Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_051a49228690f2a876fca849955999dd_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_051a49228690f2a876fca849955999dd_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-07_051a49228690f2a876fca849955999dd_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260807-ejrcdazxay
- SHA256 7724b7c9ab29906e1f5caf5c158f4581a371cd6169b84e42ad31c7af1e70df54
- MD5 051a49228690f2a876fca849955999dd
- SHA1 a7cb4f5362fe1a304cc0936dad000b47b5a92624
- SHA512 141dd63f9019cd60c2c549f404e2e94e4bd9d0061d2524c7274e2af30a2b11acc745a3a2e8380c8083dbb1cc0f8397304e8e961a3da594aa118b2de2e9986798
- SSDEEP 12288:wU5rCOTeiDjsyAi9e69Mv+/c/PmcNZ+3/v+I9hUG2VA:wUQOJDjxs6Q/PJNGEA
- TLSH T1FEE4D02177D8C632E5FB037859B5E6644D7EBD226712D6CF2F8015AE0AB1BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2136 64D0.tmp 468 65AA.tmp 3776 6695.tmp 2032 67EC.tmp 3960 68C7.tmp 4572 69B2.tmp 3420 6AEA.tmp 4416 6C13.tmp 1944 6D2C.tmp 3984 6E45.tmp 780 6F20.tmp 2052 700B.tmp 2304 7105.tmp 1360 71EF.tmp 3796 7327.tmp 1700 7431.tmp 3112 753B.tmp 204 75F6.tmp 4612 76A2.tmp 556 777D.tmp 2432 7867.tmp 2672 7971.tmp 4304 7A2C.tmp 2992 7B07.tmp 4520 7BF1.tmp 2840 7CDC.tmp 1412 7DE5.tmp 4564 7EDF.tmp 4172 7FBA.tmp 2820 8085.tmp 4804 8170.tmp 4852 8279.tmp 2096 8325.tmp 4476 83C1.tmp 4992 845E.tmp 620 84EA.tmp 1244 85A6.tmp 2856 8632.tmp 1692 86BF.tmp 4684 877B.tmp 4120 8826.tmp 732 88E2.tmp 1588 897E.tmp 452 8A2A.tmp 2660 8AC6.tmp 656 8B63.tmp 4844 8BFF.tmp 5096 8C9B.tmp 1784 8D08.tmp 4740 8D66.tmp 220 8DB4.tmp 3692 8E12.tmp 1012 8E60.tmp 4516 8EAE.tmp 2788 8F0C.tmp 4432 8F5A.tmp 1448 8FA8.tmp 2040 9006.tmp 892 9073.tmp 3324 90C2.tmp 3476 9110.tmp 2640 91AC.tmp 536 91FA.tmp 2808 9248.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 573E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A232.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C501.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 2136 5032 2026-08-07_051a49228690f2a876fca849955999dd_elex_mafia_stealc_tofsee.exe 83 PID 2136 wrote to memory of 468 2136 64D0.tmp 84 PID 468 wrote to memory of 3776 468 65AA.tmp 85 PID 3776 wrote to memory of 2032 3776 6695.tmp 86 PID 2032 wrote to memory of 3960 2032 67EC.tmp 87 PID 3960 wrote to memory of 4572 3960 68C7.tmp 88 PID 4572 wrote to memory of 3420 4572 69B2.tmp 89 PID 3420 wrote to memory of 4416 3420 6AEA.tmp 90 PID 4416 wrote to memory of 1944 4416 6C13.tmp 91 PID 1944 wrote to memory of 3984 1944 6D2C.tmp 93 PID 3984 wrote to memory of 780 3984 6E45.tmp 94 PID 780 wrote to memory of 2052 780 6F20.tmp 95 PID 2052 wrote to memory of 2304 2052 700B.tmp 96 PID 2304 wrote to memory of 1360 2304 7105.tmp 98 PID 1360 wrote to memory of 3796 1360 71EF.tmp 101 PID 3796 wrote to memory of 1700 3796 7327.tmp 104 PID 1700 wrote to memory of 3112 1700 7431.tmp 105 PID 3112 wrote to memory of 204 3112 753B.tmp 107 PID 204 wrote to memory of 4612 204 75F6.tmp 108 PID 4612 wrote to memory of 556 4612 76A2.tmp 110 PID 556 wrote to memory of 2432 556 777D.tmp 112 PID 2432 wrote to memory of 2672 2432 7867.tmp 113 PID 2672 wrote to memory of 4304 2672 7971.tmp 114 PID 4304 wrote to memory of 2992 4304 7A2C.tmp 115 PID 2992 wrote to memory of 4520 2992 7B07.tmp 116 PID 4520 wrote to memory of 2840 4520 7BF1.tmp 117 PID 2840 wrote to memory of 1412 2840 7CDC.tmp 118 PID 1412 wrote to memory of 4564 1412 7DE5.tmp 119 PID 4564 wrote to memory of 4172 4564 7EDF.tmp 120 PID 4172 wrote to memory of 2820 4172 7FBA.tmp 121 PID 2820 wrote to memory of 4804 2820 8085.tmp 122 PID 4804 wrote to memory of 4852 4804 8170.tmp 123 PID 4852 wrote to memory of 2096 4852 8279.tmp 125 PID 2096 wrote to memory of 4476 2096 8325.tmp 126 PID 4476 wrote to memory of 4992 4476 83C1.tmp 127 PID 4992 wrote to memory of 620 4992 845E.tmp 128 PID 620 wrote to memory of 1244 620 84EA.tmp 129 PID 1244 wrote to memory of 2856 1244 85A6.tmp 130 PID 2856 wrote to memory of 1692 2856 8632.tmp 131 PID 1692 wrote to memory of 4684 1692 86BF.tmp 132 PID 4684 wrote to memory of 4120 4684 877B.tmp 133 PID 4120 wrote to memory of 732 4120 8826.tmp 134 PID 732 wrote to memory of 1588 732 88E2.tmp 135 PID 1588 wrote to memory of 452 1588 897E.tmp 136 PID 452 wrote to memory of 2660 452 8A2A.tmp 137 PID 2660 wrote to memory of 656 2660 8AC6.tmp 138 PID 656 wrote to memory of 4844 656 8B63.tmp 139 PID 4844 wrote to memory of 5096 4844 8BFF.tmp 140 PID 5096 wrote to memory of 1784 5096 8C9B.tmp 141 PID 1784 wrote to memory of 4740 1784 8D08.tmp 142 PID 4740 wrote to memory of 220 4740 8D66.tmp 143 PID 220 wrote to memory of 3692 220 8DB4.tmp 144 PID 3692 wrote to memory of 1012 3692 8E12.tmp 146 PID 1012 wrote to memory of 4516 1012 8E60.tmp 148 PID 4516 wrote to memory of 2788 4516 8EAE.tmp 149 PID 2788 wrote to memory of 4432 2788 8F0C.tmp 150 PID 4432 wrote to memory of 1448 4432 8F5A.tmp 151 PID 1448 wrote to memory of 2040 1448 8FA8.tmp 152 PID 2040 wrote to memory of 892 2040 9006.tmp 153 PID 892 wrote to memory of 3324 892 9073.tmp 154 PID 3324 wrote to memory of 3476 3324 90C2.tmp 155 PID 4212 wrote to memory of 2640 4212 915E.tmp 157 PID 2640 wrote to memory of 536 2640 91AC.tmp 158 PID 536 wrote to memory of 2808 536 91FA.tmp 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_051a49228690f2a876fca849955999dd_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_051a49228690f2a876fca849955999dd_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\7971.tmp"C:\Users\Admin\AppData\Local\Temp\7971.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\84EA.tmp"C:\Users\Admin\AppData\Local\Temp\84EA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\85A6.tmp"C:\Users\Admin\AppData\Local\Temp\85A6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8826.tmp"C:\Users\Admin\AppData\Local\Temp\8826.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\88E2.tmp"C:\Users\Admin\AppData\Local\Temp\88E2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\897E.tmp"C:\Users\Admin\AppData\Local\Temp\897E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\9073.tmp"C:\Users\Admin\AppData\Local\Temp\9073.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\90C2.tmp"C:\Users\Admin\AppData\Local\Temp\90C2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"62⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"63⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"67⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"68⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\9333.tmp"C:\Users\Admin\AppData\Local\Temp\9333.tmp"69⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\9381.tmp"C:\Users\Admin\AppData\Local\Temp\9381.tmp"70⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"71⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\941D.tmp"C:\Users\Admin\AppData\Local\Temp\941D.tmp"72⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\946B.tmp"C:\Users\Admin\AppData\Local\Temp\946B.tmp"73⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\94C9.tmp"C:\Users\Admin\AppData\Local\Temp\94C9.tmp"74⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\9517.tmp"C:\Users\Admin\AppData\Local\Temp\9517.tmp"75⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\9575.tmp"C:\Users\Admin\AppData\Local\Temp\9575.tmp"76⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"77⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9611.tmp"C:\Users\Admin\AppData\Local\Temp\9611.tmp"78⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\965F.tmp"C:\Users\Admin\AppData\Local\Temp\965F.tmp"79⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"80⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"81⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"82⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"83⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"84⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"85⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"86⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"87⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"88⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\998C.tmp"C:\Users\Admin\AppData\Local\Temp\998C.tmp"89⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\99DA.tmp"C:\Users\Admin\AppData\Local\Temp\99DA.tmp"90⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"91⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\9A76.tmp"C:\Users\Admin\AppData\Local\Temp\9A76.tmp"92⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"93⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\9B22.tmp"C:\Users\Admin\AppData\Local\Temp\9B22.tmp"94⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"95⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\9BCE.tmp"C:\Users\Admin\AppData\Local\Temp\9BCE.tmp"96⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"97⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"98⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"99⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"100⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"101⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"102⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"103⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"104⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"105⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\9EDB.tmp"C:\Users\Admin\AppData\Local\Temp\9EDB.tmp"106⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\9F29.tmp"C:\Users\Admin\AppData\Local\Temp\9F29.tmp"107⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"108⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"109⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\A013.tmp"C:\Users\Admin\AppData\Local\Temp\A013.tmp"110⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"111⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"112⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"113⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"114⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"115⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"116⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"117⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"118⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"120⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\A37E.tmp"C:\Users\Admin\AppData\Local\Temp\A37E.tmp"121⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"122⤵PID:3644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-