Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 06:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_210e3484d7b58375ae8d2eb8a23bb962_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_210e3484d7b58375ae8d2eb8a23bb962_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_210e3484d7b58375ae8d2eb8a23bb962_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260819-g1fcjseq8y
- SHA256 3cb4ae89074f58272eafefbe3e778ae55abbda2fc4a7752c75883389f3cdf5d3
- MD5 210e3484d7b58375ae8d2eb8a23bb962
- SHA1 e84709c2b17b03db42eb09089ed3b2131aa61b12
- SHA512 f444a1ca9eb92dfc9f305e938c58ef5397effb9ed84d05c8f95e4b7cd0e5ae10a400f1736da3f561a823a13ea20b14a7c238ed37bac4a64b599c94a22fcb7eef
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLDgSRau4suEUxak4EhiBgjuHaBZGePKMy7sHS:NU5rCOTeijsCagJUxvDsb6RaATZwlH
- TLSH T106B4F126B585C132F5D202714BE6DBA12A3ABC74572294C33BC4A33E6FB56E1D379306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 624 A9A4.tmp 5728 AA5F.tmp 4712 AB88.tmp 3860 AD5D.tmp 824 AE18.tmp 4520 AF03.tmp 4352 AFDE.tmp 3468 B0F7.tmp 5572 B1C2.tmp 5472 B27D.tmp 5644 B358.tmp 4860 B433.tmp 2452 B51D.tmp 4304 B5D9.tmp 2096 B6B4.tmp 2496 B7AE.tmp 6084 B888.tmp 4112 B9A2.tmp 4072 BA7C.tmp 3252 BB38.tmp 2356 BBF3.tmp 1740 BCCE.tmp 5684 BDC8.tmp 5864 BE55.tmp 2804 BEF1.tmp 900 BFBC.tmp 5388 C0C6.tmp 3708 C1A0.tmp 464 C23D.tmp 2192 C2F8.tmp 5840 C3F2.tmp 2340 C4EC.tmp 2708 C598.tmp 5604 C634.tmp 4960 C6B1.tmp 2952 C76D.tmp 4808 C819.tmp 3528 C8B5.tmp 4944 C942.tmp 3660 C9ED.tmp 6060 CA7A.tmp 4460 CB07.tmp 4320 CB93.tmp 2608 CC30.tmp 2128 CCAD.tmp 4316 CD49.tmp 5088 CDD5.tmp 4700 CE81.tmp 1264 CF2D.tmp 1384 CFC9.tmp 1172 D046.tmp 1776 D0C3.tmp 4704 D160.tmp 2784 D1DD.tmp 5804 D269.tmp 2540 D315.tmp 2092 D392.tmp 2704 D41F.tmp 5292 D4BB.tmp 5100 D557.tmp 3228 D5F4.tmp 3308 D690.tmp 4348 D70D.tmp 4840 D7B9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 581F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 721F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 471C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E07E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 368D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 109B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22C7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 624 3952 2026-08-19_210e3484d7b58375ae8d2eb8a23bb962_elex_mafia_stealc_tofsee.exe 88 PID 624 wrote to memory of 5728 624 A9A4.tmp 89 PID 5728 wrote to memory of 4712 5728 AA5F.tmp 90 PID 4712 wrote to memory of 3860 4712 AB88.tmp 91 PID 3860 wrote to memory of 824 3860 AD5D.tmp 92 PID 824 wrote to memory of 4520 824 AE18.tmp 93 PID 4520 wrote to memory of 4352 4520 AF03.tmp 94 PID 4352 wrote to memory of 3468 4352 AFDE.tmp 95 PID 3468 wrote to memory of 5572 3468 B0F7.tmp 96 PID 5572 wrote to memory of 5472 5572 B1C2.tmp 97 PID 5472 wrote to memory of 5644 5472 B27D.tmp 98 PID 5644 wrote to memory of 4860 5644 B358.tmp 99 PID 4860 wrote to memory of 2452 4860 B433.tmp 100 PID 2452 wrote to memory of 4304 2452 B51D.tmp 101 PID 4304 wrote to memory of 2096 4304 B5D9.tmp 102 PID 2096 wrote to memory of 2496 2096 B6B4.tmp 103 PID 2496 wrote to memory of 6084 2496 B7AE.tmp 104 PID 6084 wrote to memory of 4112 6084 B888.tmp 105 PID 4112 wrote to memory of 4072 4112 B9A2.tmp 106 PID 4072 wrote to memory of 3252 4072 BA7C.tmp 107 PID 3252 wrote to memory of 2356 3252 BB38.tmp 108 PID 2356 wrote to memory of 1740 2356 BBF3.tmp 109 PID 1740 wrote to memory of 5684 1740 BCCE.tmp 110 PID 5684 wrote to memory of 5864 5684 BDC8.tmp 111 PID 5864 wrote to memory of 2804 5864 BE55.tmp 112 PID 2804 wrote to memory of 900 2804 BEF1.tmp 113 PID 900 wrote to memory of 5388 900 BFBC.tmp 114 PID 5388 wrote to memory of 3708 5388 C0C6.tmp 115 PID 3708 wrote to memory of 464 3708 C1A0.tmp 116 PID 464 wrote to memory of 2192 464 C23D.tmp 117 PID 2192 wrote to memory of 5840 2192 C2F8.tmp 118 PID 5840 wrote to memory of 2340 5840 C3F2.tmp 119 PID 2340 wrote to memory of 2708 2340 C4EC.tmp 120 PID 2708 wrote to memory of 5604 2708 C598.tmp 121 PID 5604 wrote to memory of 4960 5604 C634.tmp 122 PID 4960 wrote to memory of 2952 4960 C6B1.tmp 123 PID 2952 wrote to memory of 4808 2952 C76D.tmp 124 PID 4808 wrote to memory of 3528 4808 C819.tmp 125 PID 3528 wrote to memory of 4944 3528 C8B5.tmp 126 PID 4944 wrote to memory of 3660 4944 C942.tmp 127 PID 3660 wrote to memory of 6060 3660 C9ED.tmp 128 PID 6060 wrote to memory of 4460 6060 CA7A.tmp 129 PID 4460 wrote to memory of 4320 4460 CB07.tmp 130 PID 4320 wrote to memory of 2608 4320 CB93.tmp 131 PID 2608 wrote to memory of 2128 2608 CC30.tmp 132 PID 2128 wrote to memory of 4316 2128 CCAD.tmp 133 PID 4316 wrote to memory of 5088 4316 CD49.tmp 134 PID 5088 wrote to memory of 4700 5088 CDD5.tmp 135 PID 4700 wrote to memory of 1264 4700 CE81.tmp 136 PID 1264 wrote to memory of 1384 1264 CF2D.tmp 137 PID 1384 wrote to memory of 1172 1384 CFC9.tmp 138 PID 1172 wrote to memory of 1776 1172 D046.tmp 139 PID 1776 wrote to memory of 4704 1776 D0C3.tmp 140 PID 4704 wrote to memory of 2784 4704 D160.tmp 141 PID 2784 wrote to memory of 5804 2784 D1DD.tmp 142 PID 5804 wrote to memory of 2540 5804 D269.tmp 143 PID 2540 wrote to memory of 2092 2540 D315.tmp 144 PID 2092 wrote to memory of 2704 2092 D392.tmp 145 PID 2704 wrote to memory of 5292 2704 D41F.tmp 146 PID 5292 wrote to memory of 5100 5292 D4BB.tmp 147 PID 5100 wrote to memory of 3228 5100 D557.tmp 148 PID 3228 wrote to memory of 3308 3228 D5F4.tmp 149 PID 3308 wrote to memory of 4348 3308 D690.tmp 150 PID 4348 wrote to memory of 4840 4348 D70D.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_210e3484d7b58375ae8d2eb8a23bb962_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_210e3484d7b58375ae8d2eb8a23bb962_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\AB88.tmp"C:\Users\Admin\AppData\Local\Temp\AB88.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\AE18.tmp"C:\Users\Admin\AppData\Local\Temp\AE18.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\B433.tmp"C:\Users\Admin\AppData\Local\Temp\B433.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\B888.tmp"C:\Users\Admin\AppData\Local\Temp\B888.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\BB38.tmp"C:\Users\Admin\AppData\Local\Temp\BB38.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\C598.tmp"C:\Users\Admin\AppData\Local\Temp\C598.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\C634.tmp"C:\Users\Admin\AppData\Local\Temp\C634.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\C819.tmp"C:\Users\Admin\AppData\Local\Temp\C819.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\C942.tmp"C:\Users\Admin\AppData\Local\Temp\C942.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\CE81.tmp"C:\Users\Admin\AppData\Local\Temp\CE81.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\D160.tmp"C:\Users\Admin\AppData\Local\Temp\D160.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\D315.tmp"C:\Users\Admin\AppData\Local\Temp\D315.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\D392.tmp"C:\Users\Admin\AppData\Local\Temp\D392.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\D557.tmp"C:\Users\Admin\AppData\Local\Temp\D557.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"65⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"66⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"67⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"68⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"69⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"70⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\DB81.tmp"C:\Users\Admin\AppData\Local\Temp\DB81.tmp"71⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"72⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"73⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"74⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"75⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\DE12.tmp"C:\Users\Admin\AppData\Local\Temp\DE12.tmp"76⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"77⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"78⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"79⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\E073.tmp"C:\Users\Admin\AppData\Local\Temp\E073.tmp"80⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"81⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"82⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"83⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\E286.tmp"C:\Users\Admin\AppData\Local\Temp\E286.tmp"84⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"85⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"86⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"87⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"88⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"89⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"90⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"92⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"93⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\E814.tmp"C:\Users\Admin\AppData\Local\Temp\E814.tmp"94⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"95⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"97⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"98⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"100⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"101⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"103⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"104⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"105⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"106⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"107⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"108⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"109⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"110⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"111⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"112⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"113⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\F41A.tmp"C:\Users\Admin\AppData\Local\Temp\F41A.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"115⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"116⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"117⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\F67C.tmp"C:\Users\Admin\AppData\Local\Temp\F67C.tmp"118⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"119⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"120⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\F841.tmp"C:\Users\Admin\AppData\Local\Temp\F841.tmp"121⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"122⤵PID:4124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-