Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_0648b34a32e3c781c23332ce4d2d0ab7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_0648b34a32e3c781c23332ce4d2d0ab7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_0648b34a32e3c781c23332ce4d2d0ab7_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample261001-x3vs1sxcph
- SHA256 b6733c212ed070f2ecca77dbf060d059284e12c3e0231b3f21aabdcdb9350d23
- MD5 0648b34a32e3c781c23332ce4d2d0ab7
- SHA1 e5107fc69c5972fc695294595eb26764b2f7d834
- SHA512 9fd6ee55284e0334818ef3e299d3b4baad40035030a51a532f427269d5850afbe472ea585efcd3904c872c625444c023ece8914d311cb0ca95a3a1ad2a4bfb78
- SSDEEP 12288:NU5rCOTeijUim2sVPmfS8cHLBTvnbTZwlH4Hp:NUQOJjg5VuCtbTSlH4Hp
- TLSH T1D5B4E026B645C132E69202710BD6EBA26E3BBC754726A4C337D4623E2FB17E09375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2316 BAFE.tmp 4240 BB7B.tmp 2400 BC65.tmp 2148 BCE2.tmp 3816 BD5F.tmp 4196 BE1B.tmp 3712 BEC7.tmp 448 BFA2.tmp 548 C02E.tmp 3464 C0DA.tmp 3788 C147.tmp 1776 C1C4.tmp 3560 C270.tmp 3700 C2ED.tmp 2624 C3A9.tmp 1456 C464.tmp 4716 C4F1.tmp 4376 C58D.tmp 4572 C658.tmp 4324 C6F5.tmp 1936 C7A0.tmp 1476 C83D.tmp 2880 C8AA.tmp 4040 C946.tmp 4852 C9E3.tmp 3468 CA8E.tmp 1912 CB1B.tmp 3372 CBD7.tmp 2584 CC63.tmp 4740 CD0F.tmp 3928 CD7C.tmp 4356 CE28.tmp 3388 CEA5.tmp 4700 CEF3.tmp 4252 CF42.tmp 8 CF9F.tmp 4032 D02C.tmp 2368 D099.tmp 4088 D0F7.tmp 5068 D145.tmp 4024 D1A3.tmp 1536 D1F1.tmp 2056 D24F.tmp 536 D2BC.tmp 4816 D30A.tmp 368 D358.tmp 4676 D3A7.tmp 1680 D3F5.tmp 4988 D443.tmp 748 D491.tmp 3232 D4DF.tmp 3784 D52D.tmp 216 D57B.tmp 3704 D5C9.tmp 1540 D618.tmp 4508 D675.tmp 1580 D6D3.tmp 4320 D721.tmp 2036 D76F.tmp 5092 D7DD.tmp 2856 D83A.tmp 3444 D889.tmp 2364 D8F6.tmp 980 D934.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C02E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 2316 4164 2026-09-30_0648b34a32e3c781c23332ce4d2d0ab7_elex_mafia_stealc_tofsee.exe 86 PID 2316 wrote to memory of 4240 2316 BAFE.tmp 87 PID 4240 wrote to memory of 2400 4240 BB7B.tmp 89 PID 2400 wrote to memory of 2148 2400 BC65.tmp 91 PID 2148 wrote to memory of 3816 2148 BCE2.tmp 92 PID 3816 wrote to memory of 4196 3816 BD5F.tmp 93 PID 4196 wrote to memory of 3712 4196 BE1B.tmp 95 PID 3712 wrote to memory of 448 3712 BEC7.tmp 96 PID 448 wrote to memory of 548 448 BFA2.tmp 97 PID 548 wrote to memory of 3464 548 C02E.tmp 98 PID 3464 wrote to memory of 3788 3464 C0DA.tmp 99 PID 3788 wrote to memory of 1776 3788 C147.tmp 100 PID 1776 wrote to memory of 3560 1776 C1C4.tmp 101 PID 3560 wrote to memory of 3700 3560 C270.tmp 102 PID 3700 wrote to memory of 2624 3700 C2ED.tmp 103 PID 2624 wrote to memory of 1456 2624 C3A9.tmp 104 PID 1456 wrote to memory of 4716 1456 C464.tmp 105 PID 4716 wrote to memory of 4376 4716 C4F1.tmp 106 PID 4376 wrote to memory of 4572 4376 C58D.tmp 107 PID 4572 wrote to memory of 4324 4572 C658.tmp 108 PID 4324 wrote to memory of 1936 4324 C6F5.tmp 109 PID 1936 wrote to memory of 1476 1936 C7A0.tmp 110 PID 1476 wrote to memory of 2880 1476 C83D.tmp 113 PID 2880 wrote to memory of 4040 2880 C8AA.tmp 114 PID 4040 wrote to memory of 4852 4040 C946.tmp 115 PID 4852 wrote to memory of 3468 4852 C9E3.tmp 116 PID 3468 wrote to memory of 1912 3468 CA8E.tmp 117 PID 1912 wrote to memory of 3372 1912 CB1B.tmp 118 PID 3372 wrote to memory of 2584 3372 CBD7.tmp 119 PID 2584 wrote to memory of 4740 2584 CC63.tmp 121 PID 4740 wrote to memory of 3928 4740 CD0F.tmp 122 PID 3928 wrote to memory of 4356 3928 CD7C.tmp 124 PID 4356 wrote to memory of 3388 4356 CE28.tmp 125 PID 3388 wrote to memory of 4700 3388 CEA5.tmp 126 PID 4700 wrote to memory of 4252 4700 CEF3.tmp 127 PID 4252 wrote to memory of 8 4252 CF42.tmp 128 PID 8 wrote to memory of 4032 8 CF9F.tmp 129 PID 4032 wrote to memory of 2368 4032 D02C.tmp 130 PID 2368 wrote to memory of 4088 2368 D099.tmp 131 PID 4088 wrote to memory of 5068 4088 D0F7.tmp 132 PID 5068 wrote to memory of 4024 5068 D145.tmp 133 PID 4024 wrote to memory of 1536 4024 D1A3.tmp 134 PID 1536 wrote to memory of 2056 1536 D1F1.tmp 135 PID 2056 wrote to memory of 536 2056 D24F.tmp 136 PID 536 wrote to memory of 4816 536 D2BC.tmp 137 PID 4816 wrote to memory of 368 4816 D30A.tmp 138 PID 368 wrote to memory of 4676 368 D358.tmp 139 PID 4676 wrote to memory of 1680 4676 D3A7.tmp 140 PID 1680 wrote to memory of 4988 1680 D3F5.tmp 141 PID 4988 wrote to memory of 748 4988 D443.tmp 142 PID 748 wrote to memory of 3232 748 D491.tmp 143 PID 3232 wrote to memory of 3784 3232 D4DF.tmp 144 PID 3784 wrote to memory of 216 3784 D52D.tmp 145 PID 216 wrote to memory of 3704 216 D57B.tmp 146 PID 3704 wrote to memory of 1540 3704 D5C9.tmp 147 PID 1540 wrote to memory of 4508 1540 D618.tmp 148 PID 4508 wrote to memory of 1580 4508 D675.tmp 149 PID 1580 wrote to memory of 4320 1580 D6D3.tmp 150 PID 4320 wrote to memory of 2036 4320 D721.tmp 151 PID 2036 wrote to memory of 5092 2036 D76F.tmp 152 PID 5092 wrote to memory of 2856 5092 D7DD.tmp 153 PID 2856 wrote to memory of 3444 2856 D83A.tmp 154 PID 3444 wrote to memory of 2364 3444 D889.tmp 156 PID 2364 wrote to memory of 980 2364 D8F6.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_0648b34a32e3c781c23332ce4d2d0ab7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_0648b34a32e3c781c23332ce4d2d0ab7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\C02E.tmp"C:\Users\Admin\AppData\Local\Temp\C02E.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\C147.tmp"C:\Users\Admin\AppData\Local\Temp\C147.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\C658.tmp"C:\Users\Admin\AppData\Local\Temp\C658.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\C6F5.tmp"C:\Users\Admin\AppData\Local\Temp\C6F5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\D145.tmp"C:\Users\Admin\AppData\Local\Temp\D145.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\D57B.tmp"C:\Users\Admin\AppData\Local\Temp\D57B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\D675.tmp"C:\Users\Admin\AppData\Local\Temp\D675.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"66⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"67⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"68⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"69⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"70⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"72⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"73⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"74⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"75⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\DCFD.tmp"C:\Users\Admin\AppData\Local\Temp\DCFD.tmp"76⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\DD4B.tmp"C:\Users\Admin\AppData\Local\Temp\DD4B.tmp"77⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\DD99.tmp"C:\Users\Admin\AppData\Local\Temp\DD99.tmp"78⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"79⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"80⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"81⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\DF10.tmp"C:\Users\Admin\AppData\Local\Temp\DF10.tmp"82⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"83⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"84⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"85⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\E078.tmp"C:\Users\Admin\AppData\Local\Temp\E078.tmp"86⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"87⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\E143.tmp"C:\Users\Admin\AppData\Local\Temp\E143.tmp"88⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"89⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"91⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"92⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\E308.tmp"C:\Users\Admin\AppData\Local\Temp\E308.tmp"93⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"94⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"95⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"96⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"97⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\E49E.tmp"C:\Users\Admin\AppData\Local\Temp\E49E.tmp"98⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"99⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"100⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"101⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"102⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"103⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\E673.tmp"C:\Users\Admin\AppData\Local\Temp\E673.tmp"104⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"105⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\E70F.tmp"C:\Users\Admin\AppData\Local\Temp\E70F.tmp"106⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\E77D.tmp"C:\Users\Admin\AppData\Local\Temp\E77D.tmp"107⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"108⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\E829.tmp"C:\Users\Admin\AppData\Local\Temp\E829.tmp"109⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"110⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"111⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"112⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\E980.tmp"C:\Users\Admin\AppData\Local\Temp\E980.tmp"113⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\E9CE.tmp"C:\Users\Admin\AppData\Local\Temp\E9CE.tmp"114⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"115⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"116⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"117⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"118⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"119⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"120⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\EC5F.tmp"C:\Users\Admin\AppData\Local\Temp\EC5F.tmp"121⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-