Analysis
- max time kernel
116s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_1aa07ddc75a5d4488014b35c362863ca_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_1aa07ddc75a5d4488014b35c362863ca_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_1aa07ddc75a5d4488014b35c362863ca_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260930-qtgfpsgd83
- SHA256 2fc49e842969b6f433b305b1ac157c43bc35e11b444b62928d75a835aa88ee27
- MD5 1aa07ddc75a5d4488014b35c362863ca
- SHA1 e53de945b40dfc7eeab9a65367164109c9de698d
- SHA512 67bdd2deadb3949cb6dc6c8da8770e8d08cc71c45f3cb550a48cca60a4b0ec23b33064a4af857eb8cb669be4a90903b43faa41e4ecb64f91ede3d0f765ed225f
- SSDEEP 12288:9U5rCOTei6DI/Lkafo1NIWNzVjgTH/qZoXWjdq:9UQOJ6D8M70r/qqGh
- TLSH T1C3C4F1257585C433EA9202318ED2EBB1697ABC314726A4C77B80776E6FB52E1D378307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3288 A687.tmp 2104 A762.tmp 1644 A88B.tmp 468 A9F2.tmp 6104 AAEC.tmp 5324 AB98.tmp 4080 AC63.tmp 6128 AD0F.tmp 2720 AD9B.tmp 2308 AE57.tmp 5296 AF22.tmp 1320 AFDE.tmp 3664 B05B.tmp 2280 B145.tmp 3660 B220.tmp 2292 B2FA.tmp 980 B3E5.tmp 772 B4FE.tmp 2652 B57B.tmp 5460 B617.tmp 5316 B721.tmp 2116 B81B.tmp 2072 B8E6.tmp 1984 B9B1.tmp 3108 BA8C.tmp 868 BB76.tmp 4736 BC13.tmp 4516 BCFD.tmp 2896 BDC8.tmp 4192 BE55.tmp 4480 BEF1.tmp 1204 BF9D.tmp 4844 C097.tmp 3872 C114.tmp 6068 C1DF.tmp 2704 C28B.tmp 3948 C337.tmp 4184 C3C3.tmp 6120 C47F.tmp 1916 C51B.tmp 3744 C5C7.tmp 4768 C673.tmp 1408 C71F.tmp 6084 C7CB.tmp 5604 C857.tmp 3076 C8F3.tmp 3576 C9ED.tmp 2956 CA8A.tmp 4156 CB07.tmp 5000 CBB3.tmp 4128 CC4F.tmp 5900 CCCC.tmp 2288 CD78.tmp 1848 CE14.tmp 552 CEA1.tmp 5288 CF4C.tmp 3516 CFC9.tmp 4312 D066.tmp 4296 D112.tmp 5732 D19E.tmp 4600 D23A.tmp 4632 D2B7.tmp 4232 D363.tmp 5692 D41F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F28F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 469F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5698.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 394C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6156.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 544B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 561B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E291.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 3288 3412 2026-09-30_1aa07ddc75a5d4488014b35c362863ca_elex_mafia_stealc_tofsee.exe 88 PID 3288 wrote to memory of 2104 3288 A687.tmp 89 PID 2104 wrote to memory of 1644 2104 A762.tmp 90 PID 1644 wrote to memory of 468 1644 A88B.tmp 91 PID 468 wrote to memory of 6104 468 A9F2.tmp 92 PID 6104 wrote to memory of 5324 6104 AAEC.tmp 93 PID 5324 wrote to memory of 4080 5324 AB98.tmp 94 PID 4080 wrote to memory of 6128 4080 AC63.tmp 95 PID 6128 wrote to memory of 2720 6128 AD0F.tmp 96 PID 2720 wrote to memory of 2308 2720 AD9B.tmp 97 PID 2308 wrote to memory of 5296 2308 AE57.tmp 98 PID 5296 wrote to memory of 1320 5296 AF22.tmp 99 PID 1320 wrote to memory of 3664 1320 AFDE.tmp 100 PID 3664 wrote to memory of 2280 3664 B05B.tmp 101 PID 2280 wrote to memory of 3660 2280 B145.tmp 102 PID 3660 wrote to memory of 2292 3660 B220.tmp 103 PID 2292 wrote to memory of 980 2292 B2FA.tmp 104 PID 980 wrote to memory of 772 980 B3E5.tmp 105 PID 772 wrote to memory of 2652 772 B4FE.tmp 106 PID 2652 wrote to memory of 5460 2652 B57B.tmp 107 PID 5460 wrote to memory of 5316 5460 B617.tmp 108 PID 5316 wrote to memory of 2116 5316 B721.tmp 109 PID 2116 wrote to memory of 2072 2116 B81B.tmp 110 PID 2072 wrote to memory of 1984 2072 B8E6.tmp 111 PID 1984 wrote to memory of 3108 1984 B9B1.tmp 112 PID 3108 wrote to memory of 868 3108 BA8C.tmp 113 PID 868 wrote to memory of 4736 868 BB76.tmp 114 PID 4736 wrote to memory of 4516 4736 BC13.tmp 115 PID 4516 wrote to memory of 2896 4516 BCFD.tmp 116 PID 2896 wrote to memory of 4192 2896 BDC8.tmp 117 PID 4192 wrote to memory of 4480 4192 BE55.tmp 118 PID 4480 wrote to memory of 1204 4480 BEF1.tmp 119 PID 1204 wrote to memory of 4844 1204 BF9D.tmp 120 PID 4844 wrote to memory of 3872 4844 C097.tmp 121 PID 3872 wrote to memory of 6068 3872 C114.tmp 122 PID 6068 wrote to memory of 2704 6068 C1DF.tmp 123 PID 2704 wrote to memory of 3948 2704 C28B.tmp 124 PID 3948 wrote to memory of 4184 3948 C337.tmp 125 PID 4184 wrote to memory of 6120 4184 C3C3.tmp 126 PID 6120 wrote to memory of 1916 6120 C47F.tmp 127 PID 1916 wrote to memory of 3744 1916 C51B.tmp 128 PID 3744 wrote to memory of 4768 3744 C5C7.tmp 129 PID 4768 wrote to memory of 1408 4768 C673.tmp 130 PID 1408 wrote to memory of 6084 1408 C71F.tmp 131 PID 6084 wrote to memory of 5604 6084 C7CB.tmp 132 PID 5604 wrote to memory of 3076 5604 C857.tmp 133 PID 3076 wrote to memory of 3576 3076 C8F3.tmp 134 PID 3576 wrote to memory of 2956 3576 C9ED.tmp 135 PID 2956 wrote to memory of 4156 2956 CA8A.tmp 136 PID 4156 wrote to memory of 5000 4156 CB07.tmp 137 PID 5000 wrote to memory of 4128 5000 CBB3.tmp 138 PID 4128 wrote to memory of 5900 4128 CC4F.tmp 139 PID 5900 wrote to memory of 2288 5900 CCCC.tmp 140 PID 2288 wrote to memory of 1848 2288 CD78.tmp 141 PID 1848 wrote to memory of 552 1848 CE14.tmp 142 PID 552 wrote to memory of 5288 552 CEA1.tmp 143 PID 5288 wrote to memory of 3516 5288 CF4C.tmp 144 PID 3516 wrote to memory of 4312 3516 CFC9.tmp 145 PID 4312 wrote to memory of 4296 4312 D066.tmp 146 PID 4296 wrote to memory of 5732 4296 D112.tmp 147 PID 5732 wrote to memory of 4600 5732 D19E.tmp 148 PID 4600 wrote to memory of 4632 4600 D23A.tmp 149 PID 4632 wrote to memory of 4232 4632 D2B7.tmp 150 PID 4232 wrote to memory of 5692 4232 D363.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_1aa07ddc75a5d4488014b35c362863ca_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_1aa07ddc75a5d4488014b35c362863ca_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\A687.tmp"C:\Users\Admin\AppData\Local\Temp\A687.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\A9F2.tmp"C:\Users\Admin\AppData\Local\Temp\A9F2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\AB98.tmp"C:\Users\Admin\AppData\Local\Temp\AB98.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\AC63.tmp"C:\Users\Admin\AppData\Local\Temp\AC63.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\AE57.tmp"C:\Users\Admin\AppData\Local\Temp\AE57.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\B57B.tmp"C:\Users\Admin\AppData\Local\Temp\B57B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\B721.tmp"C:\Users\Admin\AppData\Local\Temp\B721.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\B81B.tmp"C:\Users\Admin\AppData\Local\Temp\B81B.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\BC13.tmp"C:\Users\Admin\AppData\Local\Temp\BC13.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\C114.tmp"C:\Users\Admin\AppData\Local\Temp\C114.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\C28B.tmp"C:\Users\Admin\AppData\Local\Temp\C28B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C337.tmp"C:\Users\Admin\AppData\Local\Temp\C337.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\C47F.tmp"C:\Users\Admin\AppData\Local\Temp\C47F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\C71F.tmp"C:\Users\Admin\AppData\Local\Temp\C71F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"C:\Users\Admin\AppData\Local\Temp\C7CB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\D112.tmp"C:\Users\Admin\AppData\Local\Temp\D112.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\D19E.tmp"C:\Users\Admin\AppData\Local\Temp\D19E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\D23A.tmp"C:\Users\Admin\AppData\Local\Temp\D23A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"65⤵
- Executes dropped EXE
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"66⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\D557.tmp"C:\Users\Admin\AppData\Local\Temp\D557.tmp"67⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"69⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\D71C.tmp"C:\Users\Admin\AppData\Local\Temp\D71C.tmp"70⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"71⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"72⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"73⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"74⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"75⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"76⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"77⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"78⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"79⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"80⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"81⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"82⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"83⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\E073.tmp"C:\Users\Admin\AppData\Local\Temp\E073.tmp"84⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"85⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"86⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\E238.tmp"C:\Users\Admin\AppData\Local\Temp\E238.tmp"87⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"88⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"89⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"90⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"91⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"92⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"C:\Users\Admin\AppData\Local\Temp\E5F1.tmp"93⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"94⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"95⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"96⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"97⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"98⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"99⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"100⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"102⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"103⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\ECB8.tmp"C:\Users\Admin\AppData\Local\Temp\ECB8.tmp"104⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"105⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"106⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"107⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"108⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"109⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\F052.tmp"C:\Users\Admin\AppData\Local\Temp\F052.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"111⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"112⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"113⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"114⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\F330.tmp"C:\Users\Admin\AppData\Local\Temp\F330.tmp"115⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"C:\Users\Admin\AppData\Local\Temp\F3DC.tmp"116⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\F488.tmp"C:\Users\Admin\AppData\Local\Temp\F488.tmp"117⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\F505.tmp"C:\Users\Admin\AppData\Local\Temp\F505.tmp"118⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"119⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"120⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"121⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"122⤵PID:5268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-