Analysis
- max time kernel
88s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_34104d919c2acf76fefb6db650fa7555_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
General
- Target 2026-09-30_34104d919c2acf76fefb6db650fa7555_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260930-pnppfsvt2j
- SHA256 80e392b174a05f76cc37042c1cf302fbcd37036f473b36cb559cd4de5171121c
- MD5 34104d919c2acf76fefb6db650fa7555
- SHA1 44909a411566121c2fd70878c6f3454bffd6cf5e
- SHA512 394806f95c3ce59ae1153d5c4cc220b992bdc6f8f50467885668d958ec4b025adb5a5208e0c911798c20736519cf3656326e3072ae6931737be8ca5cf7becb1a
- SSDEEP 12288:wU5rCOTeiDRSXLg4M76RdzdtUArEBNZ+3/v+I9hUG2VA:wUQOJDRSbg47tsBNGEA
- TLSH T128E4E12177D88536E5FB037859B5F6614E7EBD326722D6CF2B8016AE09B1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral2/memory/4464-7-0x0000000000CD0000-0x0000000000D53000-memory.dmp family_stealc_v3 - Executes dropped EXE 64 IoCs
pid Process 4412 4731.tmp 6064 4888.tmp 3492 4925.tmp 4712 4A5D.tmp 3872 4C13.tmp 5476 4CAF.tmp 4872 4D3C.tmp 3256 4DD8.tmp 2772 4E64.tmp 5112 4EF1.tmp 3120 4F9D.tmp 2924 5039.tmp 2044 5104.tmp 4292 51A1.tmp 3556 525C.tmp 4812 5318.tmp 4564 5395.tmp 3060 5431.tmp 6036 54AE.tmp 4220 555A.tmp 2784 5634.tmp 5324 56C1.tmp 4724 574E.tmp 4268 57EA.tmp 4452 5877.tmp 680 5932.tmp 5768 5A0D.tmp 724 5A99.tmp 2968 5B36.tmp 1724 5BC2.tmp 2296 5C3F.tmp 4940 5CAD.tmp 3140 5D59.tmp 5028 5DF5.tmp 3464 5EDF.tmp 1544 5F7B.tmp 4448 6018.tmp 6028 60A4.tmp 1260 6131.tmp 2060 61AE.tmp 996 625A.tmp 5488 62F6.tmp 5464 6392.tmp 1900 641F.tmp 4608 64CB.tmp 5804 6557.tmp 3440 6623.tmp 3480 66AF.tmp 3980 673C.tmp 5224 67C8.tmp 2824 6855.tmp 1856 68E2.tmp 3352 69AD.tmp 4280 6A39.tmp 2884 6AB6.tmp 5688 6B24.tmp 1816 6BA1.tmp 3408 6C2D.tmp 3716 6CAA.tmp 5844 6D37.tmp 2236 6DB4.tmp 5748 6E41.tmp 1600 6EAE.tmp 4636 6F2B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 673C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A39.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 4412 4464 2026-09-30_34104d919c2acf76fefb6db650fa7555_elex_mafia_stealc_tofsee.exe 89 PID 4412 wrote to memory of 6064 4412 4731.tmp 90 PID 6064 wrote to memory of 3492 6064 4888.tmp 91 PID 3492 wrote to memory of 4712 3492 4925.tmp 92 PID 4712 wrote to memory of 3872 4712 4A5D.tmp 93 PID 3872 wrote to memory of 5476 3872 4C13.tmp 94 PID 5476 wrote to memory of 4872 5476 4CAF.tmp 95 PID 4872 wrote to memory of 3256 4872 4D3C.tmp 96 PID 3256 wrote to memory of 2772 3256 4DD8.tmp 97 PID 2772 wrote to memory of 5112 2772 4E64.tmp 98 PID 5112 wrote to memory of 3120 5112 4EF1.tmp 99 PID 3120 wrote to memory of 2924 3120 4F9D.tmp 100 PID 2924 wrote to memory of 2044 2924 5039.tmp 101 PID 2044 wrote to memory of 4292 2044 5104.tmp 102 PID 4292 wrote to memory of 3556 4292 51A1.tmp 103 PID 3556 wrote to memory of 4812 3556 525C.tmp 104 PID 4812 wrote to memory of 4564 4812 5318.tmp 105 PID 4564 wrote to memory of 3060 4564 5395.tmp 106 PID 3060 wrote to memory of 6036 3060 5431.tmp 107 PID 6036 wrote to memory of 4220 6036 54AE.tmp 108 PID 4220 wrote to memory of 2784 4220 555A.tmp 109 PID 2784 wrote to memory of 5324 2784 5634.tmp 110 PID 5324 wrote to memory of 4724 5324 56C1.tmp 111 PID 4724 wrote to memory of 4268 4724 574E.tmp 112 PID 4268 wrote to memory of 4452 4268 57EA.tmp 113 PID 4452 wrote to memory of 680 4452 5877.tmp 114 PID 680 wrote to memory of 5768 680 5932.tmp 115 PID 5768 wrote to memory of 724 5768 5A0D.tmp 116 PID 724 wrote to memory of 2968 724 5A99.tmp 117 PID 2968 wrote to memory of 1724 2968 5B36.tmp 118 PID 1724 wrote to memory of 2296 1724 5BC2.tmp 119 PID 2296 wrote to memory of 4940 2296 5C3F.tmp 120 PID 4940 wrote to memory of 3140 4940 5CAD.tmp 121 PID 3140 wrote to memory of 5028 3140 5D59.tmp 122 PID 5028 wrote to memory of 3464 5028 5DF5.tmp 123 PID 3464 wrote to memory of 1544 3464 5EDF.tmp 124 PID 1544 wrote to memory of 4448 1544 5F7B.tmp 125 PID 4448 wrote to memory of 6028 4448 6018.tmp 126 PID 6028 wrote to memory of 1260 6028 60A4.tmp 127 PID 1260 wrote to memory of 2060 1260 6131.tmp 128 PID 2060 wrote to memory of 996 2060 61AE.tmp 129 PID 996 wrote to memory of 5488 996 625A.tmp 130 PID 5488 wrote to memory of 5464 5488 62F6.tmp 131 PID 5464 wrote to memory of 1900 5464 6392.tmp 132 PID 1900 wrote to memory of 4608 1900 641F.tmp 133 PID 4608 wrote to memory of 5804 4608 64CB.tmp 134 PID 5804 wrote to memory of 3440 5804 6557.tmp 135 PID 3440 wrote to memory of 3480 3440 6623.tmp 136 PID 3480 wrote to memory of 3980 3480 66AF.tmp 137 PID 3980 wrote to memory of 5224 3980 673C.tmp 138 PID 5224 wrote to memory of 2824 5224 67C8.tmp 139 PID 2824 wrote to memory of 1856 2824 6855.tmp 140 PID 1856 wrote to memory of 3352 1856 68E2.tmp 141 PID 3352 wrote to memory of 4280 3352 69AD.tmp 142 PID 4280 wrote to memory of 2884 4280 6A39.tmp 143 PID 2884 wrote to memory of 5688 2884 6AB6.tmp 144 PID 5688 wrote to memory of 1816 5688 6B24.tmp 145 PID 1816 wrote to memory of 3408 1816 6BA1.tmp 146 PID 3408 wrote to memory of 3716 3408 6C2D.tmp 147 PID 3716 wrote to memory of 5844 3716 6CAA.tmp 148 PID 5844 wrote to memory of 2236 5844 6D37.tmp 149 PID 2236 wrote to memory of 5748 2236 6DB4.tmp 150 PID 5748 wrote to memory of 1600 5748 6E41.tmp 151 PID 1600 wrote to memory of 4636 1600 6EAE.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_34104d919c2acf76fefb6db650fa7555_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_34104d919c2acf76fefb6db650fa7555_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\4925.tmp"C:\Users\Admin\AppData\Local\Temp\4925.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4E64.tmp"C:\Users\Admin\AppData\Local\Temp\4E64.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\5039.tmp"C:\Users\Admin\AppData\Local\Temp\5039.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\5318.tmp"C:\Users\Admin\AppData\Local\Temp\5318.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\5431.tmp"C:\Users\Admin\AppData\Local\Temp\5431.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\54AE.tmp"C:\Users\Admin\AppData\Local\Temp\54AE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\555A.tmp"C:\Users\Admin\AppData\Local\Temp\555A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\56C1.tmp"C:\Users\Admin\AppData\Local\Temp\56C1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\574E.tmp"C:\Users\Admin\AppData\Local\Temp\574E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\57EA.tmp"C:\Users\Admin\AppData\Local\Temp\57EA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5932.tmp"C:\Users\Admin\AppData\Local\Temp\5932.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\5B36.tmp"C:\Users\Admin\AppData\Local\Temp\5B36.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5D59.tmp"C:\Users\Admin\AppData\Local\Temp\5D59.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\6018.tmp"C:\Users\Admin\AppData\Local\Temp\6018.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\6131.tmp"C:\Users\Admin\AppData\Local\Temp\6131.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\61AE.tmp"C:\Users\Admin\AppData\Local\Temp\61AE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\62F6.tmp"C:\Users\Admin\AppData\Local\Temp\62F6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\641F.tmp"C:\Users\Admin\AppData\Local\Temp\641F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\673C.tmp"C:\Users\Admin\AppData\Local\Temp\673C.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\6855.tmp"C:\Users\Admin\AppData\Local\Temp\6855.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\6B24.tmp"C:\Users\Admin\AppData\Local\Temp\6B24.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6E41.tmp"C:\Users\Admin\AppData\Local\Temp\6E41.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"65⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"66⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\7064.tmp"C:\Users\Admin\AppData\Local\Temp\7064.tmp"67⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"68⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"69⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"70⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\7296.tmp"C:\Users\Admin\AppData\Local\Temp\7296.tmp"71⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"72⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"73⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"74⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\74A9.tmp"C:\Users\Admin\AppData\Local\Temp\74A9.tmp"75⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7536.tmp"C:\Users\Admin\AppData\Local\Temp\7536.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\75B3.tmp"C:\Users\Admin\AppData\Local\Temp\75B3.tmp"77⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\7630.tmp"C:\Users\Admin\AppData\Local\Temp\7630.tmp"78⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"79⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\772A.tmp"C:\Users\Admin\AppData\Local\Temp\772A.tmp"80⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\77B7.tmp"C:\Users\Admin\AppData\Local\Temp\77B7.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\78B1.tmp"C:\Users\Admin\AppData\Local\Temp\78B1.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"84⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\79CA.tmp"C:\Users\Admin\AppData\Local\Temp\79CA.tmp"85⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"86⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"87⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"89⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"90⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"91⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"92⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\7E00.tmp"C:\Users\Admin\AppData\Local\Temp\7E00.tmp"93⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"94⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"95⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"96⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"98⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"99⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"100⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\81B9.tmp"C:\Users\Admin\AppData\Local\Temp\81B9.tmp"101⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"102⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"103⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"104⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\838E.tmp"C:\Users\Admin\AppData\Local\Temp\838E.tmp"105⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\840B.tmp"C:\Users\Admin\AppData\Local\Temp\840B.tmp"106⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"107⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8514.tmp"C:\Users\Admin\AppData\Local\Temp\8514.tmp"108⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"109⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\862E.tmp"C:\Users\Admin\AppData\Local\Temp\862E.tmp"110⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"111⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"112⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"114⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"115⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"117⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"118⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"119⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"120⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"121⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-