Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/10/2026, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_792e949cf9199774a59c3171c733ffa7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-25_792e949cf9199774a59c3171c733ffa7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-25_792e949cf9199774a59c3171c733ffa7_elex_mafia_stealc_tofsee.exe
- Size 486KB
- Sample261026-29knvahs4w
- SHA256 f35f5d2e991beae577aced8e19b84ff51f546660e8945f2017189662efce74df
- MD5 792e949cf9199774a59c3171c733ffa7
- SHA1 f9080938aa27a8199f88cbc438e6df46d998d6e2
- SHA512 198b4f5a244c67dc9958e75f5f2b66fe7a25e67a3e1281e8c152583c5029198f3c5dc93c50158004c45eb7b7c73fff3630d4864e16a98aeceff97ccd903ba4be
- SSDEEP 12288:oU5rCOTeiDer/x83330RhTt8eyMJ1sIYObNZ:oUQOJDer636hTavMbsRObN
- TLSH T129B4F125B580C032E69602354FE6DBA2693BBD319B26A4C737D0277D6EF02D1A3B4357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4372 1EF8.tmp 4136 2021.tmp 4112 21C7.tmp 708 2292.tmp 5004 230F.tmp 4360 23BB.tmp 3788 2495.tmp 4956 2551.tmp 2740 25CE.tmp 4992 26B8.tmp 5456 2754.tmp 4988 2820.tmp 5224 28AC.tmp 3368 2968.tmp 3356 2A33.tmp 5916 2B1D.tmp 1072 2BC9.tmp 3232 2CA4.tmp 6028 2D6F.tmp 1232 2E3A.tmp 4376 2ED6.tmp 5132 2F63.tmp 5404 300F.tmp 916 308C.tmp 1752 3138.tmp 4744 31D4.tmp 5512 3270.tmp 5508 334B.tmp 688 33D8.tmp 5012 3483.tmp 2904 352F.tmp 5040 35FA.tmp 1212 3697.tmp 1372 3714.tmp 5016 3781.tmp 3320 37EE.tmp 1756 385C.tmp 1120 38D9.tmp 2512 3956.tmp 3316 39D3.tmp 4824 3A40.tmp 4300 3ABD.tmp 748 3B2B.tmp 6088 3BA8.tmp 1376 3C25.tmp 4644 3C92.tmp 5160 3D1F.tmp 1332 3D8C.tmp 5092 3E09.tmp 6108 3E86.tmp 2896 3F03.tmp 3556 3F70.tmp 1164 3FDE.tmp 4788 406A.tmp 4596 40E7.tmp 4708 4193.tmp 1796 4201.tmp 2524 427E.tmp 4496 42EB.tmp 2424 4368.tmp 5972 43E5.tmp 556 4452.tmp 5336 44CF.tmp 5340 455C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 796C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A53F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B925.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 809B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 975F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3504 wrote to memory of 4372 3504 2026-10-25_792e949cf9199774a59c3171c733ffa7_elex_mafia_stealc_tofsee.exe 89 PID 4372 wrote to memory of 4136 4372 1EF8.tmp 90 PID 4136 wrote to memory of 4112 4136 2021.tmp 91 PID 4112 wrote to memory of 708 4112 21C7.tmp 92 PID 708 wrote to memory of 5004 708 2292.tmp 93 PID 5004 wrote to memory of 4360 5004 230F.tmp 94 PID 4360 wrote to memory of 3788 4360 23BB.tmp 95 PID 3788 wrote to memory of 4956 3788 2495.tmp 96 PID 4956 wrote to memory of 2740 4956 2551.tmp 97 PID 2740 wrote to memory of 4992 2740 25CE.tmp 98 PID 4992 wrote to memory of 5456 4992 26B8.tmp 99 PID 5456 wrote to memory of 4988 5456 2754.tmp 100 PID 4988 wrote to memory of 5224 4988 2820.tmp 101 PID 5224 wrote to memory of 3368 5224 28AC.tmp 102 PID 3368 wrote to memory of 3356 3368 2968.tmp 103 PID 3356 wrote to memory of 5916 3356 2A33.tmp 104 PID 5916 wrote to memory of 1072 5916 2B1D.tmp 105 PID 1072 wrote to memory of 3232 1072 2BC9.tmp 106 PID 3232 wrote to memory of 6028 3232 2CA4.tmp 107 PID 6028 wrote to memory of 1232 6028 2D6F.tmp 108 PID 1232 wrote to memory of 4376 1232 2E3A.tmp 109 PID 4376 wrote to memory of 5132 4376 2ED6.tmp 110 PID 5132 wrote to memory of 5404 5132 2F63.tmp 111 PID 5404 wrote to memory of 916 5404 300F.tmp 112 PID 916 wrote to memory of 1752 916 308C.tmp 113 PID 1752 wrote to memory of 4744 1752 3138.tmp 114 PID 4744 wrote to memory of 5512 4744 31D4.tmp 115 PID 5512 wrote to memory of 5508 5512 3270.tmp 116 PID 5508 wrote to memory of 688 5508 334B.tmp 117 PID 688 wrote to memory of 5012 688 33D8.tmp 118 PID 5012 wrote to memory of 2904 5012 3483.tmp 119 PID 2904 wrote to memory of 5040 2904 352F.tmp 120 PID 5040 wrote to memory of 1212 5040 35FA.tmp 121 PID 1212 wrote to memory of 1372 1212 3697.tmp 122 PID 1372 wrote to memory of 5016 1372 3714.tmp 123 PID 5016 wrote to memory of 3320 5016 3781.tmp 124 PID 3320 wrote to memory of 1756 3320 37EE.tmp 125 PID 1756 wrote to memory of 1120 1756 385C.tmp 126 PID 1120 wrote to memory of 2512 1120 38D9.tmp 127 PID 2512 wrote to memory of 3316 2512 3956.tmp 128 PID 3316 wrote to memory of 4824 3316 39D3.tmp 129 PID 4824 wrote to memory of 4300 4824 3A40.tmp 130 PID 4300 wrote to memory of 748 4300 3ABD.tmp 131 PID 748 wrote to memory of 6088 748 3B2B.tmp 132 PID 6088 wrote to memory of 1376 6088 3BA8.tmp 133 PID 1376 wrote to memory of 4644 1376 3C25.tmp 134 PID 4644 wrote to memory of 5160 4644 3C92.tmp 135 PID 5160 wrote to memory of 1332 5160 3D1F.tmp 136 PID 1332 wrote to memory of 5092 1332 3D8C.tmp 137 PID 5092 wrote to memory of 6108 5092 3E09.tmp 138 PID 6108 wrote to memory of 2896 6108 3E86.tmp 139 PID 2896 wrote to memory of 3556 2896 3F03.tmp 140 PID 3556 wrote to memory of 1164 3556 3F70.tmp 141 PID 1164 wrote to memory of 4788 1164 3FDE.tmp 142 PID 4788 wrote to memory of 4596 4788 406A.tmp 143 PID 4596 wrote to memory of 4708 4596 40E7.tmp 144 PID 4708 wrote to memory of 1796 4708 4193.tmp 145 PID 1796 wrote to memory of 2524 1796 4201.tmp 146 PID 2524 wrote to memory of 4496 2524 427E.tmp 147 PID 4496 wrote to memory of 2424 4496 42EB.tmp 148 PID 2424 wrote to memory of 5972 2424 4368.tmp 149 PID 5972 wrote to memory of 556 5972 43E5.tmp 150 PID 556 wrote to memory of 5336 556 4452.tmp 151 PID 5336 wrote to memory of 5340 5336 44CF.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_792e949cf9199774a59c3171c733ffa7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_792e949cf9199774a59c3171c733ffa7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\23BB.tmp"C:\Users\Admin\AppData\Local\Temp\23BB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\2A33.tmp"C:\Users\Admin\AppData\Local\Temp\2A33.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\2D6F.tmp"C:\Users\Admin\AppData\Local\Temp\2D6F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\300F.tmp"C:\Users\Admin\AppData\Local\Temp\300F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\308C.tmp"C:\Users\Admin\AppData\Local\Temp\308C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\352F.tmp"C:\Users\Admin\AppData\Local\Temp\352F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3697.tmp"C:\Users\Admin\AppData\Local\Temp\3697.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3714.tmp"C:\Users\Admin\AppData\Local\Temp\3714.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\37EE.tmp"C:\Users\Admin\AppData\Local\Temp\37EE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\385C.tmp"C:\Users\Admin\AppData\Local\Temp\385C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3A40.tmp"C:\Users\Admin\AppData\Local\Temp\3A40.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4201.tmp"C:\Users\Admin\AppData\Local\Temp\4201.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\42EB.tmp"C:\Users\Admin\AppData\Local\Temp\42EB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\43E5.tmp"C:\Users\Admin\AppData\Local\Temp\43E5.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\4452.tmp"C:\Users\Admin\AppData\Local\Temp\4452.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"65⤵
- Executes dropped EXE
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"66⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\4656.tmp"C:\Users\Admin\AppData\Local\Temp\4656.tmp"67⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"68⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"69⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"71⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"72⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"73⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"74⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"75⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"76⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4B96.tmp"C:\Users\Admin\AppData\Local\Temp\4B96.tmp"78⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"79⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"80⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\4CED.tmp"C:\Users\Admin\AppData\Local\Temp\4CED.tmp"81⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"82⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"83⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"84⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"85⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\4F4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F4F.tmp"86⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"87⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\5039.tmp"C:\Users\Admin\AppData\Local\Temp\5039.tmp"88⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"89⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\5114.tmp"C:\Users\Admin\AppData\Local\Temp\5114.tmp"90⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\5181.tmp"C:\Users\Admin\AppData\Local\Temp\5181.tmp"91⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\51EF.tmp"C:\Users\Admin\AppData\Local\Temp\51EF.tmp"92⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"93⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"94⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"95⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"96⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\548F.tmp"C:\Users\Admin\AppData\Local\Temp\548F.tmp"97⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\551B.tmp"C:\Users\Admin\AppData\Local\Temp\551B.tmp"98⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"99⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"100⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"101⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\56E0.tmp"C:\Users\Admin\AppData\Local\Temp\56E0.tmp"102⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\575D.tmp"C:\Users\Admin\AppData\Local\Temp\575D.tmp"103⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"104⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5867.tmp"C:\Users\Admin\AppData\Local\Temp\5867.tmp"105⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"106⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"107⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"108⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"109⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5B07.tmp"C:\Users\Admin\AppData\Local\Temp\5B07.tmp"110⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\5B74.tmp"C:\Users\Admin\AppData\Local\Temp\5B74.tmp"111⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\5C01.tmp"C:\Users\Admin\AppData\Local\Temp\5C01.tmp"112⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"113⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"114⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\5D87.tmp"C:\Users\Admin\AppData\Local\Temp\5D87.tmp"115⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5E14.tmp"C:\Users\Admin\AppData\Local\Temp\5E14.tmp"116⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\5E91.tmp"C:\Users\Admin\AppData\Local\Temp\5E91.tmp"117⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"118⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"119⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6018.tmp"C:\Users\Admin\AppData\Local\Temp\6018.tmp"120⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"121⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\6121.tmp"C:\Users\Admin\AppData\Local\Temp\6121.tmp"122⤵PID:5088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-