Analysis
- max time kernel
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_a269a0294f9df27387eb4c418c01424c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_a269a0294f9df27387eb4c418c01424c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-18_a269a0294f9df27387eb4c418c01424c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260718-1fl45sgs41
- SHA256 38a2c519c51c5e5bc9629d99ffcefa0c4873927d72d3f01229ff4bc12616e0da
- MD5 a269a0294f9df27387eb4c418c01424c
- SHA1 558e38e0a56577b02e36f5c89e40d996bfdbcd93
- SHA512 b8151029c4ee0ee00a37da7166bcfbbe9e089d77e9d9b53ef191d54b44154e60dc94f69457093391497d29c076f49760257fa10ab14c48dd3a643961d187d410
- SSDEEP 12288:wU5rCOTeiDGJXwcQEafeF7IPBHQFNZ+3/v+I9hUG2VA:wUQOJDFcBafexIBQFNGEA
- TLSH T176E4D02177D88532E5FB037899B5F650597EBD326722D6CF6F8016AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4840 85D0.tmp 4164 868B.tmp 2516 87D4.tmp 1176 88ED.tmp 5868 8A16.tmp 1704 8B2F.tmp 4260 8C48.tmp 5588 8D13.tmp 2088 8E0D.tmp 264 8EE8.tmp 5704 8FB3.tmp 6088 90DC.tmp 5024 91E6.tmp 2532 92B1.tmp 1136 93AB.tmp 2632 94D4.tmp 4324 960C.tmp 5776 96E7.tmp 2768 97F1.tmp 5492 98CB.tmp 1952 9996.tmp 868 9A90.tmp 2392 9B8A.tmp 2700 9CD3.tmp 5472 9DDC.tmp 4248 9F05.tmp 1920 A01E.tmp 5124 A109.tmp 2280 A203.tmp 2128 A2ED.tmp 2028 A3D7.tmp 3108 A4B2.tmp 3236 A5FA.tmp 1280 A6B6.tmp 2168 A752.tmp 5160 A80E.tmp 4228 A8AA.tmp 5964 A946.tmp 2524 A9D3.tmp 3736 AA6F.tmp 1352 AB3A.tmp 3400 AC24.tmp 4924 ACFF.tmp 2792 ADCA.tmp 5748 AE95.tmp 3568 AFAF.tmp 4272 B06A.tmp 5780 B106.tmp 2852 B183.tmp 2072 B1F1.tmp 3612 B27D.tmp 5688 B2FA.tmp 4464 B377.tmp 4788 B3E5.tmp 2832 B471.tmp 5224 B4EE.tmp 6028 B56B.tmp 3216 B5F8.tmp 4148 B685.tmp 2720 B702.tmp 3604 B79E.tmp 248 B80B.tmp 3016 B869.tmp 4128 B8E6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 928D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C758.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C555.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3184 wrote to memory of 4840 3184 2026-07-18_a269a0294f9df27387eb4c418c01424c_elex_mafia_stealc_tofsee.exe 89 PID 4840 wrote to memory of 4164 4840 85D0.tmp 90 PID 4164 wrote to memory of 2516 4164 868B.tmp 91 PID 2516 wrote to memory of 1176 2516 87D4.tmp 92 PID 1176 wrote to memory of 5868 1176 88ED.tmp 93 PID 5868 wrote to memory of 1704 5868 8A16.tmp 94 PID 1704 wrote to memory of 4260 1704 8B2F.tmp 95 PID 4260 wrote to memory of 5588 4260 8C48.tmp 96 PID 5588 wrote to memory of 2088 5588 8D13.tmp 97 PID 2088 wrote to memory of 264 2088 8E0D.tmp 98 PID 264 wrote to memory of 5704 264 8EE8.tmp 99 PID 5704 wrote to memory of 6088 5704 8FB3.tmp 100 PID 6088 wrote to memory of 5024 6088 90DC.tmp 101 PID 5024 wrote to memory of 2532 5024 91E6.tmp 102 PID 2532 wrote to memory of 1136 2532 92B1.tmp 103 PID 1136 wrote to memory of 2632 1136 93AB.tmp 104 PID 2632 wrote to memory of 4324 2632 94D4.tmp 105 PID 4324 wrote to memory of 5776 4324 960C.tmp 106 PID 5776 wrote to memory of 2768 5776 96E7.tmp 107 PID 2768 wrote to memory of 5492 2768 97F1.tmp 108 PID 5492 wrote to memory of 1952 5492 98CB.tmp 109 PID 1952 wrote to memory of 868 1952 9996.tmp 110 PID 868 wrote to memory of 2392 868 9A90.tmp 111 PID 2392 wrote to memory of 2700 2392 9B8A.tmp 112 PID 2700 wrote to memory of 5472 2700 9CD3.tmp 113 PID 5472 wrote to memory of 4248 5472 9DDC.tmp 114 PID 4248 wrote to memory of 1920 4248 9F05.tmp 115 PID 1920 wrote to memory of 5124 1920 A01E.tmp 116 PID 5124 wrote to memory of 2280 5124 A109.tmp 117 PID 2280 wrote to memory of 2128 2280 A203.tmp 118 PID 2128 wrote to memory of 2028 2128 A2ED.tmp 119 PID 2028 wrote to memory of 3108 2028 A3D7.tmp 120 PID 3108 wrote to memory of 3236 3108 A4B2.tmp 121 PID 3236 wrote to memory of 1280 3236 A5FA.tmp 122 PID 1280 wrote to memory of 2168 1280 A6B6.tmp 123 PID 2168 wrote to memory of 5160 2168 A752.tmp 124 PID 5160 wrote to memory of 4228 5160 A80E.tmp 125 PID 4228 wrote to memory of 5964 4228 A8AA.tmp 126 PID 5964 wrote to memory of 2524 5964 A946.tmp 127 PID 2524 wrote to memory of 3736 2524 A9D3.tmp 128 PID 3736 wrote to memory of 1352 3736 AA6F.tmp 129 PID 1352 wrote to memory of 3400 1352 AB3A.tmp 130 PID 3400 wrote to memory of 4924 3400 AC24.tmp 131 PID 4924 wrote to memory of 2792 4924 ACFF.tmp 132 PID 2792 wrote to memory of 5748 2792 ADCA.tmp 133 PID 5748 wrote to memory of 3568 5748 AE95.tmp 134 PID 3568 wrote to memory of 4272 3568 AFAF.tmp 135 PID 4272 wrote to memory of 5780 4272 B06A.tmp 136 PID 5780 wrote to memory of 2852 5780 B106.tmp 137 PID 2852 wrote to memory of 2072 2852 B183.tmp 138 PID 2072 wrote to memory of 3612 2072 B1F1.tmp 139 PID 3612 wrote to memory of 5688 3612 B27D.tmp 140 PID 5688 wrote to memory of 4464 5688 B2FA.tmp 141 PID 4464 wrote to memory of 4788 4464 B377.tmp 142 PID 4788 wrote to memory of 2832 4788 B3E5.tmp 143 PID 2832 wrote to memory of 5224 2832 B471.tmp 144 PID 5224 wrote to memory of 6028 5224 B4EE.tmp 145 PID 6028 wrote to memory of 3216 6028 B56B.tmp 146 PID 3216 wrote to memory of 4148 3216 B5F8.tmp 147 PID 4148 wrote to memory of 2720 4148 B685.tmp 148 PID 2720 wrote to memory of 3604 2720 B702.tmp 149 PID 3604 wrote to memory of 248 3604 B79E.tmp 150 PID 248 wrote to memory of 3016 248 B80B.tmp 151 PID 3016 wrote to memory of 4128 3016 B869.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_a269a0294f9df27387eb4c418c01424c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a269a0294f9df27387eb4c418c01424c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\960C.tmp"C:\Users\Admin\AppData\Local\Temp\960C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\97F1.tmp"C:\Users\Admin\AppData\Local\Temp\97F1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\98CB.tmp"C:\Users\Admin\AppData\Local\Temp\98CB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"C:\Users\Admin\AppData\Local\Temp\9B8A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\A80E.tmp"C:\Users\Admin\AppData\Local\Temp\A80E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\A946.tmp"C:\Users\Admin\AppData\Local\Temp\A946.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\B183.tmp"C:\Users\Admin\AppData\Local\Temp\B183.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\B56B.tmp"C:\Users\Admin\AppData\Local\Temp\B56B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B79E.tmp"C:\Users\Admin\AppData\Local\Temp\B79E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"65⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"66⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"67⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"68⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"69⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\BB38.tmp"C:\Users\Admin\AppData\Local\Temp\BB38.tmp"70⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"71⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\BC22.tmp"C:\Users\Admin\AppData\Local\Temp\BC22.tmp"72⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"73⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"74⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"75⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"76⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"C:\Users\Admin\AppData\Local\Temp\BEA3.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\BF10.tmp"C:\Users\Admin\AppData\Local\Temp\BF10.tmp"78⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"79⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\C01A.tmp"C:\Users\Admin\AppData\Local\Temp\C01A.tmp"80⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"81⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\C104.tmp"C:\Users\Admin\AppData\Local\Temp\C104.tmp"82⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"83⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"85⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"86⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"87⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\C411.tmp"C:\Users\Admin\AppData\Local\Temp\C411.tmp"88⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:892 -
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"90⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"91⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"92⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"93⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"94⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"95⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"96⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\C903.tmp"C:\Users\Admin\AppData\Local\Temp\C903.tmp"98⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C980.tmp"C:\Users\Admin\AppData\Local\Temp\C980.tmp"99⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"100⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"102⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\CB64.tmp"C:\Users\Admin\AppData\Local\Temp\CB64.tmp"103⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\CC5E.tmp"C:\Users\Admin\AppData\Local\Temp\CC5E.tmp"105⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"106⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"107⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"108⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"109⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"111⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"112⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\D085.tmp"C:\Users\Admin\AppData\Local\Temp\D085.tmp"113⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"114⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"115⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\D20C.tmp"C:\Users\Admin\AppData\Local\Temp\D20C.tmp"116⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\D325.tmp"C:\Users\Admin\AppData\Local\Temp\D325.tmp"118⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"119⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"120⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"121⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\D519.tmp"C:\Users\Admin\AppData\Local\Temp\D519.tmp"122⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-