Analysis
- max time kernel
132s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_b842dd1d0c505a9f74c932d5a516dd2f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_b842dd1d0c505a9f74c932d5a516dd2f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-27_b842dd1d0c505a9f74c932d5a516dd2f_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260727-rmjsxsvbjb
- SHA256 ff7567b35145e8e531e5dde0756349a347582757ae8f7ebb53decd5dcc4b7702
- MD5 b842dd1d0c505a9f74c932d5a516dd2f
- SHA1 06b300aa0ae324cbdc98ba1e8480af0165f224cd
- SHA512 5559abb1e704436b5fc7a62be3211883a13a3aae1ad35e3b752a8dc40fdd5fcbcff32718764ee801ce29c909095d5dce39971cac818faff5cc28d956d138623a
- SSDEEP 12288:wU5rCOTeiDAqo0NI/ae3Nwcp/gQgkMj2rVNZ+3/v+I9hUG2VA:wUQOJDAqpI/aex/gWMj2ZNGEA
- TLSH T1FDE4D02173D8C536E5FB037859B5E6644D7EBD22A722D6CF6F8011AE0AB1BC08A71713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4148 BEE6.tmp 5604 C05D.tmp 1464 C176.tmp 5560 C30D.tmp 3684 C416.tmp 1208 C53F.tmp 1372 C649.tmp 3404 C772.tmp 4912 C88B.tmp 1584 CA02.tmp 5780 CB2B.tmp 3200 CC25.tmp 5752 CD7C.tmp 3152 CEF3.tmp 236 D00D.tmp 3736 D107.tmp 4476 D230.tmp 4996 D339.tmp 5548 D472.tmp 4692 D5C9.tmp 5528 D740.tmp 6028 D889.tmp 2496 D9A2.tmp 2100 DAAB.tmp 556 DC03.tmp 3752 DD2C.tmp 6004 DE55.tmp 5904 DF7E.tmp 3720 E087.tmp 4324 E23D.tmp 1236 E395.tmp 3516 E4AE.tmp 1340 E5D7.tmp 3588 E663.tmp 672 E78C.tmp 2820 E877.tmp 5412 E913.tmp 5884 E9DE.tmp 1964 EAB9.tmp 4084 EB55.tmp 2424 EC01.tmp 1912 ECEB.tmp 4464 EDC6.tmp 3160 EE72.tmp 2428 EF4D.tmp 3644 EFF9.tmp 3524 F0C4.tmp 1928 F1CD.tmp 5440 F2A8.tmp 5020 F344.tmp 1360 F3F0.tmp 2440 F46D.tmp 5360 F4FA.tmp 3092 F586.tmp 4580 F613.tmp 1732 F690.tmp 3648 F70D.tmp 6104 F79A.tmp 3368 F826.tmp 4788 F8B3.tmp 2528 F95F.tmp 4844 F9EB.tmp 1832 FA78.tmp 4528 FB34.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 375D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 886B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 933D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C05D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D472.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 621B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E13E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 304D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4148 3632 2026-07-27_b842dd1d0c505a9f74c932d5a516dd2f_elex_mafia_stealc_tofsee.exe 89 PID 4148 wrote to memory of 5604 4148 BEE6.tmp 90 PID 5604 wrote to memory of 1464 5604 C05D.tmp 91 PID 1464 wrote to memory of 5560 1464 C176.tmp 92 PID 5560 wrote to memory of 3684 5560 C30D.tmp 93 PID 3684 wrote to memory of 1208 3684 C416.tmp 94 PID 1208 wrote to memory of 1372 1208 C53F.tmp 95 PID 1372 wrote to memory of 3404 1372 C649.tmp 96 PID 3404 wrote to memory of 4912 3404 C772.tmp 97 PID 4912 wrote to memory of 1584 4912 C88B.tmp 98 PID 1584 wrote to memory of 5780 1584 CA02.tmp 99 PID 5780 wrote to memory of 3200 5780 CB2B.tmp 100 PID 3200 wrote to memory of 5752 3200 CC25.tmp 101 PID 5752 wrote to memory of 3152 5752 CD7C.tmp 102 PID 3152 wrote to memory of 236 3152 CEF3.tmp 103 PID 236 wrote to memory of 3736 236 D00D.tmp 104 PID 3736 wrote to memory of 4476 3736 D107.tmp 105 PID 4476 wrote to memory of 4996 4476 D230.tmp 106 PID 4996 wrote to memory of 5548 4996 D339.tmp 107 PID 5548 wrote to memory of 4692 5548 D472.tmp 108 PID 4692 wrote to memory of 5528 4692 D5C9.tmp 109 PID 5528 wrote to memory of 6028 5528 D740.tmp 110 PID 6028 wrote to memory of 2496 6028 D889.tmp 111 PID 2496 wrote to memory of 2100 2496 D9A2.tmp 112 PID 2100 wrote to memory of 556 2100 DAAB.tmp 113 PID 556 wrote to memory of 3752 556 DC03.tmp 114 PID 3752 wrote to memory of 6004 3752 DD2C.tmp 115 PID 6004 wrote to memory of 5904 6004 DE55.tmp 116 PID 5904 wrote to memory of 3720 5904 DF7E.tmp 117 PID 3720 wrote to memory of 4324 3720 E087.tmp 118 PID 4324 wrote to memory of 1236 4324 E23D.tmp 119 PID 1236 wrote to memory of 3516 1236 E395.tmp 120 PID 3516 wrote to memory of 1340 3516 E4AE.tmp 121 PID 1340 wrote to memory of 3588 1340 E5D7.tmp 122 PID 3588 wrote to memory of 672 3588 E663.tmp 123 PID 672 wrote to memory of 2820 672 E78C.tmp 124 PID 2820 wrote to memory of 5412 2820 E877.tmp 125 PID 5412 wrote to memory of 5884 5412 E913.tmp 126 PID 5884 wrote to memory of 1964 5884 E9DE.tmp 127 PID 1964 wrote to memory of 4084 1964 EAB9.tmp 128 PID 4084 wrote to memory of 2424 4084 EB55.tmp 129 PID 2424 wrote to memory of 1912 2424 EC01.tmp 130 PID 1912 wrote to memory of 4464 1912 ECEB.tmp 131 PID 4464 wrote to memory of 3160 4464 EDC6.tmp 132 PID 3160 wrote to memory of 2428 3160 EE72.tmp 133 PID 2428 wrote to memory of 3644 2428 EF4D.tmp 134 PID 3644 wrote to memory of 3524 3644 EFF9.tmp 135 PID 3524 wrote to memory of 1928 3524 F0C4.tmp 136 PID 1928 wrote to memory of 5440 1928 F1CD.tmp 137 PID 5440 wrote to memory of 5020 5440 F2A8.tmp 138 PID 5020 wrote to memory of 1360 5020 F344.tmp 139 PID 1360 wrote to memory of 2440 1360 F3F0.tmp 140 PID 2440 wrote to memory of 5360 2440 F46D.tmp 141 PID 5360 wrote to memory of 3092 5360 F4FA.tmp 142 PID 3092 wrote to memory of 4580 3092 F586.tmp 143 PID 4580 wrote to memory of 1732 4580 F613.tmp 144 PID 1732 wrote to memory of 3648 1732 F690.tmp 145 PID 3648 wrote to memory of 6104 3648 F70D.tmp 146 PID 6104 wrote to memory of 3368 6104 F79A.tmp 147 PID 3368 wrote to memory of 4788 3368 F826.tmp 148 PID 4788 wrote to memory of 2528 4788 F8B3.tmp 149 PID 2528 wrote to memory of 4844 2528 F95F.tmp 150 PID 4844 wrote to memory of 1832 4844 F9EB.tmp 151 PID 1832 wrote to memory of 4528 1832 FA78.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_b842dd1d0c505a9f74c932d5a516dd2f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_b842dd1d0c505a9f74c932d5a516dd2f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\C772.tmp"C:\Users\Admin\AppData\Local\Temp\C772.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\CA02.tmp"C:\Users\Admin\AppData\Local\Temp\CA02.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\D740.tmp"C:\Users\Admin\AppData\Local\Temp\D740.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\D9A2.tmp"C:\Users\Admin\AppData\Local\Temp\D9A2.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\E087.tmp"C:\Users\Admin\AppData\Local\Temp\E087.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\E78C.tmp"C:\Users\Admin\AppData\Local\Temp\E78C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\E913.tmp"C:\Users\Admin\AppData\Local\Temp\E913.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\EFF9.tmp"C:\Users\Admin\AppData\Local\Temp\EFF9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\F4FA.tmp"C:\Users\Admin\AppData\Local\Temp\F4FA.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\F613.tmp"C:\Users\Admin\AppData\Local\Temp\F613.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\F690.tmp"C:\Users\Admin\AppData\Local\Temp\F690.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\F70D.tmp"C:\Users\Admin\AppData\Local\Temp\F70D.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\F79A.tmp"C:\Users\Admin\AppData\Local\Temp\F79A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\F826.tmp"C:\Users\Admin\AppData\Local\Temp\F826.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\FB34.tmp"C:\Users\Admin\AppData\Local\Temp\FB34.tmp"65⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"66⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"68⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"69⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"71⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"72⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"73⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\73.tmp"C:\Users\Admin\AppData\Local\Temp\73.tmp"74⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\100.tmp"C:\Users\Admin\AppData\Local\Temp\100.tmp"75⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\1BB.tmp"C:\Users\Admin\AppData\Local\Temp\1BB.tmp"76⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2C5.tmp"C:\Users\Admin\AppData\Local\Temp\2C5.tmp"78⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"79⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3FE.tmp"C:\Users\Admin\AppData\Local\Temp\3FE.tmp"80⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\4A9.tmp"C:\Users\Admin\AppData\Local\Temp\4A9.tmp"81⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"82⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5A3.tmp"C:\Users\Admin\AppData\Local\Temp\5A3.tmp"83⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"84⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\6EC.tmp"C:\Users\Admin\AppData\Local\Temp\6EC.tmp"85⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\769.tmp"C:\Users\Admin\AppData\Local\Temp\769.tmp"86⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"87⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\882.tmp"C:\Users\Admin\AppData\Local\Temp\882.tmp"88⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\91E.tmp"C:\Users\Admin\AppData\Local\Temp\91E.tmp"89⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\9BA.tmp"C:\Users\Admin\AppData\Local\Temp\9BA.tmp"90⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\A57.tmp"C:\Users\Admin\AppData\Local\Temp\A57.tmp"91⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"92⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\B70.tmp"C:\Users\Admin\AppData\Local\Temp\B70.tmp"93⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\BFC.tmp"C:\Users\Admin\AppData\Local\Temp\BFC.tmp"94⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\C89.tmp"C:\Users\Admin\AppData\Local\Temp\C89.tmp"95⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"96⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\D83.tmp"C:\Users\Admin\AppData\Local\Temp\D83.tmp"97⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"98⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\F39.tmp"C:\Users\Admin\AppData\Local\Temp\F39.tmp"100⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\FB6.tmp"C:\Users\Admin\AppData\Local\Temp\FB6.tmp"101⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"102⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\10DE.tmp"C:\Users\Admin\AppData\Local\Temp\10DE.tmp"103⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"104⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"105⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"106⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"107⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"108⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"109⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"110⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"112⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\168C.tmp"C:\Users\Admin\AppData\Local\Temp\168C.tmp"113⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\1728.tmp"C:\Users\Admin\AppData\Local\Temp\1728.tmp"114⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"115⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"116⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\18DD.tmp"C:\Users\Admin\AppData\Local\Temp\18DD.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"118⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"119⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"120⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-