Analysis
- max time kernel
82s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_98f3a0db9b8872ef7ebdb62707071dd4_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 2026-09-08_98f3a0db9b8872ef7ebdb62707071dd4_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260910-ehjadayxfv
- SHA256 5c07a5b0ef54688b5e8a924a63f4cd0591f3c86d1fce95f29a4b5f7523224374
- MD5 98f3a0db9b8872ef7ebdb62707071dd4
- SHA1 ca69a30f09f63590e9484b3ccb472e82602f642e
- SHA512 d217c35baadc4db366d991f8a9406c44ed49020c84d445b2334333674abfc2baa16788458daf835114bb17878367964b63d23ae72135a851e16143448cad2d86
- SSDEEP 12288:wU5rCOTeiDurQp7hTr6szL55oeXX8DNZ+3/v+I9hUG2VA:wUQOJDucBBr6szl5/XXWNGEA
- TLSH T14FE4D02073D88532E5F7077859B5E6554EBEBD22A722D6DF2F8016BE09B1BC08A71313
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/3412-5-0x0000000000BB0000-0x0000000000C33000-memory.dmp family_stealc_v3 - Executes dropped EXE 64 IoCs
pid Process 3888 46ED.tmp 2696 4816.tmp 4228 48B3.tmp 5424 49BC.tmp 4888 4A2A.tmp 752 4AC6.tmp 5984 4B62.tmp 5952 4BDF.tmp 4176 4C7B.tmp 1636 4D27.tmp 692 4DB4.tmp 472 4E21.tmp 5884 4E9E.tmp 932 4F0C.tmp 4132 4F89.tmp 1592 4FF6.tmp 4040 5092.tmp 5776 511F.tmp 1364 517D.tmp 1300 5209.tmp 5828 5277.tmp 5020 52D4.tmp 1484 5351.tmp 1652 53BF.tmp 4552 543C.tmp 3208 54C8.tmp 5816 5555.tmp 1460 55C2.tmp 5628 563F.tmp 4180 56EB.tmp 2060 5749.tmp 1720 57D6.tmp 5576 5862.tmp 1268 58D0.tmp 980 593D.tmp 1436 59CA.tmp 2772 5A47.tmp 2924 5AB4.tmp 1104 5B21.tmp 620 5B9E.tmp 2896 5BFC.tmp 256 5C5A.tmp 4336 5CC7.tmp 3136 5D35.tmp 5592 5DA2.tmp 4696 5E0F.tmp 5820 5E7D.tmp 5320 5EEA.tmp 1280 5F57.tmp 8 5FC5.tmp 3440 6032.tmp 3416 60AF.tmp 5796 611D.tmp 2884 617A.tmp 5940 61E8.tmp 5844 6245.tmp 1392 62B3.tmp 480 6320.tmp 4672 638E.tmp 3276 63EB.tmp 2500 6459.tmp 2920 64C6.tmp 2324 6543.tmp 4868 65B0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 617A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 660E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 686B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F07C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 517D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 754C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6780.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA2.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 3888 3412 2026-09-08_98f3a0db9b8872ef7ebdb62707071dd4_elex_mafia_stealc_tofsee.exe 90 PID 3888 wrote to memory of 2696 3888 46ED.tmp 91 PID 2696 wrote to memory of 4228 2696 4816.tmp 92 PID 4228 wrote to memory of 5424 4228 48B3.tmp 93 PID 5424 wrote to memory of 4888 5424 49BC.tmp 94 PID 4888 wrote to memory of 752 4888 4A2A.tmp 95 PID 752 wrote to memory of 5984 752 4AC6.tmp 96 PID 5984 wrote to memory of 5952 5984 4B62.tmp 97 PID 5952 wrote to memory of 4176 5952 4BDF.tmp 98 PID 4176 wrote to memory of 1636 4176 4C7B.tmp 99 PID 1636 wrote to memory of 692 1636 4D27.tmp 100 PID 692 wrote to memory of 472 692 4DB4.tmp 101 PID 472 wrote to memory of 5884 472 4E21.tmp 102 PID 5884 wrote to memory of 932 5884 4E9E.tmp 103 PID 932 wrote to memory of 4132 932 4F0C.tmp 104 PID 4132 wrote to memory of 1592 4132 4F89.tmp 105 PID 1592 wrote to memory of 4040 1592 4FF6.tmp 106 PID 4040 wrote to memory of 5776 4040 5092.tmp 107 PID 5776 wrote to memory of 1364 5776 511F.tmp 108 PID 1364 wrote to memory of 1300 1364 517D.tmp 109 PID 1300 wrote to memory of 5828 1300 5209.tmp 110 PID 5828 wrote to memory of 5020 5828 5277.tmp 111 PID 5020 wrote to memory of 1484 5020 52D4.tmp 112 PID 1484 wrote to memory of 1652 1484 5351.tmp 113 PID 1652 wrote to memory of 4552 1652 53BF.tmp 114 PID 4552 wrote to memory of 3208 4552 543C.tmp 115 PID 3208 wrote to memory of 5816 3208 54C8.tmp 116 PID 5816 wrote to memory of 1460 5816 5555.tmp 117 PID 1460 wrote to memory of 5628 1460 55C2.tmp 118 PID 5628 wrote to memory of 4180 5628 563F.tmp 119 PID 4180 wrote to memory of 2060 4180 56EB.tmp 120 PID 2060 wrote to memory of 1720 2060 5749.tmp 121 PID 1720 wrote to memory of 5576 1720 57D6.tmp 122 PID 5576 wrote to memory of 1268 5576 5862.tmp 123 PID 1268 wrote to memory of 980 1268 58D0.tmp 124 PID 980 wrote to memory of 1436 980 593D.tmp 125 PID 1436 wrote to memory of 2772 1436 59CA.tmp 126 PID 2772 wrote to memory of 2924 2772 5A47.tmp 127 PID 2924 wrote to memory of 1104 2924 5AB4.tmp 128 PID 1104 wrote to memory of 620 1104 5B21.tmp 129 PID 620 wrote to memory of 2896 620 5B9E.tmp 130 PID 2896 wrote to memory of 256 2896 5BFC.tmp 131 PID 256 wrote to memory of 4336 256 5C5A.tmp 132 PID 4336 wrote to memory of 3136 4336 5CC7.tmp 133 PID 3136 wrote to memory of 5592 3136 5D35.tmp 134 PID 5592 wrote to memory of 4696 5592 5DA2.tmp 135 PID 4696 wrote to memory of 5820 4696 5E0F.tmp 136 PID 5820 wrote to memory of 5320 5820 5E7D.tmp 137 PID 5320 wrote to memory of 1280 5320 5EEA.tmp 138 PID 1280 wrote to memory of 8 1280 5F57.tmp 139 PID 8 wrote to memory of 3440 8 5FC5.tmp 140 PID 3440 wrote to memory of 3416 3440 6032.tmp 141 PID 3416 wrote to memory of 5796 3416 60AF.tmp 142 PID 5796 wrote to memory of 2884 5796 611D.tmp 143 PID 2884 wrote to memory of 5940 2884 617A.tmp 144 PID 5940 wrote to memory of 5844 5940 61E8.tmp 145 PID 5844 wrote to memory of 1392 5844 6245.tmp 146 PID 1392 wrote to memory of 480 1392 62B3.tmp 147 PID 480 wrote to memory of 4672 480 6320.tmp 148 PID 4672 wrote to memory of 3276 4672 638E.tmp 149 PID 3276 wrote to memory of 2500 3276 63EB.tmp 150 PID 2500 wrote to memory of 2920 2500 6459.tmp 151 PID 2920 wrote to memory of 2324 2920 64C6.tmp 152 PID 2324 wrote to memory of 4868 2324 6543.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_98f3a0db9b8872ef7ebdb62707071dd4_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_98f3a0db9b8872ef7ebdb62707071dd4_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\46ED.tmp"C:\Users\Admin\AppData\Local\Temp\46ED.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\4816.tmp"C:\Users\Admin\AppData\Local\Temp\4816.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\48B3.tmp"C:\Users\Admin\AppData\Local\Temp\48B3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\49BC.tmp"C:\Users\Admin\AppData\Local\Temp\49BC.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\4D27.tmp"C:\Users\Admin\AppData\Local\Temp\4D27.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\4E21.tmp"C:\Users\Admin\AppData\Local\Temp\4E21.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\4E9E.tmp"C:\Users\Admin\AppData\Local\Temp\4E9E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4F89.tmp"C:\Users\Admin\AppData\Local\Temp\4F89.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5092.tmp"C:\Users\Admin\AppData\Local\Temp\5092.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\511F.tmp"C:\Users\Admin\AppData\Local\Temp\511F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\517D.tmp"C:\Users\Admin\AppData\Local\Temp\517D.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\5209.tmp"C:\Users\Admin\AppData\Local\Temp\5209.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\5277.tmp"C:\Users\Admin\AppData\Local\Temp\5277.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\52D4.tmp"C:\Users\Admin\AppData\Local\Temp\52D4.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5351.tmp"C:\Users\Admin\AppData\Local\Temp\5351.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\53BF.tmp"C:\Users\Admin\AppData\Local\Temp\53BF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\543C.tmp"C:\Users\Admin\AppData\Local\Temp\543C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\54C8.tmp"C:\Users\Admin\AppData\Local\Temp\54C8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5555.tmp"C:\Users\Admin\AppData\Local\Temp\5555.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\563F.tmp"C:\Users\Admin\AppData\Local\Temp\563F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\56EB.tmp"C:\Users\Admin\AppData\Local\Temp\56EB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\5749.tmp"C:\Users\Admin\AppData\Local\Temp\5749.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\57D6.tmp"C:\Users\Admin\AppData\Local\Temp\57D6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5862.tmp"C:\Users\Admin\AppData\Local\Temp\5862.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\58D0.tmp"C:\Users\Admin\AppData\Local\Temp\58D0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\593D.tmp"C:\Users\Admin\AppData\Local\Temp\593D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\59CA.tmp"C:\Users\Admin\AppData\Local\Temp\59CA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5A47.tmp"C:\Users\Admin\AppData\Local\Temp\5A47.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\5B21.tmp"C:\Users\Admin\AppData\Local\Temp\5B21.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\5BFC.tmp"C:\Users\Admin\AppData\Local\Temp\5BFC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\5D35.tmp"C:\Users\Admin\AppData\Local\Temp\5D35.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\5F57.tmp"C:\Users\Admin\AppData\Local\Temp\5F57.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6032.tmp"C:\Users\Admin\AppData\Local\Temp\6032.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\60AF.tmp"C:\Users\Admin\AppData\Local\Temp\60AF.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\617A.tmp"C:\Users\Admin\AppData\Local\Temp\617A.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\61E8.tmp"C:\Users\Admin\AppData\Local\Temp\61E8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\6245.tmp"C:\Users\Admin\AppData\Local\Temp\6245.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\62B3.tmp"C:\Users\Admin\AppData\Local\Temp\62B3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\6320.tmp"C:\Users\Admin\AppData\Local\Temp\6320.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\638E.tmp"C:\Users\Admin\AppData\Local\Temp\638E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\63EB.tmp"C:\Users\Admin\AppData\Local\Temp\63EB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6459.tmp"C:\Users\Admin\AppData\Local\Temp\6459.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\64C6.tmp"C:\Users\Admin\AppData\Local\Temp\64C6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6543.tmp"C:\Users\Admin\AppData\Local\Temp\6543.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\65B0.tmp"C:\Users\Admin\AppData\Local\Temp\65B0.tmp"65⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\660E.tmp"C:\Users\Admin\AppData\Local\Temp\660E.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\668B.tmp"C:\Users\Admin\AppData\Local\Temp\668B.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\66E9.tmp"C:\Users\Admin\AppData\Local\Temp\66E9.tmp"68⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6756.tmp"C:\Users\Admin\AppData\Local\Temp\6756.tmp"69⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\67C4.tmp"C:\Users\Admin\AppData\Local\Temp\67C4.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"71⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\688F.tmp"C:\Users\Admin\AppData\Local\Temp\688F.tmp"72⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\692B.tmp"C:\Users\Admin\AppData\Local\Temp\692B.tmp"73⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\69B8.tmp"C:\Users\Admin\AppData\Local\Temp\69B8.tmp"74⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6A15.tmp"C:\Users\Admin\AppData\Local\Temp\6A15.tmp"75⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\6A83.tmp"C:\Users\Admin\AppData\Local\Temp\6A83.tmp"76⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"77⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\6B6D.tmp"C:\Users\Admin\AppData\Local\Temp\6B6D.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\6BCB.tmp"C:\Users\Admin\AppData\Local\Temp\6BCB.tmp"79⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6C38.tmp"C:\Users\Admin\AppData\Local\Temp\6C38.tmp"80⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"81⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\6D03.tmp"C:\Users\Admin\AppData\Local\Temp\6D03.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\6D71.tmp"C:\Users\Admin\AppData\Local\Temp\6D71.tmp"83⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"84⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"85⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\6F46.tmp"C:\Users\Admin\AppData\Local\Temp\6F46.tmp"87⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"88⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\7030.tmp"C:\Users\Admin\AppData\Local\Temp\7030.tmp"89⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\709D.tmp"C:\Users\Admin\AppData\Local\Temp\709D.tmp"90⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"91⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"92⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"93⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"94⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"95⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\732E.tmp"C:\Users\Admin\AppData\Local\Temp\732E.tmp"96⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"97⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\73F9.tmp"C:\Users\Admin\AppData\Local\Temp\73F9.tmp"98⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\7466.tmp"C:\Users\Admin\AppData\Local\Temp\7466.tmp"99⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\74D3.tmp"C:\Users\Admin\AppData\Local\Temp\74D3.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\7541.tmp"C:\Users\Admin\AppData\Local\Temp\7541.tmp"101⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\759F.tmp"C:\Users\Admin\AppData\Local\Temp\759F.tmp"102⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\761C.tmp"C:\Users\Admin\AppData\Local\Temp\761C.tmp"103⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\7689.tmp"C:\Users\Admin\AppData\Local\Temp\7689.tmp"104⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\76E7.tmp"C:\Users\Admin\AppData\Local\Temp\76E7.tmp"105⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\7754.tmp"C:\Users\Admin\AppData\Local\Temp\7754.tmp"106⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\77C1.tmp"C:\Users\Admin\AppData\Local\Temp\77C1.tmp"107⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\781F.tmp"C:\Users\Admin\AppData\Local\Temp\781F.tmp"108⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\788D.tmp"C:\Users\Admin\AppData\Local\Temp\788D.tmp"109⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\78EA.tmp"C:\Users\Admin\AppData\Local\Temp\78EA.tmp"110⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7958.tmp"C:\Users\Admin\AppData\Local\Temp\7958.tmp"111⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\79C5.tmp"C:\Users\Admin\AppData\Local\Temp\79C5.tmp"112⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\7A32.tmp"C:\Users\Admin\AppData\Local\Temp\7A32.tmp"113⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"114⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"115⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"116⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7C07.tmp"C:\Users\Admin\AppData\Local\Temp\7C07.tmp"117⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\7C75.tmp"C:\Users\Admin\AppData\Local\Temp\7C75.tmp"118⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"120⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"121⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"122⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-