Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/05/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260516-mxtcwscy4x
- SHA256 552860c8c42d3ed697a32a5d8307be995525ac0a62406d494d85131f82196327
- MD5 254422413d8e2109a9143307f7d0f2d6
- SHA1 6b2b0df8504b944dac22c1ae99e4be31230b1c62
- SHA512 b431a887f00b5f6458c563ba8b518d6d3a5aad2d5beeda7a38a74fe6b5073f7072081c8473f3469f372cd5ee2968d35130e70482fed599baf2027c6e31b68e46
- SSDEEP 12288:NU5rCOTeij7dNnVfDFwbOjiP6ZVT0PGLTZwlH:NUQOJj7dNVf9jhZtGGLTSlH
- TLSH T1A4B4F126B585C032E6D211314FE6EBB16A3E7D354722A4C72B94663E2FB13E1D739342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4548 F5AA.tmp 2444 F618.tmp 2380 F676.tmp 2284 F6E3.tmp 3348 F731.tmp 1880 F7CD.tmp 4732 F84A.tmp 3720 F8B8.tmp 1460 F906.tmp 5624 F983.tmp 1852 FA00.tmp 3312 FA6D.tmp 5204 FAFA.tmp 5532 FB67.tmp 3660 FBF4.tmp 5744 FC80.tmp 2120 FCEE.tmp 4716 FD4C.tmp 992 FDB9.tmp 5408 FE36.tmp 1276 FEB3.tmp 5784 FF20.tmp 3872 FF8E.tmp 3524 1A.tmp 4920 78.tmp 4052 E5.tmp 2768 162.tmp 2560 1C0.tmp 5144 20E.tmp 956 27C.tmp 4020 2D9.tmp 3444 347.tmp 6080 3C4.tmp 2980 412.tmp 3868 47F.tmp 4972 4CD.tmp 2204 51C.tmp 5356 579.tmp 2916 5D7.tmp 2516 625.tmp 1760 673.tmp 5608 6D1.tmp 5388 72F.tmp 3816 77D.tmp 2248 7DB.tmp 3132 838.tmp 2832 887.tmp 5436 8E4.tmp 2304 942.tmp 1484 990.tmp 4840 9EE.tmp 1376 A2C.tmp 2940 A7B.tmp 4412 AD8.tmp 388 B26.tmp 4612 B84.tmp 2104 BE2.tmp 4812 C40.tmp 4480 C8E.tmp 4604 CEC.tmp 3428 D3A.tmp 3892 D88.tmp 3020 DD6.tmp 4368 E24.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 971B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 581E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2844.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F558.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9110.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 245C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9769.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4448 wrote to memory of 4548 4448 2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe 81 PID 4548 wrote to memory of 2444 4548 F5AA.tmp 82 PID 2444 wrote to memory of 2380 2444 F618.tmp 83 PID 2380 wrote to memory of 2284 2380 F676.tmp 84 PID 2284 wrote to memory of 3348 2284 F6E3.tmp 85 PID 3348 wrote to memory of 1880 3348 F731.tmp 86 PID 1880 wrote to memory of 4732 1880 F7CD.tmp 87 PID 4732 wrote to memory of 3720 4732 F84A.tmp 88 PID 3720 wrote to memory of 1460 3720 F8B8.tmp 89 PID 1460 wrote to memory of 5624 1460 F906.tmp 90 PID 5624 wrote to memory of 1852 5624 F983.tmp 91 PID 1852 wrote to memory of 3312 1852 FA00.tmp 92 PID 3312 wrote to memory of 5204 3312 FA6D.tmp 93 PID 5204 wrote to memory of 5532 5204 FAFA.tmp 94 PID 5532 wrote to memory of 3660 5532 FB67.tmp 95 PID 3660 wrote to memory of 5744 3660 FBF4.tmp 96 PID 5744 wrote to memory of 2120 5744 FC80.tmp 97 PID 2120 wrote to memory of 4716 2120 FCEE.tmp 98 PID 4716 wrote to memory of 992 4716 FD4C.tmp 99 PID 992 wrote to memory of 5408 992 FDB9.tmp 100 PID 5408 wrote to memory of 1276 5408 FE36.tmp 101 PID 1276 wrote to memory of 5784 1276 FEB3.tmp 102 PID 5784 wrote to memory of 3872 5784 FF20.tmp 103 PID 3872 wrote to memory of 3524 3872 FF8E.tmp 104 PID 3524 wrote to memory of 4920 3524 1A.tmp 105 PID 4920 wrote to memory of 4052 4920 78.tmp 106 PID 4052 wrote to memory of 2768 4052 E5.tmp 107 PID 2768 wrote to memory of 2560 2768 162.tmp 108 PID 2560 wrote to memory of 5144 2560 1C0.tmp 109 PID 5144 wrote to memory of 956 5144 20E.tmp 110 PID 956 wrote to memory of 4020 956 27C.tmp 111 PID 4020 wrote to memory of 3444 4020 2D9.tmp 112 PID 3444 wrote to memory of 6080 3444 347.tmp 113 PID 6080 wrote to memory of 2980 6080 3C4.tmp 114 PID 2980 wrote to memory of 3868 2980 412.tmp 115 PID 3868 wrote to memory of 4972 3868 47F.tmp 116 PID 4972 wrote to memory of 2204 4972 4CD.tmp 117 PID 2204 wrote to memory of 5356 2204 51C.tmp 118 PID 5356 wrote to memory of 2916 5356 579.tmp 119 PID 2916 wrote to memory of 2516 2916 5D7.tmp 120 PID 2516 wrote to memory of 1760 2516 625.tmp 121 PID 1760 wrote to memory of 5608 1760 673.tmp 122 PID 5608 wrote to memory of 5388 5608 6D1.tmp 123 PID 5388 wrote to memory of 3816 5388 72F.tmp 124 PID 3816 wrote to memory of 2248 3816 77D.tmp 125 PID 2248 wrote to memory of 3132 2248 7DB.tmp 126 PID 3132 wrote to memory of 2832 3132 838.tmp 127 PID 2832 wrote to memory of 5436 2832 887.tmp 128 PID 5436 wrote to memory of 2304 5436 8E4.tmp 129 PID 2304 wrote to memory of 1484 2304 942.tmp 130 PID 1484 wrote to memory of 4840 1484 990.tmp 131 PID 4840 wrote to memory of 1376 4840 9EE.tmp 132 PID 1376 wrote to memory of 2940 1376 A2C.tmp 133 PID 2940 wrote to memory of 4412 2940 A7B.tmp 134 PID 4412 wrote to memory of 388 4412 AD8.tmp 135 PID 388 wrote to memory of 4612 388 B26.tmp 136 PID 4612 wrote to memory of 2104 4612 B84.tmp 137 PID 2104 wrote to memory of 4812 2104 BE2.tmp 138 PID 4812 wrote to memory of 4480 4812 C40.tmp 139 PID 4480 wrote to memory of 4604 4480 C8E.tmp 140 PID 4604 wrote to memory of 3428 4604 CEC.tmp 141 PID 3428 wrote to memory of 3892 3428 D3A.tmp 142 PID 3892 wrote to memory of 3020 3892 D88.tmp 143 PID 3020 wrote to memory of 4368 3020 DD6.tmp 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"65⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"66⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"67⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"68⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"70⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"71⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"72⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"74⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"75⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"76⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"77⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"78⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"79⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"80⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"81⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"82⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"83⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"84⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"85⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"86⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"88⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"89⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"90⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"91⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"92⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"93⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"94⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"95⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"96⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"97⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"98⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"99⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"100⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"101⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"102⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"103⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"104⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"105⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"107⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"108⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"109⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"110⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"111⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"112⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"113⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"114⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"115⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"116⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"117⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"118⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"119⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"120⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"121⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"122⤵PID:5580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-