Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_19338c0e9c449c356364009dbdb6b004_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_19338c0e9c449c356364009dbdb6b004_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_19338c0e9c449c356364009dbdb6b004_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260804-dv16aacb83
- SHA256 208eeb1e839182cdfd0b3bdec4d9913570b232a95717d00d347b84631c3bdfc7
- MD5 19338c0e9c449c356364009dbdb6b004
- SHA1 381432ac3d6ffedb355c5a64c440524e81a7375c
- SHA512 30c83d17d01dbf7c17aafb4c55413502f7c2421bb2395b2de7620dbfd4cfed0d0b8a234f515ca38b05e335a7609a1169e11cc3f52432ac086bead54d00797883
- SSDEEP 12288:NU5rCOTeijIE9ZGftCTEQcW/4NItijWBSidotDTZwlH:NUQOJjIIStUEBWgWMisTSlH
- TLSH T151B4F1267645C132E5D202340AD6EBB26A3BBC354B26A4C737D4673E2FB56E1E370346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4296 1FF.tmp 2160 29B.tmp 3316 347.tmp 3476 3F3.tmp 2004 49F.tmp 4820 52B.tmp 2752 5D7.tmp 4312 683.tmp 4400 710.tmp 824 7BB.tmp 3664 858.tmp 5112 8D5.tmp 2260 990.tmp 2704 A5B.tmp 4884 AF8.tmp 2496 B84.tmp 4344 C11.tmp 3836 CBD.tmp 4488 D69.tmp 364 DF5.tmp 4468 E82.tmp 4600 F0E.tmp 224 F9B.tmp 2376 1028.tmp 3908 10A5.tmp 1740 1131.tmp 848 11AE.tmp 3612 123B.tmp 1292 12B8.tmp 4228 1335.tmp 3864 13D1.tmp 5100 144E.tmp 4892 14CB.tmp 1620 1548.tmp 1844 1596.tmp 4352 15E4.tmp 2508 1633.tmp 4648 16A0.tmp 2328 16EE.tmp 964 175B.tmp 1280 17C9.tmp 4268 1817.tmp 1236 1865.tmp 1864 18D2.tmp 3196 1921.tmp 2768 197E.tmp 4240 19CC.tmp 2904 1A1B.tmp 4932 1A78.tmp 2764 1AD6.tmp 1656 1B43.tmp 2644 1B92.tmp 4284 1BE0.tmp 692 1C3D.tmp 3984 1CAB.tmp 3604 1D09.tmp 4560 1D57.tmp 3052 1DB4.tmp 592 1E03.tmp 2128 1E51.tmp 3356 1EAE.tmp 3292 1EFD.tmp 2180 1F4B.tmp 4024 1F99.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D50E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 530D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F76B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 870D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E395.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 437C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1472 wrote to memory of 4296 1472 2026-08-03_19338c0e9c449c356364009dbdb6b004_elex_mafia_stealc_tofsee.exe 88 PID 4296 wrote to memory of 2160 4296 1FF.tmp 89 PID 2160 wrote to memory of 3316 2160 29B.tmp 90 PID 3316 wrote to memory of 3476 3316 347.tmp 91 PID 3476 wrote to memory of 2004 3476 3F3.tmp 92 PID 2004 wrote to memory of 4820 2004 49F.tmp 93 PID 4820 wrote to memory of 2752 4820 52B.tmp 94 PID 2752 wrote to memory of 4312 2752 5D7.tmp 95 PID 4312 wrote to memory of 4400 4312 683.tmp 96 PID 4400 wrote to memory of 824 4400 710.tmp 97 PID 824 wrote to memory of 3664 824 7BB.tmp 98 PID 3664 wrote to memory of 5112 3664 858.tmp 99 PID 5112 wrote to memory of 2260 5112 8D5.tmp 100 PID 2260 wrote to memory of 2704 2260 990.tmp 101 PID 2704 wrote to memory of 4884 2704 A5B.tmp 102 PID 4884 wrote to memory of 2496 4884 AF8.tmp 103 PID 2496 wrote to memory of 4344 2496 B84.tmp 104 PID 4344 wrote to memory of 3836 4344 C11.tmp 105 PID 3836 wrote to memory of 4488 3836 CBD.tmp 106 PID 4488 wrote to memory of 364 4488 D69.tmp 107 PID 364 wrote to memory of 4468 364 DF5.tmp 108 PID 4468 wrote to memory of 4600 4468 E82.tmp 109 PID 4600 wrote to memory of 224 4600 F0E.tmp 110 PID 224 wrote to memory of 2376 224 F9B.tmp 111 PID 2376 wrote to memory of 3908 2376 1028.tmp 112 PID 3908 wrote to memory of 1740 3908 10A5.tmp 113 PID 1740 wrote to memory of 848 1740 1131.tmp 114 PID 848 wrote to memory of 3612 848 11AE.tmp 115 PID 3612 wrote to memory of 1292 3612 123B.tmp 116 PID 1292 wrote to memory of 4228 1292 12B8.tmp 117 PID 4228 wrote to memory of 3864 4228 1335.tmp 118 PID 3864 wrote to memory of 5100 3864 13D1.tmp 119 PID 5100 wrote to memory of 4892 5100 144E.tmp 120 PID 4892 wrote to memory of 1620 4892 14CB.tmp 121 PID 1620 wrote to memory of 1844 1620 1548.tmp 122 PID 1844 wrote to memory of 4352 1844 1596.tmp 123 PID 4352 wrote to memory of 2508 4352 15E4.tmp 124 PID 2508 wrote to memory of 4648 2508 1633.tmp 125 PID 4648 wrote to memory of 2328 4648 16A0.tmp 126 PID 2328 wrote to memory of 964 2328 16EE.tmp 127 PID 964 wrote to memory of 1280 964 175B.tmp 128 PID 1280 wrote to memory of 4268 1280 17C9.tmp 129 PID 4268 wrote to memory of 1236 4268 1817.tmp 130 PID 1236 wrote to memory of 1864 1236 1865.tmp 131 PID 1864 wrote to memory of 3196 1864 18D2.tmp 132 PID 3196 wrote to memory of 2768 3196 1921.tmp 133 PID 2768 wrote to memory of 4240 2768 197E.tmp 134 PID 4240 wrote to memory of 2904 4240 19CC.tmp 135 PID 2904 wrote to memory of 4932 2904 1A1B.tmp 136 PID 4932 wrote to memory of 2764 4932 1A78.tmp 137 PID 2764 wrote to memory of 1656 2764 1AD6.tmp 138 PID 1656 wrote to memory of 2644 1656 1B43.tmp 139 PID 2644 wrote to memory of 4284 2644 1B92.tmp 140 PID 4284 wrote to memory of 692 4284 1BE0.tmp 141 PID 692 wrote to memory of 3984 692 1C3D.tmp 142 PID 3984 wrote to memory of 3604 3984 1CAB.tmp 143 PID 3604 wrote to memory of 4560 3604 1D09.tmp 144 PID 4560 wrote to memory of 3052 4560 1D57.tmp 145 PID 3052 wrote to memory of 592 3052 1DB4.tmp 146 PID 592 wrote to memory of 2128 592 1E03.tmp 147 PID 2128 wrote to memory of 3356 2128 1E51.tmp 148 PID 3356 wrote to memory of 3292 3356 1EAE.tmp 149 PID 3292 wrote to memory of 2180 3292 1EFD.tmp 150 PID 2180 wrote to memory of 4024 2180 1F4B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_19338c0e9c449c356364009dbdb6b004_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_19338c0e9c449c356364009dbdb6b004_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"65⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"66⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"67⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"68⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"69⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"70⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"71⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"73⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"74⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"75⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"76⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"77⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"78⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"79⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"80⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"81⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"82⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"83⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"84⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"85⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"86⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"87⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"88⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"89⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"90⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"91⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"93⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"94⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"95⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"96⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"97⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"98⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"99⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"100⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"101⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"102⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"103⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"104⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"105⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"106⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"107⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"108⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"109⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"110⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"111⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"112⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"113⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"115⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"116⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"117⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"118⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"119⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"120⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"121⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-