Analysis
- max time kernel
137s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 14:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_bf88570924a4f8214e71737eae4e2ca8_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_bf88570924a4f8214e71737eae4e2ca8_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_bf88570924a4f8214e71737eae4e2ca8_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260803-rdfd5s1fpg
- SHA256 ff15a04b51f38c0a6e9b0a6e2f579b82eb0bfb28bfeb207c10501ef839cbf2a3
- MD5 bf88570924a4f8214e71737eae4e2ca8
- SHA1 8e7a5152e89a19ce9bd07bd60ad7a2d81751163c
- SHA512 4baa6889bbdd888e37b13b76807394b3ff98140aea0468ef10b2c694e513bd7d5f51577b2ce9d0f2ffd2d08968b976672c1e9f637ae5f78f864792f8309cfa2d
- SSDEEP 12288:wU5rCOTeiDo3mAW9FD4dfvxtFXBtNZ+3/v+I9hUG2VA:wUQOJDo3k7eTxtNGEA
- TLSH T16AE4D12173D88132E5F7037859B5E6654D7EBD32A722D6DF2F8016AE09B1BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6116 98EF.tmp 4548 9A57.tmp 1312 9B80.tmp 4876 9CC8.tmp 4868 9D74.tmp 4952 9EAC.tmp 1220 9F68.tmp 4464 A071.tmp 1392 A16B.tmp 624 A284.tmp 5764 A340.tmp 5760 A43A.tmp 5840 A544.tmp 2256 A68C.tmp 3828 A7B5.tmp 5752 A8CE.tmp 3608 A95A.tmp 2356 A9E7.tmp 5520 AAB2.tmp 3708 AB5E.tmp 440 ABBC.tmp 5212 AC29.tmp 640 AD91.tmp 64 ADDF.tmp 3664 AEAA.tmp 5508 AF56.tmp 5532 AFB3.tmp 3956 B08E.tmp 3544 B1D6.tmp 5976 B263.tmp 2176 B30F.tmp 2560 B3EA.tmp 4436 B4F3.tmp 2532 B5AF.tmp 5732 B67A.tmp 756 B735.tmp 4976 B7E1.tmp 204 B8AC.tmp 4472 B968.tmp 3796 B9E5.tmp 5756 BA81.tmp 4136 BB2D.tmp 3160 BBC9.tmp 4836 BC65.tmp 3960 BD02.tmp 5176 BD8E.tmp 4912 BE3A.tmp 3728 BEC7.tmp 1652 BF82.tmp 5688 C01F.tmp 4036 C06D.tmp 2372 C0CA.tmp 5856 C128.tmp 876 C196.tmp 4892 C1F3.tmp 4512 C261.tmp 3268 C2ED.tmp 2472 C34B.tmp 4236 C399.tmp 4688 C3E7.tmp 2764 C435.tmp 5868 C493.tmp 1356 C4F1.tmp 3220 C55E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B08E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E257.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B67A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 910B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F41A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C83D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5589.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 6116 4956 2026-08-03_bf88570924a4f8214e71737eae4e2ca8_elex_mafia_stealc_tofsee.exe 84 PID 6116 wrote to memory of 4548 6116 98EF.tmp 85 PID 4548 wrote to memory of 1312 4548 9A57.tmp 86 PID 1312 wrote to memory of 4876 1312 9B80.tmp 87 PID 4876 wrote to memory of 4868 4876 9CC8.tmp 88 PID 4868 wrote to memory of 4952 4868 9D74.tmp 89 PID 4952 wrote to memory of 1220 4952 9EAC.tmp 90 PID 1220 wrote to memory of 4464 1220 9F68.tmp 91 PID 4464 wrote to memory of 1392 4464 A071.tmp 92 PID 1392 wrote to memory of 624 1392 A16B.tmp 93 PID 624 wrote to memory of 5764 624 A284.tmp 94 PID 5764 wrote to memory of 5760 5764 A340.tmp 95 PID 5760 wrote to memory of 5840 5760 A43A.tmp 96 PID 5840 wrote to memory of 2256 5840 A544.tmp 97 PID 2256 wrote to memory of 3828 2256 A68C.tmp 98 PID 3828 wrote to memory of 5752 3828 A7B5.tmp 99 PID 5752 wrote to memory of 3608 5752 A8CE.tmp 100 PID 3608 wrote to memory of 2356 3608 A95A.tmp 101 PID 2356 wrote to memory of 5520 2356 A9E7.tmp 102 PID 5520 wrote to memory of 3708 5520 AAB2.tmp 103 PID 3708 wrote to memory of 440 3708 AB5E.tmp 104 PID 440 wrote to memory of 5212 440 ABBC.tmp 105 PID 5212 wrote to memory of 640 5212 AC29.tmp 106 PID 640 wrote to memory of 64 640 AD91.tmp 107 PID 64 wrote to memory of 3664 64 ADDF.tmp 108 PID 3664 wrote to memory of 5508 3664 AEAA.tmp 109 PID 5508 wrote to memory of 5532 5508 AF56.tmp 110 PID 5532 wrote to memory of 3956 5532 AFB3.tmp 111 PID 3956 wrote to memory of 3544 3956 B08E.tmp 112 PID 3544 wrote to memory of 5976 3544 B1D6.tmp 114 PID 5976 wrote to memory of 2176 5976 B263.tmp 117 PID 2176 wrote to memory of 2560 2176 B30F.tmp 118 PID 2560 wrote to memory of 4436 2560 B3EA.tmp 119 PID 4436 wrote to memory of 2532 4436 B4F3.tmp 120 PID 2532 wrote to memory of 5732 2532 B5AF.tmp 121 PID 5732 wrote to memory of 756 5732 B67A.tmp 123 PID 756 wrote to memory of 4976 756 B735.tmp 124 PID 4976 wrote to memory of 204 4976 B7E1.tmp 125 PID 204 wrote to memory of 4472 204 B8AC.tmp 126 PID 4472 wrote to memory of 3796 4472 B968.tmp 127 PID 3796 wrote to memory of 5756 3796 B9E5.tmp 128 PID 5756 wrote to memory of 4136 5756 BA81.tmp 129 PID 4136 wrote to memory of 3160 4136 BB2D.tmp 130 PID 3160 wrote to memory of 4836 3160 BBC9.tmp 131 PID 4836 wrote to memory of 3960 4836 BC65.tmp 132 PID 3960 wrote to memory of 5176 3960 BD02.tmp 133 PID 5176 wrote to memory of 4912 5176 BD8E.tmp 134 PID 4912 wrote to memory of 3728 4912 BE3A.tmp 135 PID 3728 wrote to memory of 1652 3728 BEC7.tmp 136 PID 1652 wrote to memory of 5688 1652 BF82.tmp 137 PID 5688 wrote to memory of 4036 5688 C01F.tmp 138 PID 4036 wrote to memory of 2372 4036 C06D.tmp 139 PID 2372 wrote to memory of 5856 2372 C0CA.tmp 140 PID 5856 wrote to memory of 876 5856 C128.tmp 141 PID 876 wrote to memory of 4892 876 C196.tmp 142 PID 4892 wrote to memory of 4512 4892 C1F3.tmp 143 PID 4512 wrote to memory of 3268 4512 C261.tmp 144 PID 3268 wrote to memory of 2472 3268 C2ED.tmp 145 PID 2472 wrote to memory of 4236 2472 C34B.tmp 146 PID 4236 wrote to memory of 4688 4236 C399.tmp 147 PID 4688 wrote to memory of 2764 4688 C3E7.tmp 148 PID 2764 wrote to memory of 5868 2764 C435.tmp 149 PID 5868 wrote to memory of 1356 5868 C493.tmp 150 PID 1356 wrote to memory of 3220 1356 C4F1.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bf88570924a4f8214e71737eae4e2ca8_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bf88570924a4f8214e71737eae4e2ca8_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\A16B.tmp"C:\Users\Admin\AppData\Local\Temp\A16B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A284.tmp"C:\Users\Admin\AppData\Local\Temp\A284.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\A340.tmp"C:\Users\Admin\AppData\Local\Temp\A340.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\AD91.tmp"C:\Users\Admin\AppData\Local\Temp\AD91.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\AF56.tmp"C:\Users\Admin\AppData\Local\Temp\AF56.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\B1D6.tmp"C:\Users\Admin\AppData\Local\Temp\B1D6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\B30F.tmp"C:\Users\Admin\AppData\Local\Temp\B30F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\B67A.tmp"C:\Users\Admin\AppData\Local\Temp\B67A.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\B735.tmp"C:\Users\Admin\AppData\Local\Temp\B735.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\BA81.tmp"C:\Users\Admin\AppData\Local\Temp\BA81.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\BD02.tmp"C:\Users\Admin\AppData\Local\Temp\BD02.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\BF82.tmp"C:\Users\Admin\AppData\Local\Temp\BF82.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\C01F.tmp"C:\Users\Admin\AppData\Local\Temp\C01F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\C196.tmp"C:\Users\Admin\AppData\Local\Temp\C196.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\C1F3.tmp"C:\Users\Admin\AppData\Local\Temp\C1F3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\C261.tmp"C:\Users\Admin\AppData\Local\Temp\C261.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C3E7.tmp"C:\Users\Admin\AppData\Local\Temp\C3E7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\C435.tmp"C:\Users\Admin\AppData\Local\Temp\C435.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\C493.tmp"C:\Users\Admin\AppData\Local\Temp\C493.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"65⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"66⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\C60A.tmp"C:\Users\Admin\AppData\Local\Temp\C60A.tmp"67⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\C658.tmp"C:\Users\Admin\AppData\Local\Temp\C658.tmp"68⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"70⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\C772.tmp"C:\Users\Admin\AppData\Local\Temp\C772.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"72⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"74⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"75⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"76⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"77⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"78⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"79⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"80⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"81⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"82⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"83⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"84⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"85⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"86⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"87⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"88⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"89⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"90⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"91⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"92⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"94⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"95⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"96⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"97⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\D03C.tmp"C:\Users\Admin\AppData\Local\Temp\D03C.tmp"98⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"99⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"100⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"101⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\D174.tmp"C:\Users\Admin\AppData\Local\Temp\D174.tmp"102⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"103⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\D210.tmp"C:\Users\Admin\AppData\Local\Temp\D210.tmp"104⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\D25E.tmp"C:\Users\Admin\AppData\Local\Temp\D25E.tmp"105⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"106⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"107⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"108⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"109⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"110⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"111⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"112⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\D5AA.tmp"C:\Users\Admin\AppData\Local\Temp\D5AA.tmp"113⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"114⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"115⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"116⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"117⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\D77F.tmp"C:\Users\Admin\AppData\Local\Temp\D77F.tmp"118⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"119⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"120⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"121⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\D906.tmp"C:\Users\Admin\AppData\Local\Temp\D906.tmp"122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-