Analysis
- max time kernel
126s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_6b78b7d5731c38ea08494145d971afe7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_6b78b7d5731c38ea08494145d971afe7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-21_6b78b7d5731c38ea08494145d971afe7_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample261022-2pwklsvtey
- SHA256 f16aa11f0de57ce4a427e9f431e43ab4e1513c6d98b29266c139d50b52243c42
- MD5 6b78b7d5731c38ea08494145d971afe7
- SHA1 d2802a93a8a83c7bb79a9defd54caebeeb1a59c4
- SHA512 884bd73145edd02453b0299672ab605a18583fcdab271e98eafa18c8412a7c610fe0434a0925554c740b3c26caf304e0da1639592aba0ea3be624c8c6110dc91
- SSDEEP 12288:HU5rCOTeiJ+2IMjsu17kHeUBXa9SO7YNZ:HUQOJJLjN1wHezDYN
- TLSH T182B4F021B589C032E5A202354EE6EBB2593BBD315B22A4C76B84777E6FB42D1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3276 D47D.tmp 4048 D519.tmp 4028 D596.tmp 1352 D642.tmp 2256 D6DE.tmp 2588 D7B9.tmp 3556 D893.tmp 5724 D920.tmp 2544 D9AD.tmp 5804 DA97.tmp 3108 DB33.tmp 1532 DC2D.tmp 4896 DC9B.tmp 1400 DD75.tmp 3000 DE02.tmp 1404 DEAE.tmp 4640 DF3B.tmp 2124 DFD7.tmp 3708 E063.tmp 1668 E0F0.tmp 5352 E1AC.tmp 4156 E257.tmp 5116 E303.tmp 6048 E3DE.tmp 3904 E45B.tmp 1096 E4E8.tmp 4632 E5A3.tmp 5080 E630.tmp 2924 E69D.tmp 1772 E71A.tmp 1432 E7A7.tmp 1172 E853.tmp 4936 E8DF.tmp 4244 E94D.tmp 3324 E9BA.tmp 5524 EA37.tmp 4240 EAB4.tmp 1744 EB21.tmp 3232 EB9E.tmp 5516 EC1B.tmp 3400 EC89.tmp 4064 ED25.tmp 1328 EDA2.tmp 5360 EE1F.tmp 1036 EEAC.tmp 788 EF19.tmp 1156 EFB5.tmp 2764 F042.tmp 3044 F0CF.tmp 4380 F13C.tmp 5012 F1A9.tmp 872 F226.tmp 1240 F2A3.tmp 6140 F311.tmp 2420 F38E.tmp 4676 F40B.tmp 5608 F497.tmp 3368 F514.tmp 4684 F582.tmp 3048 F5FF.tmp 2564 F6AB.tmp 5752 F728.tmp 5076 F795.tmp 4924 F802.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 634F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4775.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5669.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 580F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 920B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8837.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 156E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 650F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B62D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 3276 1652 2026-10-21_6b78b7d5731c38ea08494145d971afe7_elex_mafia_stealc_tofsee.exe 88 PID 3276 wrote to memory of 4048 3276 D47D.tmp 89 PID 4048 wrote to memory of 4028 4048 D519.tmp 90 PID 4028 wrote to memory of 1352 4028 D596.tmp 91 PID 1352 wrote to memory of 2256 1352 D642.tmp 92 PID 2256 wrote to memory of 2588 2256 D6DE.tmp 93 PID 2588 wrote to memory of 3556 2588 D7B9.tmp 94 PID 3556 wrote to memory of 5724 3556 D893.tmp 95 PID 5724 wrote to memory of 2544 5724 D920.tmp 96 PID 2544 wrote to memory of 5804 2544 D9AD.tmp 97 PID 5804 wrote to memory of 3108 5804 DA97.tmp 98 PID 3108 wrote to memory of 1532 3108 DB33.tmp 99 PID 1532 wrote to memory of 4896 1532 DC2D.tmp 100 PID 4896 wrote to memory of 1400 4896 DC9B.tmp 101 PID 1400 wrote to memory of 3000 1400 DD75.tmp 102 PID 3000 wrote to memory of 1404 3000 DE02.tmp 103 PID 1404 wrote to memory of 4640 1404 DEAE.tmp 104 PID 4640 wrote to memory of 2124 4640 DF3B.tmp 105 PID 2124 wrote to memory of 3708 2124 DFD7.tmp 106 PID 3708 wrote to memory of 1668 3708 E063.tmp 107 PID 1668 wrote to memory of 5352 1668 E0F0.tmp 108 PID 5352 wrote to memory of 4156 5352 E1AC.tmp 109 PID 4156 wrote to memory of 5116 4156 E257.tmp 110 PID 5116 wrote to memory of 6048 5116 E303.tmp 111 PID 6048 wrote to memory of 3904 6048 E3DE.tmp 112 PID 3904 wrote to memory of 1096 3904 E45B.tmp 113 PID 1096 wrote to memory of 4632 1096 E4E8.tmp 114 PID 4632 wrote to memory of 5080 4632 E5A3.tmp 115 PID 5080 wrote to memory of 2924 5080 E630.tmp 116 PID 2924 wrote to memory of 1772 2924 E69D.tmp 117 PID 1772 wrote to memory of 1432 1772 E71A.tmp 118 PID 1432 wrote to memory of 1172 1432 E7A7.tmp 119 PID 1172 wrote to memory of 4936 1172 E853.tmp 120 PID 4936 wrote to memory of 4244 4936 E8DF.tmp 121 PID 4244 wrote to memory of 3324 4244 E94D.tmp 122 PID 3324 wrote to memory of 5524 3324 E9BA.tmp 123 PID 5524 wrote to memory of 4240 5524 EA37.tmp 124 PID 4240 wrote to memory of 1744 4240 EAB4.tmp 125 PID 1744 wrote to memory of 3232 1744 EB21.tmp 126 PID 3232 wrote to memory of 5516 3232 EB9E.tmp 127 PID 5516 wrote to memory of 3400 5516 EC1B.tmp 128 PID 3400 wrote to memory of 4064 3400 EC89.tmp 129 PID 4064 wrote to memory of 1328 4064 ED25.tmp 130 PID 1328 wrote to memory of 5360 1328 EDA2.tmp 131 PID 5360 wrote to memory of 1036 5360 EE1F.tmp 132 PID 1036 wrote to memory of 788 1036 EEAC.tmp 133 PID 788 wrote to memory of 1156 788 EF19.tmp 134 PID 1156 wrote to memory of 2764 1156 EFB5.tmp 135 PID 2764 wrote to memory of 3044 2764 F042.tmp 136 PID 3044 wrote to memory of 4380 3044 F0CF.tmp 137 PID 4380 wrote to memory of 5012 4380 F13C.tmp 138 PID 5012 wrote to memory of 872 5012 F1A9.tmp 139 PID 872 wrote to memory of 1240 872 F226.tmp 140 PID 1240 wrote to memory of 6140 1240 F2A3.tmp 141 PID 6140 wrote to memory of 2420 6140 F311.tmp 142 PID 2420 wrote to memory of 4676 2420 F38E.tmp 143 PID 4676 wrote to memory of 5608 4676 F40B.tmp 144 PID 5608 wrote to memory of 3368 5608 F497.tmp 145 PID 3368 wrote to memory of 4684 3368 F514.tmp 146 PID 4684 wrote to memory of 3048 4684 F582.tmp 147 PID 3048 wrote to memory of 2564 3048 F5FF.tmp 148 PID 2564 wrote to memory of 5752 2564 F6AB.tmp 149 PID 5752 wrote to memory of 5076 5752 F728.tmp 150 PID 5076 wrote to memory of 4924 5076 F795.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_6b78b7d5731c38ea08494145d971afe7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_6b78b7d5731c38ea08494145d971afe7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\D47D.tmp"C:\Users\Admin\AppData\Local\Temp\D47D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\D519.tmp"C:\Users\Admin\AppData\Local\Temp\D519.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\D6DE.tmp"C:\Users\Admin\AppData\Local\Temp\D6DE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\DB33.tmp"C:\Users\Admin\AppData\Local\Temp\DB33.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\DD75.tmp"C:\Users\Admin\AppData\Local\Temp\DD75.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\DE02.tmp"C:\Users\Admin\AppData\Local\Temp\DE02.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\E063.tmp"C:\Users\Admin\AppData\Local\Temp\E063.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\E853.tmp"C:\Users\Admin\AppData\Local\Temp\E853.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\EA37.tmp"C:\Users\Admin\AppData\Local\Temp\EA37.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\F226.tmp"C:\Users\Admin\AppData\Local\Temp\F226.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\F514.tmp"C:\Users\Admin\AppData\Local\Temp\F514.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\F582.tmp"C:\Users\Admin\AppData\Local\Temp\F582.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F802.tmp"C:\Users\Admin\AppData\Local\Temp\F802.tmp"65⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"66⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"67⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"68⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\FA35.tmp"C:\Users\Admin\AppData\Local\Temp\FA35.tmp"69⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"70⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"71⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"72⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"73⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"74⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"75⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"76⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"77⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"78⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"79⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"80⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"81⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"82⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"83⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\1D6.tmp"C:\Users\Admin\AppData\Local\Temp\1D6.tmp"84⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\282.tmp"C:\Users\Admin\AppData\Local\Temp\282.tmp"85⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"86⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\39B.tmp"C:\Users\Admin\AppData\Local\Temp\39B.tmp"87⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"88⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"90⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"91⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"92⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"94⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"95⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"96⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"97⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"98⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\996.tmp"C:\Users\Admin\AppData\Local\Temp\996.tmp"99⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"100⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"101⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"102⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"103⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"104⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\C84.tmp"C:\Users\Admin\AppData\Local\Temp\C84.tmp"105⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"106⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\D9E.tmp"C:\Users\Admin\AppData\Local\Temp\D9E.tmp"107⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"108⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"109⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\F24.tmp"C:\Users\Admin\AppData\Local\Temp\F24.tmp"110⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"111⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"112⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"113⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1137.tmp"C:\Users\Admin\AppData\Local\Temp\1137.tmp"114⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\11B4.tmp"C:\Users\Admin\AppData\Local\Temp\11B4.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"116⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\12BE.tmp"C:\Users\Admin\AppData\Local\Temp\12BE.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:404 -
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"118⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"119⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"120⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\14F1.tmp"C:\Users\Admin\AppData\Local\Temp\14F1.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-