Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_0a3e633cfec18ebe643681424668f700_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_0a3e633cfec18ebe643681424668f700_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-07_0a3e633cfec18ebe643681424668f700_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260807-cdr1lsde59
- SHA256 2e6bec7e3561dd62fc48480998220031969f706b2aba84196938d9ded84833a9
- MD5 0a3e633cfec18ebe643681424668f700
- SHA1 06d3b6e75f8920dbf3aa8aa05a053ed18ded2f07
- SHA512 30b32f9142c34167816f1ac9794fbcd31bd3b11513c93e20972f80a355e9951892320d3a62c8a838da6e05b05e221eb8125bac0907970c74b2d7de38298c65cc
- SSDEEP 12288:NU5rCOTeijZ3vnb9R/bQn591iRLFh8TZwlH:NUQOJjhT9pUT1+oTSlH
- TLSH T17FB4F121B285C532E69202710BD6EBA22A3EBD315736E4C73794636E6FB13E1D375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4108 B12A.tmp 60 B1F6.tmp 4312 B2B1.tmp 4768 B36D.tmp 4816 B409.tmp 2040 B4C4.tmp 5080 B570.tmp 4840 B5FD.tmp 1152 B67A.tmp 4628 B6E7.tmp 4388 B7B2.tmp 2240 B85E.tmp 3684 B8EB.tmp 3640 B968.tmp 624 BA52.tmp 5012 BADF.tmp 3220 BB7B.tmp 2804 BC08.tmp 636 BC85.tmp 4848 BD21.tmp 3692 BDDC.tmp 4640 BE98.tmp 1488 BF15.tmp 3888 BFC1.tmp 1840 C03E.tmp 3816 C119.tmp 2536 C1C4.tmp 2964 C290.tmp 4844 C30D.tmp 4648 C3A9.tmp 4240 C4B2.tmp 4020 C54F.tmp 2000 C629.tmp 2796 C697.tmp 3100 C6F5.tmp 4272 C791.tmp 3940 C80E.tmp 4524 C85C.tmp 4320 C8BA.tmp 3668 C908.tmp 648 C956.tmp 4716 C9C3.tmp 560 CA21.tmp 4952 CA8E.tmp 5036 CAEC.tmp 432 CB5A.tmp 2296 CBC7.tmp 4488 CC25.tmp 3328 CC82.tmp 4964 CCF0.tmp 2344 CD5D.tmp 1716 CDCB.tmp 1260 CE28.tmp 4720 CE86.tmp 3432 CF03.tmp 2340 CF61.tmp 2084 CFBF.tmp 4160 D01C.tmp 1376 D099.tmp 4660 D107.tmp 3968 D184.tmp 1132 D1F1.tmp 4988 D24F.tmp 1232 D2BC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 817B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C80E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 523D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 161E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A39.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3796 wrote to memory of 4108 3796 2026-08-07_0a3e633cfec18ebe643681424668f700_elex_mafia_stealc_tofsee.exe 86 PID 4108 wrote to memory of 60 4108 B12A.tmp 87 PID 60 wrote to memory of 4312 60 B1F6.tmp 88 PID 4312 wrote to memory of 4768 4312 B2B1.tmp 89 PID 4768 wrote to memory of 4816 4768 B36D.tmp 90 PID 4816 wrote to memory of 2040 4816 B409.tmp 91 PID 2040 wrote to memory of 5080 2040 B4C4.tmp 92 PID 5080 wrote to memory of 4840 5080 B570.tmp 93 PID 4840 wrote to memory of 1152 4840 B5FD.tmp 94 PID 1152 wrote to memory of 4628 1152 B67A.tmp 95 PID 4628 wrote to memory of 4388 4628 B6E7.tmp 96 PID 4388 wrote to memory of 2240 4388 B7B2.tmp 97 PID 2240 wrote to memory of 3684 2240 B85E.tmp 98 PID 3684 wrote to memory of 3640 3684 B8EB.tmp 99 PID 3640 wrote to memory of 624 3640 B968.tmp 100 PID 624 wrote to memory of 5012 624 BA52.tmp 101 PID 5012 wrote to memory of 3220 5012 BADF.tmp 102 PID 3220 wrote to memory of 2804 3220 BB7B.tmp 103 PID 2804 wrote to memory of 636 2804 BC08.tmp 104 PID 636 wrote to memory of 4848 636 BC85.tmp 105 PID 4848 wrote to memory of 3692 4848 BD21.tmp 106 PID 3692 wrote to memory of 4640 3692 BDDC.tmp 107 PID 4640 wrote to memory of 1488 4640 BE98.tmp 108 PID 1488 wrote to memory of 3888 1488 BF15.tmp 109 PID 3888 wrote to memory of 1840 3888 BFC1.tmp 110 PID 1840 wrote to memory of 3816 1840 C03E.tmp 111 PID 3816 wrote to memory of 2536 3816 C119.tmp 112 PID 2536 wrote to memory of 2964 2536 C1C4.tmp 114 PID 2964 wrote to memory of 4844 2964 C290.tmp 115 PID 4844 wrote to memory of 4648 4844 C30D.tmp 116 PID 4648 wrote to memory of 4240 4648 C3A9.tmp 117 PID 4240 wrote to memory of 4020 4240 C4B2.tmp 118 PID 4020 wrote to memory of 2000 4020 C54F.tmp 119 PID 2000 wrote to memory of 2796 2000 C629.tmp 120 PID 2796 wrote to memory of 3100 2796 C697.tmp 121 PID 3100 wrote to memory of 4272 3100 C6F5.tmp 122 PID 4272 wrote to memory of 3940 4272 C791.tmp 123 PID 3940 wrote to memory of 4524 3940 C80E.tmp 124 PID 4524 wrote to memory of 4320 4524 C85C.tmp 125 PID 4320 wrote to memory of 3668 4320 C8BA.tmp 126 PID 3668 wrote to memory of 648 3668 C908.tmp 127 PID 648 wrote to memory of 4716 648 C956.tmp 128 PID 4716 wrote to memory of 560 4716 C9C3.tmp 129 PID 560 wrote to memory of 4952 560 CA21.tmp 132 PID 4952 wrote to memory of 5036 4952 CA8E.tmp 133 PID 5036 wrote to memory of 432 5036 CAEC.tmp 134 PID 432 wrote to memory of 2296 432 CB5A.tmp 135 PID 2296 wrote to memory of 4488 2296 CBC7.tmp 136 PID 4488 wrote to memory of 3328 4488 CC25.tmp 137 PID 3328 wrote to memory of 4964 3328 CC82.tmp 138 PID 4964 wrote to memory of 2344 4964 CCF0.tmp 139 PID 2344 wrote to memory of 1716 2344 CD5D.tmp 140 PID 1716 wrote to memory of 1260 1716 CDCB.tmp 141 PID 1260 wrote to memory of 4720 1260 CE28.tmp 142 PID 4720 wrote to memory of 3432 4720 CE86.tmp 144 PID 3432 wrote to memory of 2340 3432 CF03.tmp 145 PID 2340 wrote to memory of 2084 2340 CF61.tmp 146 PID 2084 wrote to memory of 4160 2084 CFBF.tmp 148 PID 4160 wrote to memory of 1376 4160 D01C.tmp 149 PID 1376 wrote to memory of 4660 1376 D099.tmp 150 PID 4660 wrote to memory of 3968 4660 D107.tmp 151 PID 3968 wrote to memory of 1132 3968 D184.tmp 152 PID 1132 wrote to memory of 4988 1132 D1F1.tmp 153 PID 4988 wrote to memory of 1232 4988 D24F.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0a3e633cfec18ebe643681424668f700_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0a3e633cfec18ebe643681424668f700_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\B67A.tmp"C:\Users\Admin\AppData\Local\Temp\B67A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\B85E.tmp"C:\Users\Admin\AppData\Local\Temp\B85E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B8EB.tmp"C:\Users\Admin\AppData\Local\Temp\B8EB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\BE98.tmp"C:\Users\Admin\AppData\Local\Temp\BE98.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\BF15.tmp"C:\Users\Admin\AppData\Local\Temp\BF15.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\C03E.tmp"C:\Users\Admin\AppData\Local\Temp\C03E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\C54F.tmp"C:\Users\Admin\AppData\Local\Temp\C54F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C697.tmp"C:\Users\Admin\AppData\Local\Temp\C697.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\C6F5.tmp"C:\Users\Admin\AppData\Local\Temp\C6F5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\C791.tmp"C:\Users\Admin\AppData\Local\Temp\C791.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\C85C.tmp"C:\Users\Admin\AppData\Local\Temp\C85C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\C956.tmp"C:\Users\Admin\AppData\Local\Temp\C956.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\CC82.tmp"C:\Users\Admin\AppData\Local\Temp\CC82.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\CF61.tmp"C:\Users\Admin\AppData\Local\Temp\CF61.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"65⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"66⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"67⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\D404.tmp"C:\Users\Admin\AppData\Local\Temp\D404.tmp"68⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"69⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"70⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\D50E.tmp"C:\Users\Admin\AppData\Local\Temp\D50E.tmp"71⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"72⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\D608.tmp"C:\Users\Admin\AppData\Local\Temp\D608.tmp"73⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"74⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"75⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"76⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\D869.tmp"C:\Users\Admin\AppData\Local\Temp\D869.tmp"77⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"78⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\D944.tmp"C:\Users\Admin\AppData\Local\Temp\D944.tmp"79⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"80⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"81⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"82⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"83⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"84⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"85⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"86⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"87⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"88⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"89⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"90⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"91⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"92⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"93⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"94⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"95⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"96⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"97⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"98⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\E104.tmp"C:\Users\Admin\AppData\Local\Temp\E104.tmp"99⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"100⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"101⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"102⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"103⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"104⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"105⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"106⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\E48F.tmp"C:\Users\Admin\AppData\Local\Temp\E48F.tmp"107⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"108⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"109⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"111⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"112⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"114⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\E7BB.tmp"C:\Users\Admin\AppData\Local\Temp\E7BB.tmp"115⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"116⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"117⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"118⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"119⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\E990.tmp"C:\Users\Admin\AppData\Local\Temp\E990.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"121⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\EA6B.tmp"C:\Users\Admin\AppData\Local\Temp\EA6B.tmp"122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-