Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_59b09e8cc61488f48d7084acf6d44c95_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_59b09e8cc61488f48d7084acf6d44c95_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-05_59b09e8cc61488f48d7084acf6d44c95_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260805-w5zdjstdmc
- SHA256 2d33acaa817265e01229c9f0386279eeee1badcf85a5c7e0fb166d9a8a1f0305
- MD5 59b09e8cc61488f48d7084acf6d44c95
- SHA1 afa7c895730ee6709ed21692701eb3cc467ea1c1
- SHA512 e4e247385fc54bf4f8d9744cc644e4bfbf096dc35cd9b938831762a3f367ae2ba0f7acc10a811a75efef450ae98bb0d8767c0893200dbbc0cf9437c4f815216c
- SSDEEP 12288:9U5rCOTei6pYoPb0WIrFkPW3geZIVs33vSy/qqZoXWjdqpby1grA70G+o:9UQOJ6pYoPIW6kPnhq36y/qqqGh4yAT4
- TLSH T132E401217A88C032EA8612304EE6EB72297E7D75572664C77BC06A7E6F742D1D339307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4456 FF40.tmp 2568 B.tmp 2680 E5.tmp 2540 1D0.tmp 2060 29B.tmp 2140 3B4.tmp 2944 460.tmp 4880 54A.tmp 4156 5E7.tmp 2696 6C1.tmp 3000 75E.tmp 1876 7EA.tmp 1028 8B5.tmp 1956 990.tmp 1744 A4C.tmp 3360 B07.tmp 2952 BC3.tmp 3228 C40.tmp 2364 CCC.tmp 628 DD6.tmp 3404 E63.tmp 4996 F4D.tmp 1404 1028.tmp 2688 1102.tmp 1200 11FC.tmp 5104 1299.tmp 2804 1354.tmp 4908 141F.tmp 212 14FA.tmp 4580 15C5.tmp 1952 1661.tmp 3772 171D.tmp 3472 17D8.tmp 4900 1846.tmp 1264 18A4.tmp 2936 18F2.tmp 4600 194F.tmp 3004 199E.tmp 1616 19EC.tmp 4288 1A69.tmp 1872 1AC6.tmp 3876 1B43.tmp 1208 1B92.tmp 3364 1BFF.tmp 736 1C4D.tmp 2664 1C9B.tmp 4116 1D18.tmp 3340 1D66.tmp 3188 1DE3.tmp 3140 1E31.tmp 4204 1EAE.tmp 464 1EFD.tmp 3084 1F4B.tmp 4972 1FA8.tmp 3376 2025.tmp 2732 2083.tmp 3180 20E1.tmp 2124 212F.tmp 4236 217D.tmp 1068 21CB.tmp 2228 2219.tmp 2724 2287.tmp 3308 22E5.tmp 3456 2342.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4954.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 554F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C203.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 4456 4736 2026-08-05_59b09e8cc61488f48d7084acf6d44c95_elex_mafia_stealc_tofsee.exe 84 PID 4456 wrote to memory of 2568 4456 FF40.tmp 85 PID 2568 wrote to memory of 2680 2568 B.tmp 86 PID 2680 wrote to memory of 2540 2680 E5.tmp 87 PID 2540 wrote to memory of 2060 2540 1D0.tmp 88 PID 2060 wrote to memory of 2140 2060 29B.tmp 89 PID 2140 wrote to memory of 2944 2140 3B4.tmp 90 PID 2944 wrote to memory of 4880 2944 460.tmp 91 PID 4880 wrote to memory of 4156 4880 54A.tmp 92 PID 4156 wrote to memory of 2696 4156 5E7.tmp 93 PID 2696 wrote to memory of 3000 2696 6C1.tmp 94 PID 3000 wrote to memory of 1876 3000 75E.tmp 95 PID 1876 wrote to memory of 1028 1876 7EA.tmp 96 PID 1028 wrote to memory of 1956 1028 8B5.tmp 97 PID 1956 wrote to memory of 1744 1956 990.tmp 98 PID 1744 wrote to memory of 3360 1744 A4C.tmp 99 PID 3360 wrote to memory of 2952 3360 B07.tmp 100 PID 2952 wrote to memory of 3228 2952 BC3.tmp 101 PID 3228 wrote to memory of 2364 3228 C40.tmp 102 PID 2364 wrote to memory of 628 2364 CCC.tmp 103 PID 628 wrote to memory of 3404 628 DD6.tmp 104 PID 3404 wrote to memory of 4996 3404 E63.tmp 105 PID 4996 wrote to memory of 1404 4996 F4D.tmp 106 PID 1404 wrote to memory of 2688 1404 1028.tmp 107 PID 2688 wrote to memory of 1200 2688 1102.tmp 108 PID 1200 wrote to memory of 5104 1200 11FC.tmp 109 PID 5104 wrote to memory of 2804 5104 1299.tmp 110 PID 2804 wrote to memory of 4908 2804 1354.tmp 111 PID 4908 wrote to memory of 212 4908 141F.tmp 113 PID 212 wrote to memory of 4580 212 14FA.tmp 114 PID 4580 wrote to memory of 1952 4580 15C5.tmp 115 PID 1952 wrote to memory of 3772 1952 1661.tmp 116 PID 3772 wrote to memory of 3472 3772 171D.tmp 117 PID 3472 wrote to memory of 4900 3472 17D8.tmp 118 PID 4900 wrote to memory of 1264 4900 1846.tmp 119 PID 1264 wrote to memory of 2936 1264 18A4.tmp 120 PID 2936 wrote to memory of 4600 2936 18F2.tmp 121 PID 4600 wrote to memory of 3004 4600 194F.tmp 122 PID 3004 wrote to memory of 1616 3004 199E.tmp 123 PID 1616 wrote to memory of 4288 1616 19EC.tmp 124 PID 4288 wrote to memory of 1872 4288 1A69.tmp 125 PID 1872 wrote to memory of 3876 1872 1AC6.tmp 126 PID 3876 wrote to memory of 1208 3876 1B43.tmp 127 PID 1208 wrote to memory of 3364 1208 1B92.tmp 128 PID 3364 wrote to memory of 736 3364 1BFF.tmp 129 PID 736 wrote to memory of 2664 736 1C4D.tmp 130 PID 2664 wrote to memory of 4116 2664 1C9B.tmp 131 PID 4116 wrote to memory of 3340 4116 1D18.tmp 132 PID 3340 wrote to memory of 3188 3340 1D66.tmp 133 PID 3188 wrote to memory of 3140 3188 1DE3.tmp 134 PID 3140 wrote to memory of 4204 3140 1E31.tmp 135 PID 4204 wrote to memory of 464 4204 1EAE.tmp 136 PID 464 wrote to memory of 3084 464 1EFD.tmp 137 PID 3084 wrote to memory of 4972 3084 1F4B.tmp 138 PID 4972 wrote to memory of 3376 4972 1FA8.tmp 139 PID 3376 wrote to memory of 2732 3376 2025.tmp 140 PID 2732 wrote to memory of 3180 2732 2083.tmp 141 PID 3180 wrote to memory of 2124 3180 20E1.tmp 142 PID 2124 wrote to memory of 4236 2124 212F.tmp 143 PID 4236 wrote to memory of 1068 4236 217D.tmp 144 PID 1068 wrote to memory of 2228 1068 21CB.tmp 145 PID 2228 wrote to memory of 2724 2228 2219.tmp 146 PID 2724 wrote to memory of 3308 2724 2287.tmp 147 PID 3308 wrote to memory of 3456 3308 22E5.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_59b09e8cc61488f48d7084acf6d44c95_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_59b09e8cc61488f48d7084acf6d44c95_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1D18.tmp"C:\Users\Admin\AppData\Local\Temp\1D18.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"65⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"66⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"68⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"69⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"70⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"71⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"72⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"73⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"74⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"75⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"76⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"77⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"78⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"79⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"80⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"81⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"82⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"83⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"84⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"85⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"86⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"87⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"88⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"89⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"90⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"91⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"92⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"93⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"94⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"95⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"96⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"97⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"98⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"99⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"100⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"101⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"102⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"103⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"104⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"105⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"106⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"107⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"108⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"109⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:920 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"111⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"112⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"113⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"114⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"115⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"116⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"117⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"118⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"119⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"120⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"121⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"122⤵PID:4428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-