Analysis
- max time kernel
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260720-teaamaft8n
- SHA256 8539daa74b2aa2a370c04de255493b72af9f4e04f9d4f60e2323b135c7f7989d
- MD5 5934d06ae44cf9acf5847ecbb9b26b1c
- SHA1 b12a70a8fe44f22ccbe9bb4de0c9cc7c4e296152
- SHA512 1e543ec604c65a93d65e9e1787d758e95330cbcb27213b382edb0f39cf32d8fb5dfa1c539943bfafb0bd6f94a1ba4aae766e3fa52bda1e2b2cbf2736caf2c244
- SSDEEP 12288:wU5rCOTeiDlzGrrfLBHyGDFdxUohZANAQ2tZJ/NZ+3/v+I9hUG2VA:wUQOJDpErfZvJdxlENn2tz/NGEA
- TLSH T171E4D02177D8C532E5FB037859B5E6614E7EBD366722D6DF2B8012AE0971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5372 91F5.tmp 5032 933D.tmp 1528 94F3.tmp 244 962B.tmp 236 9764.tmp 2692 984E.tmp 2908 9929.tmp 5368 9A13.tmp 3808 9B6B.tmp 5796 9C75.tmp 2108 9D6F.tmp 4784 9E59.tmp 5704 9F44.tmp 3320 A03E.tmp 5140 A147.tmp 4316 A270.tmp 4472 A33B.tmp 2388 A3B8.tmp 3248 A435.tmp 5460 A4B2.tmp 1976 A55E.tmp 1684 A5EB.tmp 980 A668.tmp 4688 A6D5.tmp 4276 A791.tmp 4452 A81D.tmp 1212 A8C9.tmp 2384 A975.tmp 6036 A9E2.tmp 5668 AAAD.tmp 2496 AB3A.tmp 4228 ABE6.tmp 820 AC53.tmp 4332 ACE0.tmp 4768 AD7C.tmp 2980 AE09.tmp 4876 AE95.tmp 5224 AF22.tmp 1816 AF8F.tmp 4544 B00C.tmp 5344 B089.tmp 1472 B0F7.tmp 2868 B193.tmp 2092 B200.tmp 4820 B27D.tmp 5948 B30A.tmp 4272 B387.tmp 548 B3F4.tmp 6080 B471.tmp 5676 B4EE.tmp 5644 B55C.tmp 5400 B5C9.tmp 1980 B637.tmp 1804 B694.tmp 1416 B6F2.tmp 5880 B76F.tmp 5816 B7EC.tmp 2120 B869.tmp 2808 B905.tmp 3516 B982.tmp 4404 B9FF.tmp 4704 BA7C.tmp 200 BAEA.tmp 4580 BB86.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 345F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 133B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 852F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 984A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E70B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 5372 2364 2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe 89 PID 5372 wrote to memory of 5032 5372 91F5.tmp 90 PID 5032 wrote to memory of 1528 5032 933D.tmp 91 PID 1528 wrote to memory of 244 1528 94F3.tmp 92 PID 244 wrote to memory of 236 244 962B.tmp 93 PID 236 wrote to memory of 2692 236 9764.tmp 94 PID 2692 wrote to memory of 2908 2692 984E.tmp 95 PID 2908 wrote to memory of 5368 2908 9929.tmp 96 PID 5368 wrote to memory of 3808 5368 9A13.tmp 97 PID 3808 wrote to memory of 5796 3808 9B6B.tmp 98 PID 5796 wrote to memory of 2108 5796 9C75.tmp 99 PID 2108 wrote to memory of 4784 2108 9D6F.tmp 100 PID 4784 wrote to memory of 5704 4784 9E59.tmp 101 PID 5704 wrote to memory of 3320 5704 9F44.tmp 102 PID 3320 wrote to memory of 5140 3320 A03E.tmp 103 PID 5140 wrote to memory of 4316 5140 A147.tmp 104 PID 4316 wrote to memory of 4472 4316 A270.tmp 105 PID 4472 wrote to memory of 2388 4472 A33B.tmp 106 PID 2388 wrote to memory of 3248 2388 A3B8.tmp 107 PID 3248 wrote to memory of 5460 3248 A435.tmp 108 PID 5460 wrote to memory of 1976 5460 A4B2.tmp 109 PID 1976 wrote to memory of 1684 1976 A55E.tmp 110 PID 1684 wrote to memory of 980 1684 A5EB.tmp 111 PID 980 wrote to memory of 4688 980 A668.tmp 112 PID 4688 wrote to memory of 4276 4688 A6D5.tmp 113 PID 4276 wrote to memory of 4452 4276 A791.tmp 114 PID 4452 wrote to memory of 1212 4452 A81D.tmp 115 PID 1212 wrote to memory of 2384 1212 A8C9.tmp 116 PID 2384 wrote to memory of 6036 2384 A975.tmp 117 PID 6036 wrote to memory of 5668 6036 A9E2.tmp 118 PID 5668 wrote to memory of 2496 5668 AAAD.tmp 119 PID 2496 wrote to memory of 4228 2496 AB3A.tmp 120 PID 4228 wrote to memory of 820 4228 ABE6.tmp 121 PID 820 wrote to memory of 4332 820 AC53.tmp 122 PID 4332 wrote to memory of 4768 4332 ACE0.tmp 123 PID 4768 wrote to memory of 2980 4768 AD7C.tmp 124 PID 2980 wrote to memory of 4876 2980 AE09.tmp 125 PID 4876 wrote to memory of 5224 4876 AE95.tmp 126 PID 5224 wrote to memory of 1816 5224 AF22.tmp 127 PID 1816 wrote to memory of 4544 1816 AF8F.tmp 128 PID 4544 wrote to memory of 5344 4544 B00C.tmp 129 PID 5344 wrote to memory of 1472 5344 B089.tmp 130 PID 1472 wrote to memory of 2868 1472 B0F7.tmp 131 PID 2868 wrote to memory of 2092 2868 B193.tmp 132 PID 2092 wrote to memory of 4820 2092 B200.tmp 133 PID 4820 wrote to memory of 5948 4820 B27D.tmp 134 PID 5948 wrote to memory of 4272 5948 B30A.tmp 135 PID 4272 wrote to memory of 548 4272 B387.tmp 136 PID 548 wrote to memory of 6080 548 B3F4.tmp 137 PID 6080 wrote to memory of 5676 6080 B471.tmp 138 PID 5676 wrote to memory of 5644 5676 B4EE.tmp 139 PID 5644 wrote to memory of 5400 5644 B55C.tmp 140 PID 5400 wrote to memory of 1980 5400 B5C9.tmp 141 PID 1980 wrote to memory of 1804 1980 B637.tmp 142 PID 1804 wrote to memory of 1416 1804 B694.tmp 143 PID 1416 wrote to memory of 5880 1416 B6F2.tmp 144 PID 5880 wrote to memory of 5816 5880 B76F.tmp 145 PID 5816 wrote to memory of 2120 5816 B7EC.tmp 146 PID 2120 wrote to memory of 2808 2120 B869.tmp 147 PID 2808 wrote to memory of 3516 2808 B905.tmp 148 PID 3516 wrote to memory of 4404 3516 B982.tmp 149 PID 4404 wrote to memory of 4704 4404 B9FF.tmp 150 PID 4704 wrote to memory of 200 4704 BA7C.tmp 151 PID 200 wrote to memory of 4580 200 BAEA.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5934d06ae44cf9acf5847ecbb9b26b1c_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\91F5.tmp"C:\Users\Admin\AppData\Local\Temp\91F5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\933D.tmp"C:\Users\Admin\AppData\Local\Temp\933D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\9F44.tmp"C:\Users\Admin\AppData\Local\Temp\9F44.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A435.tmp"C:\Users\Admin\AppData\Local\Temp\A435.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\A81D.tmp"C:\Users\Admin\AppData\Local\Temp\A81D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\AE09.tmp"C:\Users\Admin\AppData\Local\Temp\AE09.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B200.tmp"C:\Users\Admin\AppData\Local\Temp\B200.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\B637.tmp"C:\Users\Admin\AppData\Local\Temp\B637.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\B905.tmp"C:\Users\Admin\AppData\Local\Temp\B905.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\BB86.tmp"C:\Users\Admin\AppData\Local\Temp\BB86.tmp"65⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\BC22.tmp"C:\Users\Admin\AppData\Local\Temp\BC22.tmp"66⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"67⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"68⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"69⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"70⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\BF10.tmp"C:\Users\Admin\AppData\Local\Temp\BF10.tmp"71⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"72⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C104.tmp"C:\Users\Admin\AppData\Local\Temp\C104.tmp"74⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"75⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"76⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"77⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\C346.tmp"C:\Users\Admin\AppData\Local\Temp\C346.tmp"78⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"79⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\C450.tmp"C:\Users\Admin\AppData\Local\Temp\C450.tmp"80⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\C4CD.tmp"C:\Users\Admin\AppData\Local\Temp\C4CD.tmp"81⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"82⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"83⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\C682.tmp"C:\Users\Admin\AppData\Local\Temp\C682.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"85⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\C79C.tmp"C:\Users\Admin\AppData\Local\Temp\C79C.tmp"86⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\C819.tmp"C:\Users\Admin\AppData\Local\Temp\C819.tmp"87⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\C896.tmp"C:\Users\Admin\AppData\Local\Temp\C896.tmp"88⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"89⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"90⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"91⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\CA99.tmp"C:\Users\Admin\AppData\Local\Temp\CA99.tmp"92⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"93⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"94⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"95⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"96⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"97⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"98⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"99⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"102⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"103⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"104⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"105⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"106⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"107⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"108⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\D40F.tmp"C:\Users\Admin\AppData\Local\Temp\D40F.tmp"109⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"110⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"111⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"112⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\D651.tmp"C:\Users\Admin\AppData\Local\Temp\D651.tmp"113⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"114⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"115⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"116⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"117⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"119⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"120⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"121⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\DB24.tmp"C:\Users\Admin\AppData\Local\Temp\DB24.tmp"122⤵PID:3100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-