Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 16:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_d064045b583622165ad764bc592017b0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_d064045b583622165ad764bc592017b0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_d064045b583622165ad764bc592017b0_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260816-vap1yssxdv
- SHA256 43c7b1ef68a44cacbfbe574ca74eab1c4a8073651c37b546b6b5bb4b961c2343
- MD5 d064045b583622165ad764bc592017b0
- SHA1 27625db5c7ad47a1a25d5c64b1cf3461481662d7
- SHA512 43214dd6c9388276654392daf9edb46f15a213ae790e26bf85ef78028650b78bc39ce1e6ba14e1ac37dbd1b70e10f49191ee324d6d74ef99710f6f1efc239360
- SSDEEP 12288:wU5rCOTeiDaf14qoPBKcIF+yX7YPNZ+3/v+I9hUG2VA:wUQOJDyWdAcsreNGEA
- TLSH T157E4D12177D8C532E5FB037859B5E6614D7EBD266722D6CF2F9012AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5224 88B3.tmp 5616 899D.tmp 5952 8A88.tmp 3024 8C0E.tmp 1996 8D66.tmp 5704 8E7F.tmp 5520 8F79.tmp 5580 9064.tmp 5660 91AC.tmp 5640 9296.tmp 5996 93EE.tmp 5800 94F8.tmp 5836 95E2.tmp 6112 96EC.tmp 5712 97A7.tmp 5900 98C0.tmp 6068 99CA.tmp 632 9A95.tmp 6028 9BBE.tmp 1548 9CE7.tmp 2088 9DD1.tmp 5748 9F0A.tmp 3088 A042.tmp 3268 A15C.tmp 444 A284.tmp 4172 A3AD.tmp 1512 A505.tmp 2800 A62E.tmp 992 A766.tmp 3964 A880.tmp 1636 A9A9.tmp 3420 AAB2.tmp 3648 ABCB.tmp 4756 AC77.tmp 676 AD04.tmp 1800 ADA0.tmp 5060 AE1D.tmp 3320 AEC9.tmp 4784 AF75.tmp 4764 B030.tmp 4728 B08E.tmp 3192 B12A.tmp 4712 B1C7.tmp 216 B263.tmp 3908 B31E.tmp 3588 B3BB.tmp 3124 B457.tmp 3000 B4E4.tmp 4916 B58F.tmp 3008 B5DE.tmp 2416 B63B.tmp 1584 B689.tmp 4140 B6D8.tmp 2500 B745.tmp 4304 B7C2.tmp 944 B820.tmp 2232 B86E.tmp 1992 B8BC.tmp 4584 B91A.tmp 4416 B977.tmp 5128 B9F4.tmp 5240 BA52.tmp 5328 BAC0.tmp 5368 BB2D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F25A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C86C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 5224 4996 2026-08-16_d064045b583622165ad764bc592017b0_elex_mafia_stealc_tofsee.exe 85 PID 5224 wrote to memory of 5616 5224 88B3.tmp 86 PID 5616 wrote to memory of 5952 5616 899D.tmp 87 PID 5952 wrote to memory of 3024 5952 8A88.tmp 88 PID 3024 wrote to memory of 1996 3024 8C0E.tmp 89 PID 1996 wrote to memory of 5704 1996 8D66.tmp 90 PID 5704 wrote to memory of 5520 5704 8E7F.tmp 91 PID 5520 wrote to memory of 5580 5520 8F79.tmp 92 PID 5580 wrote to memory of 5660 5580 9064.tmp 93 PID 5660 wrote to memory of 5640 5660 91AC.tmp 94 PID 5640 wrote to memory of 5996 5640 9296.tmp 95 PID 5996 wrote to memory of 5800 5996 93EE.tmp 96 PID 5800 wrote to memory of 5836 5800 94F8.tmp 97 PID 5836 wrote to memory of 6112 5836 95E2.tmp 98 PID 6112 wrote to memory of 5712 6112 96EC.tmp 99 PID 5712 wrote to memory of 5900 5712 97A7.tmp 100 PID 5900 wrote to memory of 6068 5900 98C0.tmp 101 PID 6068 wrote to memory of 632 6068 99CA.tmp 102 PID 632 wrote to memory of 6028 632 9A95.tmp 103 PID 6028 wrote to memory of 1548 6028 9BBE.tmp 104 PID 1548 wrote to memory of 2088 1548 9CE7.tmp 105 PID 2088 wrote to memory of 5748 2088 9DD1.tmp 106 PID 5748 wrote to memory of 3088 5748 9F0A.tmp 107 PID 3088 wrote to memory of 3268 3088 A042.tmp 108 PID 3268 wrote to memory of 444 3268 A15C.tmp 109 PID 444 wrote to memory of 4172 444 A284.tmp 110 PID 4172 wrote to memory of 1512 4172 A3AD.tmp 111 PID 1512 wrote to memory of 2800 1512 A505.tmp 112 PID 2800 wrote to memory of 992 2800 A62E.tmp 113 PID 992 wrote to memory of 3964 992 A766.tmp 114 PID 3964 wrote to memory of 1636 3964 A880.tmp 115 PID 1636 wrote to memory of 3420 1636 A9A9.tmp 116 PID 3420 wrote to memory of 3648 3420 AAB2.tmp 117 PID 3648 wrote to memory of 4756 3648 ABCB.tmp 118 PID 4756 wrote to memory of 676 4756 AC77.tmp 119 PID 676 wrote to memory of 1800 676 AD04.tmp 120 PID 1800 wrote to memory of 5060 1800 ADA0.tmp 121 PID 5060 wrote to memory of 3320 5060 AE1D.tmp 122 PID 3320 wrote to memory of 4784 3320 AEC9.tmp 123 PID 4784 wrote to memory of 4764 4784 AF75.tmp 124 PID 4764 wrote to memory of 4728 4764 B030.tmp 125 PID 4728 wrote to memory of 3192 4728 B08E.tmp 126 PID 3192 wrote to memory of 4712 3192 B12A.tmp 127 PID 4712 wrote to memory of 216 4712 B1C7.tmp 129 PID 216 wrote to memory of 3908 216 B263.tmp 131 PID 3908 wrote to memory of 3588 3908 B31E.tmp 133 PID 3588 wrote to memory of 3124 3588 B3BB.tmp 134 PID 3124 wrote to memory of 3000 3124 B457.tmp 135 PID 3000 wrote to memory of 4916 3000 B4E4.tmp 136 PID 4916 wrote to memory of 3008 4916 B58F.tmp 137 PID 3008 wrote to memory of 2416 3008 B5DE.tmp 138 PID 2416 wrote to memory of 1584 2416 B63B.tmp 139 PID 1584 wrote to memory of 4140 1584 B689.tmp 140 PID 4140 wrote to memory of 2500 4140 B6D8.tmp 141 PID 2500 wrote to memory of 4304 2500 B745.tmp 142 PID 4304 wrote to memory of 944 4304 B7C2.tmp 143 PID 944 wrote to memory of 2232 944 B820.tmp 144 PID 2232 wrote to memory of 1992 2232 B86E.tmp 145 PID 1992 wrote to memory of 4584 1992 B8BC.tmp 146 PID 4584 wrote to memory of 4416 4584 B91A.tmp 147 PID 4416 wrote to memory of 5128 4416 B977.tmp 148 PID 5128 wrote to memory of 5240 5128 B9F4.tmp 149 PID 5240 wrote to memory of 5328 5240 BA52.tmp 150 PID 5328 wrote to memory of 5368 5328 BAC0.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_d064045b583622165ad764bc592017b0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_d064045b583622165ad764bc592017b0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\8C0E.tmp"C:\Users\Admin\AppData\Local\Temp\8C0E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\93EE.tmp"C:\Users\Admin\AppData\Local\Temp\93EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\95E2.tmp"C:\Users\Admin\AppData\Local\Temp\95E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\96EC.tmp"C:\Users\Admin\AppData\Local\Temp\96EC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\A042.tmp"C:\Users\Admin\AppData\Local\Temp\A042.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A284.tmp"C:\Users\Admin\AppData\Local\Temp\A284.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\AC77.tmp"C:\Users\Admin\AppData\Local\Temp\AC77.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\AD04.tmp"C:\Users\Admin\AppData\Local\Temp\AD04.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\B3BB.tmp"C:\Users\Admin\AppData\Local\Temp\B3BB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B58F.tmp"C:\Users\Admin\AppData\Local\Temp\B58F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\B63B.tmp"C:\Users\Admin\AppData\Local\Temp\B63B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\B820.tmp"C:\Users\Admin\AppData\Local\Temp\B820.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"65⤵
- Executes dropped EXE
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"66⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\BBF8.tmp"C:\Users\Admin\AppData\Local\Temp\BBF8.tmp"67⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\BC56.tmp"C:\Users\Admin\AppData\Local\Temp\BC56.tmp"68⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\BCB4.tmp"C:\Users\Admin\AppData\Local\Temp\BCB4.tmp"69⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"70⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"71⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"72⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\BE59.tmp"C:\Users\Admin\AppData\Local\Temp\BE59.tmp"73⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\BED6.tmp"C:\Users\Admin\AppData\Local\Temp\BED6.tmp"74⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"75⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"76⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\C00F.tmp"C:\Users\Admin\AppData\Local\Temp\C00F.tmp"77⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"78⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\C138.tmp"C:\Users\Admin\AppData\Local\Temp\C138.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\C186.tmp"C:\Users\Admin\AppData\Local\Temp\C186.tmp"81⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"82⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C241.tmp"C:\Users\Admin\AppData\Local\Temp\C241.tmp"83⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\C29F.tmp"C:\Users\Admin\AppData\Local\Temp\C29F.tmp"84⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"85⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\C36A.tmp"C:\Users\Admin\AppData\Local\Temp\C36A.tmp"86⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"87⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"88⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"89⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"90⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"91⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"92⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"93⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\C697.tmp"C:\Users\Admin\AppData\Local\Temp\C697.tmp"94⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"95⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"97⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"99⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\C917.tmp"C:\Users\Admin\AppData\Local\Temp\C917.tmp"100⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"101⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"102⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"103⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"104⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"105⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"106⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"107⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"108⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"110⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"111⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"112⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\CDEA.tmp"C:\Users\Admin\AppData\Local\Temp\CDEA.tmp"113⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"114⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"115⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"116⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"117⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"118⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"119⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"120⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"121⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"122⤵PID:5976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-