Analysis
- max time kernel
118s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_12e4824f4e0b152d0101e1c9b15fc9f9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_12e4824f4e0b152d0101e1c9b15fc9f9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-31_12e4824f4e0b152d0101e1c9b15fc9f9_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260731-lrgapsdq5w
- SHA256 52261b13024ca5aa188d986f63a750aef18fab3afd1cc8d1371e91da4a76fe35
- MD5 12e4824f4e0b152d0101e1c9b15fc9f9
- SHA1 0a0caf823f86e99448081504be49607d39d2f415
- SHA512 030b0da153c0d0a5adb716d542f6d83eddffb48c4e2906385fa54f407862538461497ebe15e765a2fdf2fa4130d8c525becab76638356185468a960faa58ff5a
- SSDEEP 12288:wU5rCOTeiDW5K69pzhHrrvJTYxkRYd39gqhaouzNZ+3/v+I9hUG2VA:wUQOJDWBzhHXvJskeZhOzNGEA
- TLSH T145E4D02177D8C532E5FB037859B5E6604DBEBD226B22D6CF2F8051AE0971BC08A71763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4516 261C.tmp 4584 26D7.tmp 5744 284E.tmp 4500 2997.tmp 4676 2ABF.tmp 4344 2C65.tmp 1500 2D7F.tmp 3844 2E88.tmp 4204 2FB1.tmp 5524 30DA.tmp 5784 31D4.tmp 3416 32FD.tmp 3656 3416.tmp 360 352F.tmp 4944 3639.tmp 2812 3743.tmp 5664 385C.tmp 4768 3937.tmp 688 3A31.tmp 5572 3B59.tmp 4132 3C82.tmp 1128 3D7C.tmp 3232 3E76.tmp 2504 3F51.tmp 5148 407A.tmp 1032 4193.tmp 5464 426E.tmp 888 4397.tmp 4792 44A0.tmp 5220 45D9.tmp 5068 4702.tmp 3004 47FC.tmp 2044 4963.tmp 1780 4A5D.tmp 1072 4B28.tmp 2924 4BB5.tmp 4464 4C61.tmp 2540 4D7A.tmp 704 4E64.tmp 2760 4F20.tmp 5052 4FCC.tmp 1988 5097.tmp 5604 5152.tmp 1616 51DF.tmp 5344 52AA.tmp 4836 5385.tmp 4368 546F.tmp 2928 554A.tmp 4400 5606.tmp 5716 5683.tmp 4776 573E.tmp 2916 57EA.tmp 3136 5877.tmp 540 5932.tmp 5332 59BF.tmp 5816 5A7A.tmp 5388 5B16.tmp 1064 5BC2.tmp 4100 5C4F.tmp 3180 5CFB.tmp 3788 5D97.tmp 4800 5E24.tmp 1352 5EB0.tmp 5752 5F6C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E98B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 790A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E502.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 4516 1620 2026-07-31_12e4824f4e0b152d0101e1c9b15fc9f9_elex_mafia_stealc_tofsee.exe 89 PID 4516 wrote to memory of 4584 4516 261C.tmp 90 PID 4584 wrote to memory of 5744 4584 26D7.tmp 91 PID 5744 wrote to memory of 4500 5744 284E.tmp 92 PID 4500 wrote to memory of 4676 4500 2997.tmp 93 PID 4676 wrote to memory of 4344 4676 2ABF.tmp 94 PID 4344 wrote to memory of 1500 4344 2C65.tmp 95 PID 1500 wrote to memory of 3844 1500 2D7F.tmp 96 PID 3844 wrote to memory of 4204 3844 2E88.tmp 97 PID 4204 wrote to memory of 5524 4204 2FB1.tmp 98 PID 5524 wrote to memory of 5784 5524 30DA.tmp 99 PID 5784 wrote to memory of 3416 5784 31D4.tmp 100 PID 3416 wrote to memory of 3656 3416 32FD.tmp 101 PID 3656 wrote to memory of 360 3656 3416.tmp 102 PID 360 wrote to memory of 4944 360 352F.tmp 103 PID 4944 wrote to memory of 2812 4944 3639.tmp 104 PID 2812 wrote to memory of 5664 2812 3743.tmp 105 PID 5664 wrote to memory of 4768 5664 385C.tmp 106 PID 4768 wrote to memory of 688 4768 3937.tmp 107 PID 688 wrote to memory of 5572 688 3A31.tmp 108 PID 5572 wrote to memory of 4132 5572 3B59.tmp 109 PID 4132 wrote to memory of 1128 4132 3C82.tmp 110 PID 1128 wrote to memory of 3232 1128 3D7C.tmp 111 PID 3232 wrote to memory of 2504 3232 3E76.tmp 112 PID 2504 wrote to memory of 5148 2504 3F51.tmp 113 PID 5148 wrote to memory of 1032 5148 407A.tmp 114 PID 1032 wrote to memory of 5464 1032 4193.tmp 115 PID 5464 wrote to memory of 888 5464 426E.tmp 116 PID 888 wrote to memory of 4792 888 4397.tmp 117 PID 4792 wrote to memory of 5220 4792 44A0.tmp 118 PID 5220 wrote to memory of 5068 5220 45D9.tmp 119 PID 5068 wrote to memory of 3004 5068 4702.tmp 120 PID 3004 wrote to memory of 2044 3004 47FC.tmp 121 PID 2044 wrote to memory of 1780 2044 4963.tmp 122 PID 1780 wrote to memory of 1072 1780 4A5D.tmp 123 PID 1072 wrote to memory of 2924 1072 4B28.tmp 124 PID 2924 wrote to memory of 4464 2924 4BB5.tmp 125 PID 4464 wrote to memory of 2540 4464 4C61.tmp 126 PID 2540 wrote to memory of 704 2540 4D7A.tmp 127 PID 704 wrote to memory of 2760 704 4E64.tmp 128 PID 2760 wrote to memory of 5052 2760 4F20.tmp 129 PID 5052 wrote to memory of 1988 5052 4FCC.tmp 130 PID 1988 wrote to memory of 5604 1988 5097.tmp 131 PID 5604 wrote to memory of 1616 5604 5152.tmp 132 PID 1616 wrote to memory of 5344 1616 51DF.tmp 133 PID 5344 wrote to memory of 4836 5344 52AA.tmp 134 PID 4836 wrote to memory of 4368 4836 5385.tmp 135 PID 4368 wrote to memory of 2928 4368 546F.tmp 136 PID 2928 wrote to memory of 4400 2928 554A.tmp 137 PID 4400 wrote to memory of 5716 4400 5606.tmp 138 PID 5716 wrote to memory of 4776 5716 5683.tmp 139 PID 4776 wrote to memory of 2916 4776 573E.tmp 140 PID 2916 wrote to memory of 3136 2916 57EA.tmp 141 PID 3136 wrote to memory of 540 3136 5877.tmp 142 PID 540 wrote to memory of 5332 540 5932.tmp 143 PID 5332 wrote to memory of 5816 5332 59BF.tmp 144 PID 5816 wrote to memory of 5388 5816 5A7A.tmp 145 PID 5388 wrote to memory of 1064 5388 5B16.tmp 146 PID 1064 wrote to memory of 4100 1064 5BC2.tmp 147 PID 4100 wrote to memory of 3180 4100 5C4F.tmp 148 PID 3180 wrote to memory of 3788 3180 5CFB.tmp 149 PID 3788 wrote to memory of 4800 3788 5D97.tmp 150 PID 4800 wrote to memory of 1352 4800 5E24.tmp 151 PID 1352 wrote to memory of 5752 1352 5EB0.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_12e4824f4e0b152d0101e1c9b15fc9f9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_12e4824f4e0b152d0101e1c9b15fc9f9_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\261C.tmp"C:\Users\Admin\AppData\Local\Temp\261C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\26D7.tmp"C:\Users\Admin\AppData\Local\Temp\26D7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2C65.tmp"C:\Users\Admin\AppData\Local\Temp\2C65.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\30DA.tmp"C:\Users\Admin\AppData\Local\Temp\30DA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\32FD.tmp"C:\Users\Admin\AppData\Local\Temp\32FD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\352F.tmp"C:\Users\Admin\AppData\Local\Temp\352F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\385C.tmp"C:\Users\Admin\AppData\Local\Temp\385C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\3A31.tmp"C:\Users\Admin\AppData\Local\Temp\3A31.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\3C82.tmp"C:\Users\Admin\AppData\Local\Temp\3C82.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\4702.tmp"C:\Users\Admin\AppData\Local\Temp\4702.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4C61.tmp"C:\Users\Admin\AppData\Local\Temp\4C61.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4E64.tmp"C:\Users\Admin\AppData\Local\Temp\4E64.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5683.tmp"C:\Users\Admin\AppData\Local\Temp\5683.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\57EA.tmp"C:\Users\Admin\AppData\Local\Temp\57EA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5932.tmp"C:\Users\Admin\AppData\Local\Temp\5932.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\59BF.tmp"C:\Users\Admin\AppData\Local\Temp\59BF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"65⤵
- Executes dropped EXE
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"66⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"67⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"68⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\61EC.tmp"C:\Users\Admin\AppData\Local\Temp\61EC.tmp"69⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\6279.tmp"C:\Users\Admin\AppData\Local\Temp\6279.tmp"70⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\6325.tmp"C:\Users\Admin\AppData\Local\Temp\6325.tmp"71⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\63D1.tmp"C:\Users\Admin\AppData\Local\Temp\63D1.tmp"72⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\645D.tmp"C:\Users\Admin\AppData\Local\Temp\645D.tmp"73⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\64EA.tmp"C:\Users\Admin\AppData\Local\Temp\64EA.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"75⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"76⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"77⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"78⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"79⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\6884.tmp"C:\Users\Admin\AppData\Local\Temp\6884.tmp"80⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\6930.tmp"C:\Users\Admin\AppData\Local\Temp\6930.tmp"81⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\69DC.tmp"C:\Users\Admin\AppData\Local\Temp\69DC.tmp"82⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\6A78.tmp"C:\Users\Admin\AppData\Local\Temp\6A78.tmp"83⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"84⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"86⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"87⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"88⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\6E02.tmp"C:\Users\Admin\AppData\Local\Temp\6E02.tmp"89⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"91⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"92⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\7073.tmp"C:\Users\Admin\AppData\Local\Temp\7073.tmp"93⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"94⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"95⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"96⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\72C5.tmp"C:\Users\Admin\AppData\Local\Temp\72C5.tmp"97⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7352.tmp"C:\Users\Admin\AppData\Local\Temp\7352.tmp"98⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\73FD.tmp"C:\Users\Admin\AppData\Local\Temp\73FD.tmp"99⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"100⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"101⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\75B3.tmp"C:\Users\Admin\AppData\Local\Temp\75B3.tmp"102⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"103⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"104⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\7788.tmp"C:\Users\Admin\AppData\Local\Temp\7788.tmp"105⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"106⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\78FF.tmp"C:\Users\Admin\AppData\Local\Temp\78FF.tmp"107⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\799B.tmp"C:\Users\Admin\AppData\Local\Temp\799B.tmp"108⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"109⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"110⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"111⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\7BED.tmp"C:\Users\Admin\AppData\Local\Temp\7BED.tmp"112⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\7C89.tmp"C:\Users\Admin\AppData\Local\Temp\7C89.tmp"113⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"114⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"115⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"116⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"117⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"118⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"119⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"120⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\812C.tmp"C:\Users\Admin\AppData\Local\Temp\812C.tmp"121⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-