 2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe 89 PID 3352 wrote to memory of 3540 3352 3399.tmp 90 PID 3540 wrote to memory of 3748 3540 3435.tmp 91 PID 3748 wrote to memory of 5544 3748 3510.tmp 92 PID 5544 wrote to memory of 4536 5544 357D.tmp 93 PID 4536 wrote to memory of 4492 4536 3629.tmp 94 PID 4492 wrote to memory of 3256 4492 36C6.tmp 95 PID 3256 wrote to memory of 4100 3256 3781.tmp 96 PID 4100 wrote to memory of 6124 4100 380E.tmp 97 PID 6124 wrote to memory of 3468 6124 38AA.tmp 98 PID 3468 wrote to memory of 3284 3468 3937.tmp 99 PID 3284 wrote to memory of 1204 3284 39B4.tmp 100 PID 1204 wrote to memory of 3140 1204 3A6F.tmp 101 PID 3140 wrote to memory of 4944 3140 3B2B.tmp 102 PID 4944 wrote to memory of 204 4944 3BC7.tmp 103 PID 204 wrote to memory of 252 204 3C34.tmp 104 PID 252 wrote to memory of 2888 252 3CD0.tmp 105 PID 2888 wrote to memory of 3940 2888 3D7C.tmp 106 PID 3940 wrote to memory of 5828 3940 3DF9.tmp 107 PID 5828 wrote to memory of 6028 5828 3E76.tmp 108 PID 6028 wrote to memory of 5552 6028 3EF3.tmp 109 PID 5552 wrote to memory of 2868 5552 3FBE.tmp 110 PID 2868 wrote to memory of 5428 2868 405B.tmp 111 PID 5428 wrote to memory of 3276 5428 40E7.tmp 112 PID 3276 wrote to memory of 840 3276 4164.tmp 113 PID 840 wrote to memory of 1552 840 41F1.tmp 114 PID 1552 wrote to memory of 752 1552 428D.tmp 115 PID 752 wrote to memory of 1720 752 42FB.tmp 116 PID 1720 wrote to memory of 1236 1720 4387.tmp 117 PID 1236 wrote to memory of 3800 1236 4443.tmp 118 PID 3800 wrote to memory of 1172 3800 451D.tmp 119 PID 1172 wrote to memory of 1580 1172 45F8.tmp 120 PID 1580 wrote to memory of 2656 1580 46E3.tmp 121 PID 2656 wrote to memory of 5784 2656 47CD.tmp 122 PID 5784 wrote to memory of 2556 5784 485A.tmp 123 PID 2556 wrote to memory of 5388 2556 48C7.tmp 124 PID 5388 wrote to memory of 1888 5388 4954.tmp 125 PID 1888 wrote to memory of 2356 1888 49B1.tmp 126 PID 2356 wrote to memory of 4680 2356 4A3E.tmp 127 PID 4680 wrote to memory of 4212 4680 4AAB.tmp 128 PID 4212 wrote to memory of 2380 4212 4B38.tmp 129 PID 2380 wrote to memory of 1548 2380 4BA5.tmp 130 PID 1548 wrote to memory of 4292 1548 4C32.tmp 131 PID 4292 wrote to memory of 2732 4292 4C9F.tmp 132 PID 2732 wrote to memory of 4068 2732 4D2C.tmp 133 PID 4068 wrote to memory of 3056 4068 4DA9.tmp 134 PID 3056 wrote to memory of 1660 3056 4E26.tmp 135 PID 1660 wrote to memory of 4704 1660 4E93.tmp 136 PID 4704 wrote to memory of 2932 4704 4F10.tmp 137 PID 2932 wrote to memory of 1448 2932 4F8D.tmp 138 PID 1448 wrote to memory of 1440 1448 500A.tmp 139 PID 1440 wrote to memory of 3572 1440 5097.tmp 140 PID 3572 wrote to memory of 4652 3572 5124.tmp 141 PID 4652 wrote to memory of 2192 4652 51A1.tmp 142 PID 2192 wrote to memory of 5816 2192 51FE.tmp 143 PID 5816 wrote to memory of 3928 5816 526C.tmp 144 PID 3928 wrote to memory of 1416 3928 52E9.tmp 145 PID 1416 wrote to memory of 2740 1416 5366.tmp 146 PID 2740 wrote to memory of 4264 2740 53D3.tmp 147 PID 4264 wrote to memory of 4360 4264 5440.tmp 148 PID 4360 wrote to memory of 5508 4360 54BD.tmp 149 PID 5508 wrote to memory of 772 5508 552B.tmp 150 PID 772 wrote to memory of 2328 772 5598.tmp 151 PID 2328 wrote to memory of 1728 2328 5634.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_7709f8e58e4705ac1ce5522becfa2999_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\3629.tmp"C:\Users\Admin\AppData\Local\Temp\3629.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\380E.tmp"C:\Users\Admin\AppData\Local\Temp\380E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\38AA.tmp"C:\Users\Admin\AppData\Local\Temp\38AA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\39B4.tmp"C:\Users\Admin\AppData\Local\Temp\39B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\41F1.tmp"C:\Users\Admin\AppData\Local\Temp\41F1.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\42FB.tmp"C:\Users\Admin\AppData\Local\Temp\42FB.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\45F8.tmp"C:\Users\Admin\AppData\Local\Temp\45F8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\46E3.tmp"C:\Users\Admin\AppData\Local\Temp\46E3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\485A.tmp"C:\Users\Admin\AppData\Local\Temp\485A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4954.tmp"C:\Users\Admin\AppData\Local\Temp\4954.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4C32.tmp"C:\Users\Admin\AppData\Local\Temp\4C32.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4F10.tmp"C:\Users\Admin\AppData\Local\Temp\4F10.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\53D3.tmp"C:\Users\Admin\AppData\Local\Temp\53D3.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\54BD.tmp"C:\Users\Admin\AppData\Local\Temp\54BD.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\56A2.tmp"C:\Users\Admin\AppData\Local\Temp\56A2.tmp"65⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"66⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\577D.tmp"C:\Users\Admin\AppData\Local\Temp\577D.tmp"67⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\57EA.tmp"C:\Users\Admin\AppData\Local\Temp\57EA.tmp"68⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\5867.tmp"C:\Users\Admin\AppData\Local\Temp\5867.tmp"69⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"71⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\59BF.tmp"C:\Users\Admin\AppData\Local\Temp\59BF.tmp"72⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"73⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"74⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5B55.tmp"C:\Users\Admin\AppData\Local\Temp\5B55.tmp"75⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"76⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"77⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"78⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\5D39.tmp"C:\Users\Admin\AppData\Local\Temp\5D39.tmp"79⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"80⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"81⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5E81.tmp"C:\Users\Admin\AppData\Local\Temp\5E81.tmp"82⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"83⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"84⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"85⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6066.tmp"C:\Users\Admin\AppData\Local\Temp\6066.tmp"86⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"88⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\61BE.tmp"C:\Users\Admin\AppData\Local\Temp\61BE.tmp"89⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"90⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\62B8.tmp"C:\Users\Admin\AppData\Local\Temp\62B8.tmp"91⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\6335.tmp"C:\Users\Admin\AppData\Local\Temp\6335.tmp"92⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\63B2.tmp"C:\Users\Admin\AppData\Local\Temp\63B2.tmp"93⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\641F.tmp"C:\Users\Admin\AppData\Local\Temp\641F.tmp"94⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"95⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\6509.tmp"C:\Users\Admin\AppData\Local\Temp\6509.tmp"96⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"97⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"98⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"99⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"100⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"101⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\679A.tmp"C:\Users\Admin\AppData\Local\Temp\679A.tmp"102⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6807.tmp"C:\Users\Admin\AppData\Local\Temp\6807.tmp"103⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"104⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\68D2.tmp"C:\Users\Admin\AppData\Local\Temp\68D2.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\694F.tmp"C:\Users\Admin\AppData\Local\Temp\694F.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\69BC.tmp"C:\Users\Admin\AppData\Local\Temp\69BC.tmp"107⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"108⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6A97.tmp"C:\Users\Admin\AppData\Local\Temp\6A97.tmp"109⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"110⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\6B82.tmp"C:\Users\Admin\AppData\Local\Temp\6B82.tmp"111⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"112⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"113⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"114⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6D47.tmp"C:\Users\Admin\AppData\Local\Temp\6D47.tmp"115⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"116⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"117⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"118⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"119⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\6F79.tmp"C:\Users\Admin\AppData\Local\Temp\6F79.tmp"120⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"121⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"122⤵PID:5408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-