Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 11:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260815-npsbaswva1
- SHA256 531e231ddb3edfa04e5bf78b3101ae8f0f94da57aae1a5e9022712365f2d5b44
- MD5 072662abd2f33fc244d70acc4dab04f9
- SHA1 500977785aac3b8b1e59757bdad5a6aa5f9dc214
- SHA512 f16afcd3d2a083e4490d0994c3644058c33dab222a91b4c8d7187776d5de82ef2441d00962d9312806cb801843e620fa727ff62170d71c8700385acff97108d3
- SSDEEP 12288:NU5rCOTeijhCdHFn85Fd6I5KjCT/nZReFs4XgnLTZwlH:NUQOJjodHu6I5Qkn1LTSlH
- TLSH T17EB4F1267285C133E69202710EE6EBA26D3B7C71572664C33B94677E2EB13D0A779343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1068 10B4.tmp 2936 1131.tmp 2560 11CE.tmp 1256 12B8.tmp 2100 1354.tmp 3960 13C2.tmp 1244 144E.tmp 2088 150A.tmp 2980 1596.tmp 4548 1642.tmp 3036 16EE.tmp 4492 176B.tmp 3936 1807.tmp 3548 1875.tmp 4044 1901.tmp 4060 199E.tmp 3828 1A49.tmp 3692 1AC6.tmp 4728 1B43.tmp 2032 1BE0.tmp 60 1CAB.tmp 4384 1D57.tmp 536 1DE3.tmp 4284 1E70.tmp 684 1F0C.tmp 1776 1FC8.tmp 1788 2054.tmp 3232 20F1.tmp 212 21AC.tmp 3064 2229.tmp 332 22C5.tmp 4736 2371.tmp 2964 23EE.tmp 980 244C.tmp 4296 249A.tmp 2892 24E8.tmp 4008 2556.tmp 3372 25C3.tmp 3452 2621.tmp 1680 268E.tmp 4652 26DC.tmp 4600 274A.tmp 2444 27A7.tmp 2496 27F5.tmp 4088 2844.tmp 1172 28B1.tmp 4520 28FF.tmp 2400 295D.tmp 2820 29AB.tmp 4448 2A09.tmp 3948 2A57.tmp 2604 2AA5.tmp 3492 2AF3.tmp 1332 2B41.tmp 440 2B8F.tmp 880 2BFD.tmp 1320 2C4B.tmp 2460 2CA9.tmp 5052 2CF7.tmp 2888 2D45.tmp 4176 2D93.tmp 4660 2DF1.tmp 2404 2E3F.tmp 4856 2E8D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A321.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 199E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 110D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B89D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 387B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 1068 1288 2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe 85 PID 1068 wrote to memory of 2936 1068 10B4.tmp 86 PID 2936 wrote to memory of 2560 2936 1131.tmp 87 PID 2560 wrote to memory of 1256 2560 11CE.tmp 88 PID 1256 wrote to memory of 2100 1256 12B8.tmp 89 PID 2100 wrote to memory of 3960 2100 1354.tmp 90 PID 3960 wrote to memory of 1244 3960 13C2.tmp 91 PID 1244 wrote to memory of 2088 1244 144E.tmp 92 PID 2088 wrote to memory of 2980 2088 150A.tmp 93 PID 2980 wrote to memory of 4548 2980 1596.tmp 94 PID 4548 wrote to memory of 3036 4548 1642.tmp 95 PID 3036 wrote to memory of 4492 3036 16EE.tmp 96 PID 4492 wrote to memory of 3936 4492 176B.tmp 97 PID 3936 wrote to memory of 3548 3936 1807.tmp 98 PID 3548 wrote to memory of 4044 3548 1875.tmp 99 PID 4044 wrote to memory of 4060 4044 1901.tmp 100 PID 4060 wrote to memory of 3828 4060 199E.tmp 101 PID 3828 wrote to memory of 3692 3828 1A49.tmp 102 PID 3692 wrote to memory of 4728 3692 1AC6.tmp 103 PID 4728 wrote to memory of 2032 4728 1B43.tmp 104 PID 2032 wrote to memory of 60 2032 1BE0.tmp 105 PID 60 wrote to memory of 4384 60 1CAB.tmp 106 PID 4384 wrote to memory of 536 4384 1D57.tmp 107 PID 536 wrote to memory of 4284 536 1DE3.tmp 108 PID 4284 wrote to memory of 684 4284 1E70.tmp 109 PID 684 wrote to memory of 1776 684 1F0C.tmp 110 PID 1776 wrote to memory of 1788 1776 1FC8.tmp 111 PID 1788 wrote to memory of 3232 1788 2054.tmp 112 PID 3232 wrote to memory of 212 3232 20F1.tmp 113 PID 212 wrote to memory of 3064 212 21AC.tmp 114 PID 3064 wrote to memory of 332 3064 2229.tmp 115 PID 332 wrote to memory of 4736 332 22C5.tmp 116 PID 4736 wrote to memory of 2964 4736 2371.tmp 117 PID 2964 wrote to memory of 980 2964 23EE.tmp 118 PID 980 wrote to memory of 4296 980 244C.tmp 119 PID 4296 wrote to memory of 2892 4296 249A.tmp 120 PID 2892 wrote to memory of 4008 2892 24E8.tmp 121 PID 4008 wrote to memory of 3372 4008 2556.tmp 122 PID 3372 wrote to memory of 3452 3372 25C3.tmp 123 PID 3452 wrote to memory of 1680 3452 2621.tmp 124 PID 1680 wrote to memory of 4652 1680 268E.tmp 125 PID 4652 wrote to memory of 4600 4652 26DC.tmp 126 PID 4600 wrote to memory of 2444 4600 274A.tmp 127 PID 2444 wrote to memory of 2496 2444 27A7.tmp 128 PID 2496 wrote to memory of 4088 2496 27F5.tmp 129 PID 4088 wrote to memory of 1172 4088 2844.tmp 130 PID 1172 wrote to memory of 4520 1172 28B1.tmp 131 PID 4520 wrote to memory of 2400 4520 28FF.tmp 132 PID 2400 wrote to memory of 2820 2400 295D.tmp 133 PID 2820 wrote to memory of 4448 2820 29AB.tmp 134 PID 4448 wrote to memory of 3948 4448 2A09.tmp 135 PID 3948 wrote to memory of 2604 3948 2A57.tmp 136 PID 2604 wrote to memory of 3492 2604 2AA5.tmp 137 PID 3492 wrote to memory of 1332 3492 2AF3.tmp 138 PID 1332 wrote to memory of 440 1332 2B41.tmp 139 PID 440 wrote to memory of 880 440 2B8F.tmp 140 PID 880 wrote to memory of 1320 880 2BFD.tmp 141 PID 1320 wrote to memory of 2460 1320 2C4B.tmp 142 PID 2460 wrote to memory of 5052 2460 2CA9.tmp 143 PID 5052 wrote to memory of 2888 5052 2CF7.tmp 144 PID 2888 wrote to memory of 4176 2888 2D45.tmp 145 PID 4176 wrote to memory of 4660 4176 2D93.tmp 146 PID 4660 wrote to memory of 2404 4660 2DF1.tmp 147 PID 2404 wrote to memory of 4856 2404 2E3F.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2844.tmp"C:\Users\Admin\AppData\Local\Temp\2844.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"65⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"66⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"67⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"68⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"69⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"70⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"72⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"73⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"74⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"75⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"76⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"77⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"78⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"79⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"80⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"81⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"82⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"83⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"84⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"85⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"86⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"87⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"88⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"89⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"90⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"91⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"92⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"94⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"95⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"96⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"97⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"98⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"99⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"100⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"101⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"102⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"103⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"104⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"105⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"107⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"108⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"109⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"110⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"111⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"112⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"113⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"114⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"115⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"117⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"118⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"119⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"120⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"121⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"122⤵PID:3996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-