Analysis
- max time kernel
116s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 12:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_86ebd4ca5926fdcc29f13cb69bbc903b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_86ebd4ca5926fdcc29f13cb69bbc903b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_86ebd4ca5926fdcc29f13cb69bbc903b_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260817-p8fx2s1bmd
- SHA256 a8e2d41ad070693f70e5b0926f9ac77c695100cab112a6984668ebbbe455dc2f
- MD5 86ebd4ca5926fdcc29f13cb69bbc903b
- SHA1 522c853e18d968aa1b96c018234e879e6d383ed3
- SHA512 ba63b7b59ff3ea9deae71dfde4e4cf98dd3e60e55babd7cabe5cf9c815c06e5a384da59d8af623a5978f37523683c198572c72b09bdf0c94a6e8f5734e11c817
- SSDEEP 6144:qorf3lPvovsgZnqG2C7mOTeiL9DU0J67LW5VvJMs9m1RI2xIoOWwat5556WVrhYi:HU5rCOTeiJxkS5fMSIIFoOQt5VZNZ
- TLSH T149B4F121B585C433E69202314EEAEBB1293B7D715B2694C77BC4A76E6E702E1E374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1928 E12F.tmp 4348 E1DA.tmp 4008 E2B5.tmp 1812 E3A0.tmp 3356 E584.tmp 4200 E64F.tmp 4440 E6EB.tmp 4144 E7D6.tmp 3564 E882.tmp 1888 E91E.tmp 4976 E9AA.tmp 6044 EA37.tmp 1456 EAF3.tmp 2564 EB60.tmp 5084 EBED.tmp 3620 EC5A.tmp 2592 ECD7.tmp 5396 ED54.tmp 4152 EDE1.tmp 2996 EE9C.tmp 4020 EF48.tmp 4476 F013.tmp 5876 F090.tmp 2588 F14C.tmp 1820 F1D8.tmp 1044 F294.tmp 3908 F340.tmp 3144 F3DC.tmp 2000 F4A7.tmp 2080 F524.tmp 1380 F5B1.tmp 3148 F61E.tmp 4792 F69B.tmp 4760 F747.tmp 2444 F7C4.tmp 5736 F841.tmp 2400 F8AE.tmp 3744 F93B.tmp 1052 F9B8.tmp 3224 FA25.tmp 3344 FAA2.tmp 924 FB2F.tmp 4316 FB8D.tmp 2700 FC0A.tmp 996 FC77.tmp 1548 FD13.tmp 1972 FDA0.tmp 1144 FE2C.tmp 5296 FEB9.tmp 2876 FF55.tmp 5464 FFF2.tmp 3816 8E.tmp 3532 10B.tmp 4592 178.tmp 3992 1F5.tmp 3124 282.tmp 4892 30E.tmp 1224 37C.tmp 2236 408.tmp 1112 476.tmp 1756 4D4.tmp 5900 551.tmp 1336 5DD.tmp 5040 65A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F14C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 681D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 325C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F36A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C257.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E12F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F01E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1928 4876 2026-08-17_86ebd4ca5926fdcc29f13cb69bbc903b_elex_mafia_stealc_tofsee.exe 88 PID 1928 wrote to memory of 4348 1928 E12F.tmp 89 PID 4348 wrote to memory of 4008 4348 E1DA.tmp 90 PID 4008 wrote to memory of 1812 4008 E2B5.tmp 91 PID 1812 wrote to memory of 3356 1812 E3A0.tmp 92 PID 3356 wrote to memory of 4200 3356 E584.tmp 93 PID 4200 wrote to memory of 4440 4200 E64F.tmp 94 PID 4440 wrote to memory of 4144 4440 E6EB.tmp 95 PID 4144 wrote to memory of 3564 4144 E7D6.tmp 96 PID 3564 wrote to memory of 1888 3564 E882.tmp 97 PID 1888 wrote to memory of 4976 1888 E91E.tmp 98 PID 4976 wrote to memory of 6044 4976 E9AA.tmp 99 PID 6044 wrote to memory of 1456 6044 EA37.tmp 100 PID 1456 wrote to memory of 2564 1456 EAF3.tmp 101 PID 2564 wrote to memory of 5084 2564 EB60.tmp 102 PID 5084 wrote to memory of 3620 5084 EBED.tmp 103 PID 3620 wrote to memory of 2592 3620 EC5A.tmp 104 PID 2592 wrote to memory of 5396 2592 ECD7.tmp 105 PID 5396 wrote to memory of 4152 5396 ED54.tmp 106 PID 4152 wrote to memory of 2996 4152 EDE1.tmp 107 PID 2996 wrote to memory of 4020 2996 EE9C.tmp 108 PID 4020 wrote to memory of 4476 4020 EF48.tmp 109 PID 4476 wrote to memory of 5876 4476 F013.tmp 110 PID 5876 wrote to memory of 2588 5876 F090.tmp 111 PID 2588 wrote to memory of 1820 2588 F14C.tmp 112 PID 1820 wrote to memory of 1044 1820 F1D8.tmp 113 PID 1044 wrote to memory of 3908 1044 F294.tmp 114 PID 3908 wrote to memory of 3144 3908 F340.tmp 115 PID 3144 wrote to memory of 2000 3144 F3DC.tmp 116 PID 2000 wrote to memory of 2080 2000 F4A7.tmp 117 PID 2080 wrote to memory of 1380 2080 F524.tmp 118 PID 1380 wrote to memory of 3148 1380 F5B1.tmp 119 PID 3148 wrote to memory of 4792 3148 F61E.tmp 120 PID 4792 wrote to memory of 4760 4792 F69B.tmp 121 PID 4760 wrote to memory of 2444 4760 F747.tmp 122 PID 2444 wrote to memory of 5736 2444 F7C4.tmp 123 PID 5736 wrote to memory of 2400 5736 F841.tmp 124 PID 2400 wrote to memory of 3744 2400 F8AE.tmp 125 PID 3744 wrote to memory of 1052 3744 F93B.tmp 126 PID 1052 wrote to memory of 3224 1052 F9B8.tmp 127 PID 3224 wrote to memory of 3344 3224 FA25.tmp 128 PID 3344 wrote to memory of 924 3344 FAA2.tmp 129 PID 924 wrote to memory of 4316 924 FB2F.tmp 130 PID 4316 wrote to memory of 2700 4316 FB8D.tmp 131 PID 2700 wrote to memory of 996 2700 FC0A.tmp 132 PID 996 wrote to memory of 1548 996 FC77.tmp 133 PID 1548 wrote to memory of 1972 1548 FD13.tmp 134 PID 1972 wrote to memory of 1144 1972 FDA0.tmp 135 PID 1144 wrote to memory of 5296 1144 FE2C.tmp 136 PID 5296 wrote to memory of 2876 5296 FEB9.tmp 137 PID 2876 wrote to memory of 5464 2876 FF55.tmp 138 PID 5464 wrote to memory of 3816 5464 FFF2.tmp 139 PID 3816 wrote to memory of 3532 3816 8E.tmp 140 PID 3532 wrote to memory of 4592 3532 10B.tmp 141 PID 4592 wrote to memory of 3992 4592 178.tmp 142 PID 3992 wrote to memory of 3124 3992 1F5.tmp 143 PID 3124 wrote to memory of 4892 3124 282.tmp 144 PID 4892 wrote to memory of 1224 4892 30E.tmp 145 PID 1224 wrote to memory of 2236 1224 37C.tmp 146 PID 2236 wrote to memory of 1112 2236 408.tmp 147 PID 1112 wrote to memory of 1756 1112 476.tmp 148 PID 1756 wrote to memory of 5900 1756 4D4.tmp 149 PID 5900 wrote to memory of 1336 5900 551.tmp 150 PID 1336 wrote to memory of 5040 1336 5DD.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_86ebd4ca5926fdcc29f13cb69bbc903b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_86ebd4ca5926fdcc29f13cb69bbc903b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\E12F.tmp"C:\Users\Admin\AppData\Local\Temp\E12F.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\E584.tmp"C:\Users\Admin\AppData\Local\Temp\E584.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\EA37.tmp"C:\Users\Admin\AppData\Local\Temp\EA37.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\EB60.tmp"C:\Users\Admin\AppData\Local\Temp\EB60.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\EE9C.tmp"C:\Users\Admin\AppData\Local\Temp\EE9C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\F013.tmp"C:\Users\Admin\AppData\Local\Temp\F013.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\F090.tmp"C:\Users\Admin\AppData\Local\Temp\F090.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F294.tmp"C:\Users\Admin\AppData\Local\Temp\F294.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\F340.tmp"C:\Users\Admin\AppData\Local\Temp\F340.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\F61E.tmp"C:\Users\Admin\AppData\Local\Temp\F61E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\F69B.tmp"C:\Users\Admin\AppData\Local\Temp\F69B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\F747.tmp"C:\Users\Admin\AppData\Local\Temp\F747.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\F841.tmp"C:\Users\Admin\AppData\Local\Temp\F841.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\F9B8.tmp"C:\Users\Admin\AppData\Local\Temp\F9B8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\8E.tmp"C:\Users\Admin\AppData\Local\Temp\8E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\282.tmp"C:\Users\Admin\AppData\Local\Temp\282.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\37C.tmp"C:\Users\Admin\AppData\Local\Temp\37C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\476.tmp"C:\Users\Admin\AppData\Local\Temp\476.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\5DD.tmp"C:\Users\Admin\AppData\Local\Temp\5DD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"65⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6F6.tmp"C:\Users\Admin\AppData\Local\Temp\6F6.tmp"66⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"67⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"68⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\8BC.tmp"C:\Users\Admin\AppData\Local\Temp\8BC.tmp"69⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"70⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\9B6.tmp"C:\Users\Admin\AppData\Local\Temp\9B6.tmp"71⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"72⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\ABF.tmp"C:\Users\Admin\AppData\Local\Temp\ABF.tmp"73⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\B3C.tmp"C:\Users\Admin\AppData\Local\Temp\B3C.tmp"74⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"75⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\C27.tmp"C:\Users\Admin\AppData\Local\Temp\C27.tmp"76⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\CA4.tmp"C:\Users\Admin\AppData\Local\Temp\CA4.tmp"77⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"79⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"80⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"81⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"82⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\F92.tmp"C:\Users\Admin\AppData\Local\Temp\F92.tmp"83⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"84⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\107C.tmp"C:\Users\Admin\AppData\Local\Temp\107C.tmp"85⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\1118.tmp"C:\Users\Admin\AppData\Local\Temp\1118.tmp"86⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"87⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"88⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"89⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\132B.tmp"C:\Users\Admin\AppData\Local\Temp\132B.tmp"90⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\1399.tmp"C:\Users\Admin\AppData\Local\Temp\1399.tmp"91⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"92⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\1493.tmp"C:\Users\Admin\AppData\Local\Temp\1493.tmp"93⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"94⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"95⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\1648.tmp"C:\Users\Admin\AppData\Local\Temp\1648.tmp"96⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"97⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\1733.tmp"C:\Users\Admin\AppData\Local\Temp\1733.tmp"98⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\17CF.tmp"C:\Users\Admin\AppData\Local\Temp\17CF.tmp"99⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"100⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\1907.tmp"C:\Users\Admin\AppData\Local\Temp\1907.tmp"101⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"102⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\1A01.tmp"C:\Users\Admin\AppData\Local\Temp\1A01.tmp"103⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\1A8E.tmp"C:\Users\Admin\AppData\Local\Temp\1A8E.tmp"104⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"105⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"106⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"107⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"108⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"109⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"110⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"111⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\1E95.tmp"C:\Users\Admin\AppData\Local\Temp\1E95.tmp"112⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"113⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"114⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\203B.tmp"C:\Users\Admin\AppData\Local\Temp\203B.tmp"115⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\20A9.tmp"C:\Users\Admin\AppData\Local\Temp\20A9.tmp"116⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2135.tmp"C:\Users\Admin\AppData\Local\Temp\2135.tmp"117⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"118⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"119⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"120⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"121⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"122⤵PID:3716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-