Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260731-t2s19axygs
- SHA256 16fe3d34c6ddf87d946aa1c557117018b02e7281a24348341e1740045492755f
- MD5 d706415347c227fdedee1ce76367fd5b
- SHA1 8be656e9667577bbe7eec03ee0ddaf442cafb575
- SHA512 99a0269c09b9bb4f7e3f2ab5fe5d60d895ad415b5bd0a5ca0430e6de10e2f4f798cab3b69db3cb295228d8b062e89975b9b389071693c76a796ef474bc4dbe9d
- SSDEEP 12288:NU5rCOTeijo5zwfPmcrrrWhtLTZwlH4Hp:NUQOJjOwn5rHQtLTSlH4Hp
- TLSH T132B4E125B689C133E69201710AE6D7A22A3F7D311766A4C33B94623E2FB67E1D375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2280 8632.tmp 5092 86DE.tmp 4196 879A.tmp 2540 8875.tmp 4704 8911.tmp 4776 898E.tmp 4960 8A2A.tmp 2836 8AC6.tmp 1248 8B43.tmp 1352 8BE0.tmp 3052 8C4D.tmp 1668 8CDA.tmp 4036 8D85.tmp 1764 8DE3.tmp 1676 8E7F.tmp 3048 8F5A.tmp 4844 8FE7.tmp 2220 9073.tmp 4580 90F0.tmp 4268 918D.tmp 3256 91FA.tmp 4216 92A6.tmp 2488 9333.tmp 1956 93DE.tmp 4944 947B.tmp 2732 9527.tmp 5048 95B3.tmp 2460 9640.tmp 548 96DC.tmp 3476 9749.tmp 628 97F5.tmp 4972 9882.tmp 2572 991E.tmp 4140 996C.tmp 3900 99BA.tmp 3360 9A09.tmp 3788 9A76.tmp 3764 9AE3.tmp 5060 9B51.tmp 4980 9B9F.tmp 2984 9C0C.tmp 1496 9C7A.tmp 1356 9CE7.tmp 4428 9D45.tmp 2476 9D93.tmp 2672 9DE1.tmp 2596 9E2F.tmp 3328 9E7D.tmp 1032 9ECB.tmp 2928 9F19.tmp 5112 9F68.tmp 4136 9FB6.tmp 1132 A004.tmp 4828 A052.tmp 1924 A0A0.tmp 4476 A0EE.tmp 4368 A13C.tmp 3848 A19A.tmp 4608 A1F8.tmp 4572 A246.tmp 2348 A2A4.tmp 2292 A2F2.tmp 1940 A340.tmp 2708 A38E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A01E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F16B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C59D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 390.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C8D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 2280 4116 2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe 85 PID 2280 wrote to memory of 5092 2280 8632.tmp 86 PID 5092 wrote to memory of 4196 5092 86DE.tmp 87 PID 4196 wrote to memory of 2540 4196 879A.tmp 88 PID 2540 wrote to memory of 4704 2540 8875.tmp 89 PID 4704 wrote to memory of 4776 4704 8911.tmp 90 PID 4776 wrote to memory of 4960 4776 898E.tmp 91 PID 4960 wrote to memory of 2836 4960 8A2A.tmp 92 PID 2836 wrote to memory of 1248 2836 8AC6.tmp 93 PID 1248 wrote to memory of 1352 1248 8B43.tmp 94 PID 1352 wrote to memory of 3052 1352 8BE0.tmp 95 PID 3052 wrote to memory of 1668 3052 8C4D.tmp 96 PID 1668 wrote to memory of 4036 1668 8CDA.tmp 97 PID 4036 wrote to memory of 1764 4036 8D85.tmp 98 PID 1764 wrote to memory of 1676 1764 8DE3.tmp 99 PID 1676 wrote to memory of 3048 1676 8E7F.tmp 100 PID 3048 wrote to memory of 4844 3048 8F5A.tmp 103 PID 4844 wrote to memory of 2220 4844 8FE7.tmp 104 PID 2220 wrote to memory of 4580 2220 9073.tmp 105 PID 4580 wrote to memory of 4268 4580 90F0.tmp 106 PID 4268 wrote to memory of 3256 4268 918D.tmp 107 PID 3256 wrote to memory of 4216 3256 91FA.tmp 108 PID 4216 wrote to memory of 2488 4216 92A6.tmp 109 PID 2488 wrote to memory of 1956 2488 9333.tmp 110 PID 1956 wrote to memory of 4944 1956 93DE.tmp 112 PID 4944 wrote to memory of 2732 4944 947B.tmp 114 PID 2732 wrote to memory of 5048 2732 9527.tmp 115 PID 5048 wrote to memory of 2460 5048 95B3.tmp 116 PID 2460 wrote to memory of 548 2460 9640.tmp 117 PID 548 wrote to memory of 3476 548 96DC.tmp 118 PID 3476 wrote to memory of 628 3476 9749.tmp 119 PID 628 wrote to memory of 4972 628 97F5.tmp 120 PID 4972 wrote to memory of 2572 4972 9882.tmp 121 PID 2572 wrote to memory of 4140 2572 991E.tmp 122 PID 4140 wrote to memory of 3900 4140 996C.tmp 123 PID 3900 wrote to memory of 3360 3900 99BA.tmp 124 PID 3360 wrote to memory of 3788 3360 9A09.tmp 125 PID 3788 wrote to memory of 3764 3788 9A76.tmp 126 PID 3764 wrote to memory of 5060 3764 9AE3.tmp 127 PID 5060 wrote to memory of 4980 5060 9B51.tmp 128 PID 4980 wrote to memory of 2984 4980 9B9F.tmp 129 PID 2984 wrote to memory of 1496 2984 9C0C.tmp 130 PID 1496 wrote to memory of 1356 1496 9C7A.tmp 131 PID 1356 wrote to memory of 4428 1356 9CE7.tmp 132 PID 4428 wrote to memory of 2476 4428 9D45.tmp 133 PID 2476 wrote to memory of 2672 2476 9D93.tmp 134 PID 2672 wrote to memory of 2596 2672 9DE1.tmp 135 PID 2596 wrote to memory of 3328 2596 9E2F.tmp 136 PID 3328 wrote to memory of 1032 3328 9E7D.tmp 137 PID 1032 wrote to memory of 2928 1032 9ECB.tmp 138 PID 2928 wrote to memory of 5112 2928 9F19.tmp 139 PID 5112 wrote to memory of 4136 5112 9F68.tmp 140 PID 4136 wrote to memory of 1132 4136 9FB6.tmp 141 PID 1132 wrote to memory of 4828 1132 A004.tmp 143 PID 4828 wrote to memory of 1924 4828 A052.tmp 144 PID 1924 wrote to memory of 4476 1924 A0A0.tmp 145 PID 4476 wrote to memory of 4368 4476 A0EE.tmp 146 PID 4368 wrote to memory of 3848 4368 A13C.tmp 147 PID 3848 wrote to memory of 4608 3848 A19A.tmp 149 PID 4608 wrote to memory of 4572 4608 A1F8.tmp 150 PID 4572 wrote to memory of 2348 4572 A246.tmp 151 PID 2348 wrote to memory of 2292 2348 A2A4.tmp 153 PID 2292 wrote to memory of 1940 2292 A2F2.tmp 155 PID 1940 wrote to memory of 2708 1940 A340.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\8875.tmp"C:\Users\Admin\AppData\Local\Temp\8875.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\898E.tmp"C:\Users\Admin\AppData\Local\Temp\898E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8D85.tmp"C:\Users\Admin\AppData\Local\Temp\8D85.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\9073.tmp"C:\Users\Admin\AppData\Local\Temp\9073.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\918D.tmp"C:\Users\Admin\AppData\Local\Temp\918D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\92A6.tmp"C:\Users\Admin\AppData\Local\Temp\92A6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\9333.tmp"C:\Users\Admin\AppData\Local\Temp\9333.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\95B3.tmp"C:\Users\Admin\AppData\Local\Temp\95B3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9640.tmp"C:\Users\Admin\AppData\Local\Temp\9640.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\96DC.tmp"C:\Users\Admin\AppData\Local\Temp\96DC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\9882.tmp"C:\Users\Admin\AppData\Local\Temp\9882.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\996C.tmp"C:\Users\Admin\AppData\Local\Temp\996C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\9A09.tmp"C:\Users\Admin\AppData\Local\Temp\9A09.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\9A76.tmp"C:\Users\Admin\AppData\Local\Temp\9A76.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\9D45.tmp"C:\Users\Admin\AppData\Local\Temp\9D45.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\9F19.tmp"C:\Users\Admin\AppData\Local\Temp\9F19.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\A19A.tmp"C:\Users\Admin\AppData\Local\Temp\A19A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\A340.tmp"C:\Users\Admin\AppData\Local\Temp\A340.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"65⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A3DC.tmp"C:\Users\Admin\AppData\Local\Temp\A3DC.tmp"66⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\A42A.tmp"C:\Users\Admin\AppData\Local\Temp\A42A.tmp"67⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A478.tmp"C:\Users\Admin\AppData\Local\Temp\A478.tmp"68⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"69⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\A524.tmp"C:\Users\Admin\AppData\Local\Temp\A524.tmp"70⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\A572.tmp"C:\Users\Admin\AppData\Local\Temp\A572.tmp"71⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"72⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"73⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"74⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"75⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"76⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"77⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"78⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"79⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\A870.tmp"C:\Users\Admin\AppData\Local\Temp\A870.tmp"80⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"81⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"82⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"83⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"84⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\AA26.tmp"C:\Users\Admin\AppData\Local\Temp\AA26.tmp"85⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\AA93.tmp"C:\Users\Admin\AppData\Local\Temp\AA93.tmp"86⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\AB00.tmp"C:\Users\Admin\AppData\Local\Temp\AB00.tmp"87⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"88⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"89⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"90⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\AC77.tmp"C:\Users\Admin\AppData\Local\Temp\AC77.tmp"91⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"92⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\AD42.tmp"C:\Users\Admin\AppData\Local\Temp\AD42.tmp"93⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"94⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"95⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"96⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"97⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\AF17.tmp"C:\Users\Admin\AppData\Local\Temp\AF17.tmp"98⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"99⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"100⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"101⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B06F.tmp"C:\Users\Admin\AppData\Local\Temp\B06F.tmp"102⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"103⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"104⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\B179.tmp"C:\Users\Admin\AppData\Local\Temp\B179.tmp"105⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"106⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B215.tmp"C:\Users\Admin\AppData\Local\Temp\B215.tmp"107⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"108⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"109⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"110⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"111⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\B39B.tmp"C:\Users\Admin\AppData\Local\Temp\B39B.tmp"112⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"114⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"115⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"116⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\B561.tmp"C:\Users\Admin\AppData\Local\Temp\B561.tmp"117⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"118⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\B63B.tmp"C:\Users\Admin\AppData\Local\Temp\B63B.tmp"119⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B6B8.tmp"C:\Users\Admin\AppData\Local\Temp\B6B8.tmp"120⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\B706.tmp"C:\Users\Admin\AppData\Local\Temp\B706.tmp"121⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"122⤵PID:3548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-