Analysis
- max time kernel
132s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260816-eynvsscr5t
- SHA256 ceb2169a9661d63bf731ada993d2b6a1349c83390d289ac70f8360820e2897e1
- MD5 703a41857c54abfaff3214eaeb853265
- SHA1 b7249873098da671f1e9985072fbc88e402cf9a5
- SHA512 6fe23a940c19e1f4f7c8c918ddea0d821e6d086e4cf2a93d20ae520070770fba4918691299a4081d752db49698e2adced7335be15eaa4f27f16bd442aeee2c8e
- SSDEEP 12288:9U5rCOTei6N7oIe4YwF2IS4GmyY7X2dIzzXsVgqZoXWjdq:9UQOJ6/YwF2UBzQgqqGh
- TLSH T144C4F1217581C032E6E202314EE2EBB1697F7C354B26A4C76B84667E6FB92E1D774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1984 FD08.tmp 4660 FDF3.tmp 5744 FECD.tmp 3008 FF99.tmp 5540 35.tmp 5012 E1.tmp 5436 1AC.tmp 3908 287.tmp 1460 352.tmp 4896 42C.tmp 940 4D8.tmp 4772 5C3.tmp 1404 66F.tmp 1252 71A.tmp 2592 7B7.tmp 1584 882.tmp 4920 93D.tmp 4576 9DA.tmp 3332 AA5.tmp 1796 B60.tmp 260 C0C.tmp 4720 CA8.tmp 5212 D73.tmp 3348 E10.tmp 5684 E8D.tmp 5608 F0A.tmp 5700 FE4.tmp 5552 1090.tmp 4652 110D.tmp 5952 11AA.tmp 2624 1255.tmp 2240 1311.tmp 5004 13CC.tmp 3736 1459.tmp 5652 14C6.tmp 2956 1543.tmp 1704 15E0.tmp 5908 164D.tmp 5124 16CA.tmp 6128 1747.tmp 1776 17C4.tmp 5736 1831.tmp 4260 18BE.tmp 5136 193B.tmp 560 19A8.tmp 1468 1A54.tmp 3276 1AB2.tmp 1540 1B2F.tmp 4668 1BCB.tmp 6092 1C68.tmp 4856 1D04.tmp 3612 1D90.tmp 4264 1E0D.tmp 3340 1E6B.tmp 3252 1EE8.tmp 3668 1F75.tmp 5144 2001.tmp 1676 207E.tmp 1192 20EC.tmp 2428 2178.tmp 5176 2205.tmp 3864 2292.tmp 4088 231E.tmp 3680 238C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 598B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B31.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1316 wrote to memory of 1984 1316 2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe 89 PID 1984 wrote to memory of 4660 1984 FD08.tmp 90 PID 4660 wrote to memory of 5744 4660 FDF3.tmp 91 PID 5744 wrote to memory of 3008 5744 FECD.tmp 92 PID 3008 wrote to memory of 5540 3008 FF99.tmp 93 PID 5540 wrote to memory of 5012 5540 35.tmp 94 PID 5012 wrote to memory of 5436 5012 E1.tmp 95 PID 5436 wrote to memory of 3908 5436 1AC.tmp 96 PID 3908 wrote to memory of 1460 3908 287.tmp 97 PID 1460 wrote to memory of 4896 1460 352.tmp 98 PID 4896 wrote to memory of 940 4896 42C.tmp 99 PID 940 wrote to memory of 4772 940 4D8.tmp 100 PID 4772 wrote to memory of 1404 4772 5C3.tmp 101 PID 1404 wrote to memory of 1252 1404 66F.tmp 102 PID 1252 wrote to memory of 2592 1252 71A.tmp 103 PID 2592 wrote to memory of 1584 2592 7B7.tmp 104 PID 1584 wrote to memory of 4920 1584 882.tmp 105 PID 4920 wrote to memory of 4576 4920 93D.tmp 106 PID 4576 wrote to memory of 3332 4576 9DA.tmp 107 PID 3332 wrote to memory of 1796 3332 AA5.tmp 108 PID 1796 wrote to memory of 260 1796 B60.tmp 109 PID 260 wrote to memory of 4720 260 C0C.tmp 110 PID 4720 wrote to memory of 5212 4720 CA8.tmp 111 PID 5212 wrote to memory of 3348 5212 D73.tmp 112 PID 3348 wrote to memory of 5684 3348 E10.tmp 113 PID 5684 wrote to memory of 5608 5684 E8D.tmp 114 PID 5608 wrote to memory of 5700 5608 F0A.tmp 115 PID 5700 wrote to memory of 5552 5700 FE4.tmp 116 PID 5552 wrote to memory of 4652 5552 1090.tmp 117 PID 4652 wrote to memory of 5952 4652 110D.tmp 118 PID 5952 wrote to memory of 2624 5952 11AA.tmp 119 PID 2624 wrote to memory of 2240 2624 1255.tmp 120 PID 2240 wrote to memory of 5004 2240 1311.tmp 121 PID 5004 wrote to memory of 3736 5004 13CC.tmp 122 PID 3736 wrote to memory of 5652 3736 1459.tmp 123 PID 5652 wrote to memory of 2956 5652 14C6.tmp 124 PID 2956 wrote to memory of 1704 2956 1543.tmp 125 PID 1704 wrote to memory of 5908 1704 15E0.tmp 126 PID 5908 wrote to memory of 5124 5908 164D.tmp 127 PID 5124 wrote to memory of 6128 5124 16CA.tmp 128 PID 6128 wrote to memory of 1776 6128 1747.tmp 129 PID 1776 wrote to memory of 5736 1776 17C4.tmp 130 PID 5736 wrote to memory of 4260 5736 1831.tmp 131 PID 4260 wrote to memory of 5136 4260 18BE.tmp 132 PID 5136 wrote to memory of 560 5136 193B.tmp 133 PID 560 wrote to memory of 1468 560 19A8.tmp 134 PID 1468 wrote to memory of 3276 1468 1A54.tmp 135 PID 3276 wrote to memory of 1540 3276 1AB2.tmp 136 PID 1540 wrote to memory of 4668 1540 1B2F.tmp 137 PID 4668 wrote to memory of 6092 4668 1BCB.tmp 138 PID 6092 wrote to memory of 4856 6092 1C68.tmp 139 PID 4856 wrote to memory of 3612 4856 1D04.tmp 140 PID 3612 wrote to memory of 4264 3612 1D90.tmp 141 PID 4264 wrote to memory of 3340 4264 1E0D.tmp 142 PID 3340 wrote to memory of 3252 3340 1E6B.tmp 143 PID 3252 wrote to memory of 3668 3252 1EE8.tmp 144 PID 3668 wrote to memory of 5144 3668 1F75.tmp 145 PID 5144 wrote to memory of 1676 5144 2001.tmp 146 PID 1676 wrote to memory of 1192 1676 207E.tmp 147 PID 1192 wrote to memory of 2428 1192 20EC.tmp 148 PID 2428 wrote to memory of 5176 2428 2178.tmp 149 PID 5176 wrote to memory of 3864 5176 2205.tmp 150 PID 3864 wrote to memory of 4088 3864 2292.tmp 151 PID 4088 wrote to memory of 3680 4088 231E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\E1.tmp"C:\Users\Admin\AppData\Local\Temp\E1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\1AC.tmp"C:\Users\Admin\AppData\Local\Temp\1AC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\287.tmp"C:\Users\Admin\AppData\Local\Temp\287.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\66F.tmp"C:\Users\Admin\AppData\Local\Temp\66F.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\882.tmp"C:\Users\Admin\AppData\Local\Temp\882.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\FE4.tmp"C:\Users\Admin\AppData\Local\Temp\FE4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\13CC.tmp"C:\Users\Admin\AppData\Local\Temp\13CC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\15E0.tmp"C:\Users\Admin\AppData\Local\Temp\15E0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\1747.tmp"C:\Users\Admin\AppData\Local\Temp\1747.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\1831.tmp"C:\Users\Admin\AppData\Local\Temp\1831.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\1D04.tmp"C:\Users\Admin\AppData\Local\Temp\1D04.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2001.tmp"C:\Users\Admin\AppData\Local\Temp\2001.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\207E.tmp"C:\Users\Admin\AppData\Local\Temp\207E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\20EC.tmp"C:\Users\Admin\AppData\Local\Temp\20EC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2205.tmp"C:\Users\Admin\AppData\Local\Temp\2205.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\231E.tmp"C:\Users\Admin\AppData\Local\Temp\231E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\238C.tmp"C:\Users\Admin\AppData\Local\Temp\238C.tmp"65⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"66⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\24A5.tmp"C:\Users\Admin\AppData\Local\Temp\24A5.tmp"67⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2522.tmp"C:\Users\Admin\AppData\Local\Temp\2522.tmp"68⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"69⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"70⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2699.tmp"C:\Users\Admin\AppData\Local\Temp\2699.tmp"71⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"72⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"73⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"74⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\287D.tmp"C:\Users\Admin\AppData\Local\Temp\287D.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"76⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"77⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"78⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"81⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"82⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2C56.tmp"C:\Users\Admin\AppData\Local\Temp\2C56.tmp"83⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2D02.tmp"C:\Users\Admin\AppData\Local\Temp\2D02.tmp"84⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"85⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"86⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"87⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"88⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"89⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2FD0.tmp"C:\Users\Admin\AppData\Local\Temp\2FD0.tmp"90⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"91⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\30CA.tmp"C:\Users\Admin\AppData\Local\Temp\30CA.tmp"92⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"93⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\31A5.tmp"C:\Users\Admin\AppData\Local\Temp\31A5.tmp"94⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"95⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"96⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\332C.tmp"C:\Users\Admin\AppData\Local\Temp\332C.tmp"97⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\33A9.tmp"C:\Users\Admin\AppData\Local\Temp\33A9.tmp"98⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"99⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"100⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"101⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"102⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\35EB.tmp"C:\Users\Admin\AppData\Local\Temp\35EB.tmp"103⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"104⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"105⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"106⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"107⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"108⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\38AA.tmp"C:\Users\Admin\AppData\Local\Temp\38AA.tmp"109⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\3994.tmp"C:\Users\Admin\AppData\Local\Temp\3994.tmp"111⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\3A02.tmp"C:\Users\Admin\AppData\Local\Temp\3A02.tmp"112⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"113⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"114⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"115⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"117⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"118⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"119⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\3E47.tmp"C:\Users\Admin\AppData\Local\Temp\3E47.tmp"120⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3EC4.tmp"C:\Users\Admin\AppData\Local\Temp\3EC4.tmp"121⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-