Analysis
- max time kernel
128s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_3a98ad6594dafb1142a5f14923527476_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_3a98ad6594dafb1142a5f14923527476_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-13_3a98ad6594dafb1142a5f14923527476_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260813-vbqnwacb86
- SHA256 6fd3ae85c92bdd24a3ea4641463efc44437a816aeb4b2cab040c62d64c4bedd9
- MD5 3a98ad6594dafb1142a5f14923527476
- SHA1 c502116274f9afa62a5ef5a8a41143a3c29e310b
- SHA512 d8a846f938aa533a6d40761c7674c69bc04e42a8357cea9ceba24c03ea3369027254d32e626a1e3ee0fdf059dfee40349d10d65a4b221574f49994f731650474
- SSDEEP 12288:NU5rCOTeijTDUDior+/P53N+26KpCH6QjRTZwlH4Hp:NUQOJjyiioP53McCaQFTSlH4Hp
- TLSH T132B4E126B645C532E68202711ED6EBE26E3F7C71472594D73B84662E2FB16E0E379303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 692 D8E6.tmp 3224 D992.tmp 3556 DAEA.tmp 2360 DC61.tmp 3164 DD0D.tmp 2492 DD8A.tmp 4280 DE26.tmp 2464 DEC2.tmp 1704 DF6E.tmp 5596 E01A.tmp 3652 E0D6.tmp 2860 E1B0.tmp 5428 E24D.tmp 2612 E337.tmp 1944 E3D3.tmp 4924 E450.tmp 2912 E55A.tmp 3252 E625.tmp 5040 E6C1.tmp 200 E77D.tmp 4876 E857.tmp 3364 E8F4.tmp 1224 E971.tmp 5584 EA2C.tmp 6048 EAC8.tmp 1860 EB94.tmp 5656 EC6E.tmp 620 ED39.tmp 4204 EDC6.tmp 4844 EE72.tmp 3508 EF3D.tmp 856 EFE9.tmp 2416 F0A4.tmp 5868 F131.tmp 2412 F1BE.tmp 5528 F26A.tmp 5136 F315.tmp 3192 F3E1.tmp 4164 F46D.tmp 3804 F509.tmp 824 F5D5.tmp 4624 F671.tmp 3008 F70D.tmp 1008 F7A9.tmp 4856 F836.tmp 2628 F8D2.tmp 2352 F95F.tmp 2076 F9EB.tmp 5848 FA78.tmp 3104 FB05.tmp 3464 FBA1.tmp 3100 FC2E.tmp 3348 FCAB.tmp 5000 FD28.tmp 4484 FDA5.tmp 1196 FE31.tmp 1952 FEED.tmp 2788 FFA8.tmp 4256 35.tmp 4476 A2.tmp 2780 11F.tmp 6132 1CB.tmp 1132 258.tmp 5148 2E4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3791.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5606.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 209E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A53F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5804 wrote to memory of 692 5804 2026-08-13_3a98ad6594dafb1142a5f14923527476_elex_mafia_stealc_tofsee.exe 89 PID 692 wrote to memory of 3224 692 D8E6.tmp 90 PID 3224 wrote to memory of 3556 3224 D992.tmp 91 PID 3556 wrote to memory of 2360 3556 DAEA.tmp 92 PID 2360 wrote to memory of 3164 2360 DC61.tmp 93 PID 3164 wrote to memory of 2492 3164 DD0D.tmp 94 PID 2492 wrote to memory of 4280 2492 DD8A.tmp 95 PID 4280 wrote to memory of 2464 4280 DE26.tmp 96 PID 2464 wrote to memory of 1704 2464 DEC2.tmp 97 PID 1704 wrote to memory of 5596 1704 DF6E.tmp 98 PID 5596 wrote to memory of 3652 5596 E01A.tmp 99 PID 3652 wrote to memory of 2860 3652 E0D6.tmp 100 PID 2860 wrote to memory of 5428 2860 E1B0.tmp 101 PID 5428 wrote to memory of 2612 5428 E24D.tmp 102 PID 2612 wrote to memory of 1944 2612 E337.tmp 103 PID 1944 wrote to memory of 4924 1944 E3D3.tmp 104 PID 4924 wrote to memory of 2912 4924 E450.tmp 105 PID 2912 wrote to memory of 3252 2912 E55A.tmp 106 PID 3252 wrote to memory of 5040 3252 E625.tmp 107 PID 5040 wrote to memory of 200 5040 E6C1.tmp 108 PID 200 wrote to memory of 4876 200 E77D.tmp 109 PID 4876 wrote to memory of 3364 4876 E857.tmp 110 PID 3364 wrote to memory of 1224 3364 E8F4.tmp 111 PID 1224 wrote to memory of 5584 1224 E971.tmp 112 PID 5584 wrote to memory of 6048 5584 EA2C.tmp 113 PID 6048 wrote to memory of 1860 6048 EAC8.tmp 114 PID 1860 wrote to memory of 5656 1860 EB94.tmp 115 PID 5656 wrote to memory of 620 5656 EC6E.tmp 116 PID 620 wrote to memory of 4204 620 ED39.tmp 117 PID 4204 wrote to memory of 4844 4204 EDC6.tmp 118 PID 4844 wrote to memory of 3508 4844 EE72.tmp 119 PID 3508 wrote to memory of 856 3508 EF3D.tmp 120 PID 856 wrote to memory of 2416 856 EFE9.tmp 121 PID 2416 wrote to memory of 5868 2416 F0A4.tmp 122 PID 5868 wrote to memory of 2412 5868 F131.tmp 123 PID 2412 wrote to memory of 5528 2412 F1BE.tmp 124 PID 5528 wrote to memory of 5136 5528 F26A.tmp 125 PID 5136 wrote to memory of 3192 5136 F315.tmp 126 PID 3192 wrote to memory of 4164 3192 F3E1.tmp 127 PID 4164 wrote to memory of 3804 4164 F46D.tmp 128 PID 3804 wrote to memory of 824 3804 F509.tmp 129 PID 824 wrote to memory of 4624 824 F5D5.tmp 130 PID 4624 wrote to memory of 3008 4624 F671.tmp 131 PID 3008 wrote to memory of 1008 3008 F70D.tmp 132 PID 1008 wrote to memory of 4856 1008 F7A9.tmp 133 PID 4856 wrote to memory of 2628 4856 F836.tmp 134 PID 2628 wrote to memory of 2352 2628 F8D2.tmp 135 PID 2352 wrote to memory of 2076 2352 F95F.tmp 136 PID 2076 wrote to memory of 5848 2076 F9EB.tmp 137 PID 5848 wrote to memory of 3104 5848 FA78.tmp 138 PID 3104 wrote to memory of 3464 3104 FB05.tmp 139 PID 3464 wrote to memory of 3100 3464 FBA1.tmp 140 PID 3100 wrote to memory of 3348 3100 FC2E.tmp 141 PID 3348 wrote to memory of 5000 3348 FCAB.tmp 142 PID 5000 wrote to memory of 4484 5000 FD28.tmp 143 PID 4484 wrote to memory of 1196 4484 FDA5.tmp 144 PID 1196 wrote to memory of 1952 1196 FE31.tmp 145 PID 1952 wrote to memory of 2788 1952 FEED.tmp 146 PID 2788 wrote to memory of 4256 2788 FFA8.tmp 147 PID 4256 wrote to memory of 4476 4256 35.tmp 148 PID 4476 wrote to memory of 2780 4476 A2.tmp 149 PID 2780 wrote to memory of 6132 2780 11F.tmp 150 PID 6132 wrote to memory of 1132 6132 1CB.tmp 151 PID 1132 wrote to memory of 5148 1132 258.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_3a98ad6594dafb1142a5f14923527476_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_3a98ad6594dafb1142a5f14923527476_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\E01A.tmp"C:\Users\Admin\AppData\Local\Temp\E01A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\E24D.tmp"C:\Users\Admin\AppData\Local\Temp\E24D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\E55A.tmp"C:\Users\Admin\AppData\Local\Temp\E55A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\E77D.tmp"C:\Users\Admin\AppData\Local\Temp\E77D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\E857.tmp"C:\Users\Admin\AppData\Local\Temp\E857.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\E971.tmp"C:\Users\Admin\AppData\Local\Temp\E971.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\EB94.tmp"C:\Users\Admin\AppData\Local\Temp\EB94.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\ED39.tmp"C:\Users\Admin\AppData\Local\Temp\ED39.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F131.tmp"C:\Users\Admin\AppData\Local\Temp\F131.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\F315.tmp"C:\Users\Admin\AppData\Local\Temp\F315.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\F70D.tmp"C:\Users\Admin\AppData\Local\Temp\F70D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\F836.tmp"C:\Users\Admin\AppData\Local\Temp\F836.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\FB05.tmp"C:\Users\Admin\AppData\Local\Temp\FB05.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\FBA1.tmp"C:\Users\Admin\AppData\Local\Temp\FBA1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\FC2E.tmp"C:\Users\Admin\AppData\Local\Temp\FC2E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\FEED.tmp"C:\Users\Admin\AppData\Local\Temp\FEED.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1CB.tmp"C:\Users\Admin\AppData\Local\Temp\1CB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2E4.tmp"C:\Users\Admin\AppData\Local\Temp\2E4.tmp"65⤵
- Executes dropped EXE
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"66⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\3EE.tmp"C:\Users\Admin\AppData\Local\Temp\3EE.tmp"67⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\46B.tmp"C:\Users\Admin\AppData\Local\Temp\46B.tmp"68⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\507.tmp"C:\Users\Admin\AppData\Local\Temp\507.tmp"69⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\594.tmp"C:\Users\Admin\AppData\Local\Temp\594.tmp"70⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\640.tmp"C:\Users\Admin\AppData\Local\Temp\640.tmp"71⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\6EC.tmp"C:\Users\Admin\AppData\Local\Temp\6EC.tmp"72⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"73⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"74⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"75⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\96C.tmp"C:\Users\Admin\AppData\Local\Temp\96C.tmp"76⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"77⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"78⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"79⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"80⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\BED.tmp"C:\Users\Admin\AppData\Local\Temp\BED.tmp"81⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\C99.tmp"C:\Users\Admin\AppData\Local\Temp\C99.tmp"82⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"83⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\DD1.tmp"C:\Users\Admin\AppData\Local\Temp\DD1.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"85⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"86⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"87⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"88⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"89⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"90⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"91⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\12C3.tmp"C:\Users\Admin\AppData\Local\Temp\12C3.tmp"92⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\136F.tmp"C:\Users\Admin\AppData\Local\Temp\136F.tmp"93⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"94⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"95⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1505.tmp"C:\Users\Admin\AppData\Local\Temp\1505.tmp"96⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"97⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\161E.tmp"C:\Users\Admin\AppData\Local\Temp\161E.tmp"98⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"99⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"100⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"101⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"102⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"103⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"104⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"105⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"106⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"107⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"108⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"109⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"110⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"111⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"112⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"113⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"114⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"115⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\209E.tmp"C:\Users\Admin\AppData\Local\Temp\209E.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"117⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"118⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2234.tmp"C:\Users\Admin\AppData\Local\Temp\2234.tmp"119⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"120⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\232E.tmp"C:\Users\Admin\AppData\Local\Temp\232E.tmp"121⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\23AB.tmp"C:\Users\Admin\AppData\Local\Temp\23AB.tmp"122⤵PID:4860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-