Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_dbe5cec7a38acb93b1afc9aab12c75ad_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_dbe5cec7a38acb93b1afc9aab12c75ad_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_dbe5cec7a38acb93b1afc9aab12c75ad_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260808-sxd6vstthy
- SHA256 5243c1488d13663a81b172574198f7bec5927a2e04d9b217b67bdba397135b9e
- MD5 dbe5cec7a38acb93b1afc9aab12c75ad
- SHA1 67ea674884b7a464d90e1fb214e207a7aa3c44b7
- SHA512 ecf481e64db15e546a4f4fae680bb7fb830577026a1ba74e4285e4f8c94be8b76247cdb3b03a745db2a6ac64e4718100a1cd5b13d5040fd8c970ecbd77c7e9c2
- SSDEEP 12288:wU5rCOTeiDnrz0l77N1S7V1O0GNZ+3/v+I9hUG2VA:wUQOJDnX0Z7Nk7rGNGEA
- TLSH T159E4D12173D88636E9F7037859B5E6614D7EBD326722D6CF2F9012AE0971BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2092 1112.tmp 2564 122B.tmp 3040 1345.tmp 2352 14FA.tmp 5116 1604.tmp 4468 175B.tmp 2912 1884.tmp 3568 19AD.tmp 3036 1AB7.tmp 2020 1BEF.tmp 1120 1D09.tmp 1764 1E22.tmp 4060 1F4B.tmp 1956 2064.tmp 3488 213F.tmp 2196 2268.tmp 60 23B0.tmp 700 24C9.tmp 4300 25F2.tmp 2684 270B.tmp 1776 2805.tmp 1888 28EF.tmp 3988 29E9.tmp 4256 2B12.tmp 332 2C4B.tmp 4812 2D64.tmp 980 2E6E.tmp 4136 2FD5.tmp 1864 310E.tmp 2700 3227.tmp 1524 3330.tmp 3468 3479.tmp 4396 35A1.tmp 1504 363E.tmp 5044 36DA.tmp 4568 3776.tmp 3244 3822.tmp 3948 388F.tmp 3492 395B.tmp 1352 3A16.tmp 3112 3AA3.tmp 1644 3B3F.tmp 2420 3C39.tmp 1596 3C97.tmp 2404 3D81.tmp 1288 3E3D.tmp 2828 3EF8.tmp 2864 3FB4.tmp 2644 406F.tmp 3820 40DC.tmp 4408 414A.tmp 3712 41A8.tmp 4024 4205.tmp 1840 4273.tmp 4476 42F0.tmp 4532 435D.tmp 4804 43CA.tmp 2080 4438.tmp 1824 44E4.tmp 2780 4541.tmp 3152 459F.tmp 4404 461C.tmp 4680 46B8.tmp 3144 4745.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8469.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2268.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 937C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 742C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 363E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 873C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E84.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2092 1492 2026-08-08_dbe5cec7a38acb93b1afc9aab12c75ad_elex_mafia_stealc_tofsee.exe 85 PID 2092 wrote to memory of 2564 2092 1112.tmp 86 PID 2564 wrote to memory of 3040 2564 122B.tmp 87 PID 3040 wrote to memory of 2352 3040 1345.tmp 88 PID 2352 wrote to memory of 5116 2352 14FA.tmp 89 PID 5116 wrote to memory of 4468 5116 1604.tmp 90 PID 4468 wrote to memory of 2912 4468 175B.tmp 91 PID 2912 wrote to memory of 3568 2912 1884.tmp 92 PID 3568 wrote to memory of 3036 3568 19AD.tmp 93 PID 3036 wrote to memory of 2020 3036 1AB7.tmp 94 PID 2020 wrote to memory of 1120 2020 1BEF.tmp 95 PID 1120 wrote to memory of 1764 1120 1D09.tmp 96 PID 1764 wrote to memory of 4060 1764 1E22.tmp 97 PID 4060 wrote to memory of 1956 4060 1F4B.tmp 98 PID 1956 wrote to memory of 3488 1956 2064.tmp 99 PID 3488 wrote to memory of 2196 3488 213F.tmp 100 PID 2196 wrote to memory of 60 2196 2268.tmp 101 PID 60 wrote to memory of 700 60 23B0.tmp 102 PID 700 wrote to memory of 4300 700 24C9.tmp 103 PID 4300 wrote to memory of 2684 4300 25F2.tmp 104 PID 2684 wrote to memory of 1776 2684 270B.tmp 105 PID 1776 wrote to memory of 1888 1776 2805.tmp 106 PID 1888 wrote to memory of 3988 1888 28EF.tmp 107 PID 3988 wrote to memory of 4256 3988 29E9.tmp 108 PID 4256 wrote to memory of 332 4256 2B12.tmp 109 PID 332 wrote to memory of 4812 332 2C4B.tmp 110 PID 4812 wrote to memory of 980 4812 2D64.tmp 111 PID 980 wrote to memory of 4136 980 2E6E.tmp 112 PID 4136 wrote to memory of 1864 4136 2FD5.tmp 113 PID 1864 wrote to memory of 2700 1864 310E.tmp 114 PID 2700 wrote to memory of 1524 2700 3227.tmp 115 PID 1524 wrote to memory of 3468 1524 3330.tmp 116 PID 3468 wrote to memory of 4396 3468 3479.tmp 117 PID 4396 wrote to memory of 1504 4396 35A1.tmp 118 PID 1504 wrote to memory of 5044 1504 363E.tmp 119 PID 5044 wrote to memory of 4568 5044 36DA.tmp 120 PID 4568 wrote to memory of 3244 4568 3776.tmp 121 PID 3244 wrote to memory of 3948 3244 3822.tmp 122 PID 3948 wrote to memory of 3492 3948 388F.tmp 124 PID 3492 wrote to memory of 1352 3492 395B.tmp 125 PID 1352 wrote to memory of 3112 1352 3A16.tmp 126 PID 3112 wrote to memory of 1644 3112 3AA3.tmp 127 PID 1644 wrote to memory of 2420 1644 3B3F.tmp 128 PID 2420 wrote to memory of 1596 2420 3C39.tmp 129 PID 1596 wrote to memory of 2404 1596 3C97.tmp 130 PID 2404 wrote to memory of 1288 2404 3D81.tmp 131 PID 1288 wrote to memory of 2828 1288 3E3D.tmp 132 PID 2828 wrote to memory of 2864 2828 3EF8.tmp 133 PID 2864 wrote to memory of 2644 2864 3FB4.tmp 134 PID 2644 wrote to memory of 3820 2644 406F.tmp 135 PID 3820 wrote to memory of 4408 3820 40DC.tmp 136 PID 4408 wrote to memory of 3712 4408 414A.tmp 137 PID 3712 wrote to memory of 4024 3712 41A8.tmp 138 PID 4024 wrote to memory of 1840 4024 4205.tmp 139 PID 1840 wrote to memory of 4476 1840 4273.tmp 140 PID 4476 wrote to memory of 4532 4476 42F0.tmp 141 PID 4532 wrote to memory of 4804 4532 435D.tmp 142 PID 4804 wrote to memory of 2080 4804 43CA.tmp 143 PID 2080 wrote to memory of 1824 2080 4438.tmp 144 PID 1824 wrote to memory of 2780 1824 44E4.tmp 145 PID 2780 wrote to memory of 3152 2780 4541.tmp 146 PID 3152 wrote to memory of 4404 3152 459F.tmp 147 PID 4404 wrote to memory of 4680 4404 461C.tmp 148 PID 4680 wrote to memory of 3144 4680 46B8.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_dbe5cec7a38acb93b1afc9aab12c75ad_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_dbe5cec7a38acb93b1afc9aab12c75ad_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"65⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"66⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"67⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"68⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"69⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"70⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"71⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"72⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"73⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"74⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"75⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"76⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"77⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"78⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"79⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"80⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"81⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"82⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"83⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"84⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"85⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"86⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"87⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"88⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"89⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"90⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"92⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"93⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"94⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"96⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"97⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"98⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"99⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"100⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"101⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"103⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"104⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"105⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"106⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"107⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"108⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"109⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"110⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"111⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"112⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"113⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"114⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"115⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"116⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"117⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"118⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"119⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"120⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"121⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-