Analysis
- max time kernel
126s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_93437bdd140fe443a406ff5e91bd5999_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_93437bdd140fe443a406ff5e91bd5999_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_93437bdd140fe443a406ff5e91bd5999_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260817-1n4ddsak2w
- SHA256 5f4540c4b70ecd3ce7170d7b9b5093d9f6f0ecaed575cb5b014f890745ea9587
- MD5 93437bdd140fe443a406ff5e91bd5999
- SHA1 24cdc4e118efce75518e6de3986bfb800b1f0be6
- SHA512 87bcbd308f976b4d676a57848fd0923da15e8df6dd472573ce2bf4d41504decee0ec032d0da5d99765b4e3ff6f92a8d9d543c5e40d090832514727f463c569ef
- SSDEEP 12288:wU5rCOTeiD0rmRR79aVOYErndyZZNG5SKpB8kdNouXtWtENZ+3/v+I9hUG2VA:wUQOJD0KBatQ5SqB5dNoudPNGEA
- TLSH T1BAE4D02077D8C536E9FB037855F9E6614A7EBD325712D6CF6B8016AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4692 4930.tmp 2308 4AE5.tmp 3416 4B81.tmp 5916 4C2D.tmp 4888 4CE9.tmp 752 4D75.tmp 6016 4E12.tmp 5952 4EAE.tmp 5912 4F4A.tmp 3240 4FD7.tmp 1148 5054.tmp 5624 50D1.tmp 1684 517D.tmp 3528 51EA.tmp 1072 5267.tmp 1224 5332.tmp 4040 539F.tmp 5776 543C.tmp 2324 5507.tmp 3380 55C2.tmp 3884 566E.tmp 4452 56EB.tmp 5088 5759.tmp 676 5814.tmp 2700 5881.tmp 4708 590E.tmp 4084 599B.tmp 4604 5A56.tmp 2836 5AD3.tmp 2008 5B41.tmp 4676 5BCD.tmp 5692 5C5A.tmp 1872 5CE6.tmp 5336 5D83.tmp 1516 5E0F.tmp 5428 5E8C.tmp 3168 5F09.tmp 2772 5F77.tmp 2924 5FF4.tmp 1104 6071.tmp 620 60EE.tmp 2896 617A.tmp 256 61F7.tmp 4336 6274.tmp 3136 62D2.tmp 5056 635F.tmp 4024 67F3.tmp 5680 689E.tmp 5308 691B.tmp 3992 6998.tmp 4832 6A06.tmp 3384 6A83.tmp 6064 6B0F.tmp 2092 6B7D.tmp 3892 6BFA.tmp 2964 6C96.tmp 1196 6D03.tmp 2372 6D71.tmp 2812 6DDE.tmp 472 6E4C.tmp 4232 6EB9.tmp 4640 6F26.tmp 4016 6FA3.tmp 120 7011.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D09F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 955C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A341.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E51D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 609B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1257.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3324 wrote to memory of 4692 3324 2026-08-17_93437bdd140fe443a406ff5e91bd5999_elex_mafia_stealc_tofsee.exe 90 PID 4692 wrote to memory of 2308 4692 4930.tmp 91 PID 2308 wrote to memory of 3416 2308 4AE5.tmp 92 PID 3416 wrote to memory of 5916 3416 4B81.tmp 93 PID 5916 wrote to memory of 4888 5916 4C2D.tmp 94 PID 4888 wrote to memory of 752 4888 4CE9.tmp 95 PID 752 wrote to memory of 6016 752 4D75.tmp 96 PID 6016 wrote to memory of 5952 6016 4E12.tmp 97 PID 5952 wrote to memory of 5912 5952 4EAE.tmp 98 PID 5912 wrote to memory of 3240 5912 4F4A.tmp 99 PID 3240 wrote to memory of 1148 3240 4FD7.tmp 100 PID 1148 wrote to memory of 5624 1148 5054.tmp 101 PID 5624 wrote to memory of 1684 5624 50D1.tmp 102 PID 1684 wrote to memory of 3528 1684 517D.tmp 103 PID 3528 wrote to memory of 1072 3528 51EA.tmp 104 PID 1072 wrote to memory of 1224 1072 5267.tmp 105 PID 1224 wrote to memory of 4040 1224 5332.tmp 106 PID 4040 wrote to memory of 5776 4040 539F.tmp 107 PID 5776 wrote to memory of 2324 5776 543C.tmp 108 PID 2324 wrote to memory of 3380 2324 5507.tmp 109 PID 3380 wrote to memory of 3884 3380 55C2.tmp 110 PID 3884 wrote to memory of 4452 3884 566E.tmp 111 PID 4452 wrote to memory of 5088 4452 56EB.tmp 112 PID 5088 wrote to memory of 676 5088 5759.tmp 113 PID 676 wrote to memory of 2700 676 5814.tmp 114 PID 2700 wrote to memory of 4708 2700 5881.tmp 115 PID 4708 wrote to memory of 4084 4708 590E.tmp 116 PID 4084 wrote to memory of 4604 4084 599B.tmp 117 PID 4604 wrote to memory of 2836 4604 5A56.tmp 118 PID 2836 wrote to memory of 2008 2836 5AD3.tmp 119 PID 2008 wrote to memory of 4676 2008 5B41.tmp 120 PID 4676 wrote to memory of 5692 4676 5BCD.tmp 121 PID 5692 wrote to memory of 1872 5692 5C5A.tmp 122 PID 1872 wrote to memory of 5336 1872 5CE6.tmp 123 PID 5336 wrote to memory of 1516 5336 5D83.tmp 124 PID 1516 wrote to memory of 5428 1516 5E0F.tmp 125 PID 5428 wrote to memory of 3168 5428 5E8C.tmp 126 PID 3168 wrote to memory of 2772 3168 5F09.tmp 127 PID 2772 wrote to memory of 2924 2772 5F77.tmp 128 PID 2924 wrote to memory of 1104 2924 5FF4.tmp 129 PID 1104 wrote to memory of 620 1104 6071.tmp 130 PID 620 wrote to memory of 2896 620 60EE.tmp 131 PID 2896 wrote to memory of 256 2896 617A.tmp 132 PID 256 wrote to memory of 4336 256 61F7.tmp 133 PID 4336 wrote to memory of 3136 4336 6274.tmp 134 PID 3136 wrote to memory of 5056 3136 62D2.tmp 135 PID 5056 wrote to memory of 4024 5056 635F.tmp 136 PID 4024 wrote to memory of 5680 4024 67F3.tmp 137 PID 5680 wrote to memory of 5308 5680 689E.tmp 138 PID 5308 wrote to memory of 3992 5308 691B.tmp 139 PID 3992 wrote to memory of 4832 3992 6998.tmp 140 PID 4832 wrote to memory of 3384 4832 6A06.tmp 141 PID 3384 wrote to memory of 6064 3384 6A83.tmp 142 PID 6064 wrote to memory of 2092 6064 6B0F.tmp 143 PID 2092 wrote to memory of 3892 2092 6B7D.tmp 144 PID 3892 wrote to memory of 2964 3892 6BFA.tmp 145 PID 2964 wrote to memory of 1196 2964 6C96.tmp 146 PID 1196 wrote to memory of 2372 1196 6D03.tmp 147 PID 2372 wrote to memory of 2812 2372 6D71.tmp 148 PID 2812 wrote to memory of 472 2812 6DDE.tmp 149 PID 472 wrote to memory of 4232 472 6E4C.tmp 150 PID 4232 wrote to memory of 4640 4232 6EB9.tmp 151 PID 4640 wrote to memory of 4016 4640 6F26.tmp 152 PID 4016 wrote to memory of 120 4016 6FA3.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_93437bdd140fe443a406ff5e91bd5999_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_93437bdd140fe443a406ff5e91bd5999_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4D75.tmp"C:\Users\Admin\AppData\Local\Temp\4D75.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4E12.tmp"C:\Users\Admin\AppData\Local\Temp\4E12.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5054.tmp"C:\Users\Admin\AppData\Local\Temp\5054.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\50D1.tmp"C:\Users\Admin\AppData\Local\Temp\50D1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\517D.tmp"C:\Users\Admin\AppData\Local\Temp\517D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\51EA.tmp"C:\Users\Admin\AppData\Local\Temp\51EA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5267.tmp"C:\Users\Admin\AppData\Local\Temp\5267.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\5332.tmp"C:\Users\Admin\AppData\Local\Temp\5332.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\539F.tmp"C:\Users\Admin\AppData\Local\Temp\539F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\543C.tmp"C:\Users\Admin\AppData\Local\Temp\543C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\5507.tmp"C:\Users\Admin\AppData\Local\Temp\5507.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\566E.tmp"C:\Users\Admin\AppData\Local\Temp\566E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\56EB.tmp"C:\Users\Admin\AppData\Local\Temp\56EB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5759.tmp"C:\Users\Admin\AppData\Local\Temp\5759.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5814.tmp"C:\Users\Admin\AppData\Local\Temp\5814.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\5881.tmp"C:\Users\Admin\AppData\Local\Temp\5881.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\590E.tmp"C:\Users\Admin\AppData\Local\Temp\590E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\599B.tmp"C:\Users\Admin\AppData\Local\Temp\599B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5A56.tmp"C:\Users\Admin\AppData\Local\Temp\5A56.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5BCD.tmp"C:\Users\Admin\AppData\Local\Temp\5BCD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5D83.tmp"C:\Users\Admin\AppData\Local\Temp\5D83.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5E8C.tmp"C:\Users\Admin\AppData\Local\Temp\5E8C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\5F09.tmp"C:\Users\Admin\AppData\Local\Temp\5F09.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\5F77.tmp"C:\Users\Admin\AppData\Local\Temp\5F77.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\6071.tmp"C:\Users\Admin\AppData\Local\Temp\6071.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\60EE.tmp"C:\Users\Admin\AppData\Local\Temp\60EE.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\617A.tmp"C:\Users\Admin\AppData\Local\Temp\617A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\61F7.tmp"C:\Users\Admin\AppData\Local\Temp\61F7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\6274.tmp"C:\Users\Admin\AppData\Local\Temp\6274.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\62D2.tmp"C:\Users\Admin\AppData\Local\Temp\62D2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\635F.tmp"C:\Users\Admin\AppData\Local\Temp\635F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\67F3.tmp"C:\Users\Admin\AppData\Local\Temp\67F3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\689E.tmp"C:\Users\Admin\AppData\Local\Temp\689E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\691B.tmp"C:\Users\Admin\AppData\Local\Temp\691B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\6998.tmp"C:\Users\Admin\AppData\Local\Temp\6998.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\6A06.tmp"C:\Users\Admin\AppData\Local\Temp\6A06.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\6A83.tmp"C:\Users\Admin\AppData\Local\Temp\6A83.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\6B7D.tmp"C:\Users\Admin\AppData\Local\Temp\6B7D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\6BFA.tmp"C:\Users\Admin\AppData\Local\Temp\6BFA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\6C96.tmp"C:\Users\Admin\AppData\Local\Temp\6C96.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\6D03.tmp"C:\Users\Admin\AppData\Local\Temp\6D03.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\6D71.tmp"C:\Users\Admin\AppData\Local\Temp\6D71.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\6F26.tmp"C:\Users\Admin\AppData\Local\Temp\6F26.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"65⤵
- Executes dropped EXE
PID:120 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"66⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"67⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"69⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\7282.tmp"C:\Users\Admin\AppData\Local\Temp\7282.tmp"70⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"71⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"72⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\73CA.tmp"C:\Users\Admin\AppData\Local\Temp\73CA.tmp"73⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\7437.tmp"C:\Users\Admin\AppData\Local\Temp\7437.tmp"74⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\74C4.tmp"C:\Users\Admin\AppData\Local\Temp\74C4.tmp"75⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\7560.tmp"C:\Users\Admin\AppData\Local\Temp\7560.tmp"76⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\761C.tmp"C:\Users\Admin\AppData\Local\Temp\761C.tmp"77⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\76D7.tmp"C:\Users\Admin\AppData\Local\Temp\76D7.tmp"78⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7793.tmp"C:\Users\Admin\AppData\Local\Temp\7793.tmp"79⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\782F.tmp"C:\Users\Admin\AppData\Local\Temp\782F.tmp"80⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\78AC.tmp"C:\Users\Admin\AppData\Local\Temp\78AC.tmp"81⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\7929.tmp"C:\Users\Admin\AppData\Local\Temp\7929.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"83⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\7A61.tmp"C:\Users\Admin\AppData\Local\Temp\7A61.tmp"84⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"85⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"86⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\7C26.tmp"C:\Users\Admin\AppData\Local\Temp\7C26.tmp"87⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"C:\Users\Admin\AppData\Local\Temp\7CA3.tmp"88⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"89⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"90⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\7E59.tmp"C:\Users\Admin\AppData\Local\Temp\7E59.tmp"91⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"92⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"93⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"94⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\807C.tmp"C:\Users\Admin\AppData\Local\Temp\807C.tmp"95⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\8108.tmp"C:\Users\Admin\AppData\Local\Temp\8108.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"97⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\8202.tmp"C:\Users\Admin\AppData\Local\Temp\8202.tmp"98⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\827F.tmp"C:\Users\Admin\AppData\Local\Temp\827F.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\830C.tmp"C:\Users\Admin\AppData\Local\Temp\830C.tmp"100⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8389.tmp"C:\Users\Admin\AppData\Local\Temp\8389.tmp"101⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8406.tmp"C:\Users\Admin\AppData\Local\Temp\8406.tmp"102⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\84A2.tmp"C:\Users\Admin\AppData\Local\Temp\84A2.tmp"103⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\8510.tmp"C:\Users\Admin\AppData\Local\Temp\8510.tmp"104⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\857D.tmp"C:\Users\Admin\AppData\Local\Temp\857D.tmp"105⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\8619.tmp"C:\Users\Admin\AppData\Local\Temp\8619.tmp"106⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\8696.tmp"C:\Users\Admin\AppData\Local\Temp\8696.tmp"107⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\8723.tmp"C:\Users\Admin\AppData\Local\Temp\8723.tmp"108⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\87CF.tmp"C:\Users\Admin\AppData\Local\Temp\87CF.tmp"109⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\884C.tmp"C:\Users\Admin\AppData\Local\Temp\884C.tmp"110⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\88B9.tmp"C:\Users\Admin\AppData\Local\Temp\88B9.tmp"111⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\8936.tmp"C:\Users\Admin\AppData\Local\Temp\8936.tmp"112⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\89D2.tmp"C:\Users\Admin\AppData\Local\Temp\89D2.tmp"113⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"C:\Users\Admin\AppData\Local\Temp\8A4F.tmp"114⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"115⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\8B59.tmp"C:\Users\Admin\AppData\Local\Temp\8B59.tmp"116⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"117⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\8C72.tmp"C:\Users\Admin\AppData\Local\Temp\8C72.tmp"118⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\8CEF.tmp"C:\Users\Admin\AppData\Local\Temp\8CEF.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"120⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\8DF9.tmp"C:\Users\Admin\AppData\Local\Temp\8DF9.tmp"121⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\8E86.tmp"C:\Users\Admin\AppData\Local\Temp\8E86.tmp"122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-