Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_0760c0fa57a4f3e6b1901f6b1b39dcb0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_0760c0fa57a4f3e6b1901f6b1b39dcb0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_0760c0fa57a4f3e6b1901f6b1b39dcb0_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260808-hfcxcsvzgy
- SHA256 38f9ca31e36264b189384da34be6a08302838c84a51b37c47586c27d094194ee
- MD5 0760c0fa57a4f3e6b1901f6b1b39dcb0
- SHA1 15528877139561850e19a5b1b1cd57f245f8fcd5
- SHA512 38501eb0ed03b8f2e41f67c123a872120a835f16edc78921ca40ada4d337611d390a7eff69df7dc81d425869dea30287a6b7139088cea59c5b726383c31e9b27
- SSDEEP 12288:NU5rCOTeijsNoyzIYiRTicyEbE/CqTZwlH4Hp:NUQOJjsK57RTiME/nTSlH4Hp
- TLSH T1F5B4F01AB285C132E6D201711EE6EBE2693B7C31672694C73B84636E2FB13E1D375346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 848 461C.tmp 4564 46F7.tmp 1048 4784.tmp 2268 484F.tmp 1200 48DB.tmp 1960 4997.tmp 4576 4A23.tmp 2516 4AA0.tmp 5036 4B3D.tmp 2480 4BF8.tmp 2744 4CB4.tmp 4692 4D6F.tmp 464 4DEC.tmp 2640 4E5A.tmp 2968 4ED7.tmp 4040 4F63.tmp 3384 4FD1.tmp 3784 507C.tmp 2596 50DA.tmp 3780 51A5.tmp 4084 5280.tmp 4976 533C.tmp 816 53F7.tmp 3424 5464.tmp 1476 5530.tmp 5048 55AD.tmp 2204 5658.tmp 4308 5704.tmp 4300 57C0.tmp 380 584C.tmp 3872 58BA.tmp 3804 5946.tmp 1688 59F2.tmp 4188 5A60.tmp 2536 5ABD.tmp 2820 5B2B.tmp 1392 5B98.tmp 2064 5C06.tmp 824 5C54.tmp 3976 5CA2.tmp 4320 5D00.tmp 4260 5D4E.tmp 3344 5D9C.tmp 3520 5DFA.tmp 4672 5E48.tmp 5116 5E96.tmp 3168 5EF4.tmp 4812 5F42.tmp 3200 5F90.tmp 4136 5FDE.tmp 4568 602C.tmp 2676 607A.tmp 2456 60D8.tmp 4696 6145.tmp 3800 6193.tmp 2888 6201.tmp 1444 626E.tmp 2844 62CC.tmp 2024 631A.tmp 928 6368.tmp 3908 63B6.tmp 4244 6424.tmp 740 6472.tmp 1784 64C0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F70D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3167.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A41B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 429D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6472.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB9D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 848 1056 2026-08-08_0760c0fa57a4f3e6b1901f6b1b39dcb0_elex_mafia_stealc_tofsee.exe 86 PID 848 wrote to memory of 4564 848 461C.tmp 87 PID 4564 wrote to memory of 1048 4564 46F7.tmp 88 PID 1048 wrote to memory of 2268 1048 4784.tmp 89 PID 2268 wrote to memory of 1200 2268 484F.tmp 90 PID 1200 wrote to memory of 1960 1200 48DB.tmp 91 PID 1960 wrote to memory of 4576 1960 4997.tmp 92 PID 4576 wrote to memory of 2516 4576 4A23.tmp 93 PID 2516 wrote to memory of 5036 2516 4AA0.tmp 94 PID 5036 wrote to memory of 2480 5036 4B3D.tmp 95 PID 2480 wrote to memory of 2744 2480 4BF8.tmp 96 PID 2744 wrote to memory of 4692 2744 4CB4.tmp 97 PID 4692 wrote to memory of 464 4692 4D6F.tmp 98 PID 464 wrote to memory of 2640 464 4DEC.tmp 99 PID 2640 wrote to memory of 2968 2640 4E5A.tmp 100 PID 2968 wrote to memory of 4040 2968 4ED7.tmp 101 PID 4040 wrote to memory of 3384 4040 4F63.tmp 102 PID 3384 wrote to memory of 3784 3384 4FD1.tmp 103 PID 3784 wrote to memory of 2596 3784 507C.tmp 104 PID 2596 wrote to memory of 3780 2596 50DA.tmp 105 PID 3780 wrote to memory of 4084 3780 51A5.tmp 106 PID 4084 wrote to memory of 4976 4084 5280.tmp 107 PID 4976 wrote to memory of 816 4976 533C.tmp 108 PID 816 wrote to memory of 3424 816 53F7.tmp 109 PID 3424 wrote to memory of 1476 3424 5464.tmp 110 PID 1476 wrote to memory of 5048 1476 5530.tmp 111 PID 5048 wrote to memory of 2204 5048 55AD.tmp 112 PID 2204 wrote to memory of 4308 2204 5658.tmp 113 PID 4308 wrote to memory of 4300 4308 5704.tmp 114 PID 4300 wrote to memory of 380 4300 57C0.tmp 115 PID 380 wrote to memory of 3872 380 584C.tmp 116 PID 3872 wrote to memory of 3804 3872 58BA.tmp 117 PID 3804 wrote to memory of 1688 3804 5946.tmp 118 PID 1688 wrote to memory of 4188 1688 59F2.tmp 119 PID 4188 wrote to memory of 2536 4188 5A60.tmp 120 PID 2536 wrote to memory of 2820 2536 5ABD.tmp 121 PID 2820 wrote to memory of 1392 2820 5B2B.tmp 122 PID 1392 wrote to memory of 2064 1392 5B98.tmp 123 PID 2064 wrote to memory of 824 2064 5C06.tmp 124 PID 824 wrote to memory of 3976 824 5C54.tmp 125 PID 3976 wrote to memory of 4320 3976 5CA2.tmp 126 PID 4320 wrote to memory of 4260 4320 5D00.tmp 127 PID 4260 wrote to memory of 3344 4260 5D4E.tmp 128 PID 3344 wrote to memory of 3520 3344 5D9C.tmp 129 PID 3520 wrote to memory of 4672 3520 5DFA.tmp 130 PID 4672 wrote to memory of 5116 4672 5E48.tmp 131 PID 5116 wrote to memory of 3168 5116 5E96.tmp 132 PID 3168 wrote to memory of 4812 3168 5EF4.tmp 133 PID 4812 wrote to memory of 3200 4812 5F42.tmp 134 PID 3200 wrote to memory of 4136 3200 5F90.tmp 135 PID 4136 wrote to memory of 4568 4136 5FDE.tmp 136 PID 4568 wrote to memory of 2676 4568 602C.tmp 137 PID 2676 wrote to memory of 2456 2676 607A.tmp 138 PID 2456 wrote to memory of 4696 2456 60D8.tmp 139 PID 4696 wrote to memory of 3800 4696 6145.tmp 140 PID 3800 wrote to memory of 2888 3800 6193.tmp 141 PID 2888 wrote to memory of 1444 2888 6201.tmp 142 PID 1444 wrote to memory of 2844 1444 626E.tmp 143 PID 2844 wrote to memory of 2024 2844 62CC.tmp 144 PID 2024 wrote to memory of 928 2024 631A.tmp 145 PID 928 wrote to memory of 3908 928 6368.tmp 146 PID 3908 wrote to memory of 4244 3908 63B6.tmp 147 PID 4244 wrote to memory of 740 4244 6424.tmp 148 PID 740 wrote to memory of 1784 740 6472.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_0760c0fa57a4f3e6b1901f6b1b39dcb0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_0760c0fa57a4f3e6b1901f6b1b39dcb0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\5C54.tmp"C:\Users\Admin\AppData\Local\Temp\5C54.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"65⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"66⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"67⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"68⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"69⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"70⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"71⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"72⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"74⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"75⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"76⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"77⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"78⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"80⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"81⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"82⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"83⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"84⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"85⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"86⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"87⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"88⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"89⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"90⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"91⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"92⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"93⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"94⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"95⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"96⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"97⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"98⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"99⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"100⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"101⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"102⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"103⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"104⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"105⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"106⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"107⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"108⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"109⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7421.tmp"C:\Users\Admin\AppData\Local\Temp\7421.tmp"110⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"111⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"112⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"113⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"114⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"115⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"116⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\76C1.tmp"C:\Users\Admin\AppData\Local\Temp\76C1.tmp"117⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"118⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"119⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"120⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"121⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-