Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_8e89fd63a7a7ca756450b796ba064f64_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_8e89fd63a7a7ca756450b796ba064f64_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_8e89fd63a7a7ca756450b796ba064f64_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample261002-k4vs7aef26
- SHA256 6e8addb9f42257de33f56c2e680bb88c15fdc117b08fdaa6ac624569e932c5cd
- MD5 8e89fd63a7a7ca756450b796ba064f64
- SHA1 a2b69a6ce8a6147d3589679f93db0828bc0c5f92
- SHA512 81084f7a744172b444b30f669a7bfa674ead4d7e438e5d7df1bd05864f4326660485f7dfef319259dc67033a4ee988c45aba83c878d9a2b15271af43790626c4
- SSDEEP 12288:9U5rCOTei6UaLSyJVlYlhE5NI5lJP/uqZoXWjdq:9UQOJ6VSyJV2hEulJPmqqGh
- TLSH T11AC4F121B584C033E99202354AE2EFA1597B7C715B22A4C73BD4A77E2FB52E29375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2304 9F77.tmp 3732 A023.tmp 4200 A0FE.tmp 1256 A1AA.tmp 2484 A265.tmp 5648 A330.tmp 4076 A3EC.tmp 5200 A4A7.tmp 2008 A553.tmp 5224 A61E.tmp 4980 A6AB.tmp 4944 A766.tmp 3324 A7E3.tmp 4792 A880.tmp 3368 A93B.tmp 2892 A9C8.tmp 5252 AA54.tmp 5940 AAB2.tmp 1816 AB3F.tmp 5728 ABCB.tmp 5688 AC48.tmp 4344 ACB6.tmp 4392 AD23.tmp 372 ADB0.tmp 4280 AE6B.tmp 1116 AF27.tmp 4296 AF94.tmp 5736 B011.tmp 3144 B0CD.tmp 4320 B1B7.tmp 5020 B263.tmp 3292 B2E0.tmp 208 B38C.tmp 2424 B3EA.tmp 5372 B438.tmp 1124 B486.tmp 1004 B4D4.tmp 4068 B532.tmp 1328 B580.tmp 1560 B5CE.tmp 5584 B61C.tmp 5084 B66A.tmp 2580 B6C8.tmp 4668 B716.tmp 3448 B774.tmp 4464 B7D2.tmp 3320 BB1D.tmp 2056 BB7B.tmp 720 BBD9.tmp 3224 BC37.tmp 1516 BC94.tmp 5156 BCE2.tmp 3076 BD40.tmp 3156 BD8E.tmp 1792 BDDC.tmp 1468 BE2B.tmp 5160 BE79.tmp 4688 BEC7.tmp 5908 BF25.tmp 4516 BF73.tmp 4312 BFC1.tmp 5536 C00F.tmp 5420 C05D.tmp 2320 C0BB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 984E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E53B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2820.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C37A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 524C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C22.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2304 3768 2026-10-01_8e89fd63a7a7ca756450b796ba064f64_elex_mafia_stealc_tofsee.exe 85 PID 2304 wrote to memory of 3732 2304 9F77.tmp 86 PID 3732 wrote to memory of 4200 3732 A023.tmp 87 PID 4200 wrote to memory of 1256 4200 A0FE.tmp 90 PID 1256 wrote to memory of 2484 1256 A1AA.tmp 92 PID 2484 wrote to memory of 5648 2484 A265.tmp 93 PID 5648 wrote to memory of 4076 5648 A330.tmp 94 PID 4076 wrote to memory of 5200 4076 A3EC.tmp 95 PID 5200 wrote to memory of 2008 5200 A4A7.tmp 96 PID 2008 wrote to memory of 5224 2008 A553.tmp 97 PID 5224 wrote to memory of 4980 5224 A61E.tmp 98 PID 4980 wrote to memory of 4944 4980 A6AB.tmp 99 PID 4944 wrote to memory of 3324 4944 A766.tmp 100 PID 3324 wrote to memory of 4792 3324 A7E3.tmp 102 PID 4792 wrote to memory of 3368 4792 A880.tmp 103 PID 3368 wrote to memory of 2892 3368 A93B.tmp 104 PID 2892 wrote to memory of 5252 2892 A9C8.tmp 107 PID 5252 wrote to memory of 5940 5252 AA54.tmp 108 PID 5940 wrote to memory of 1816 5940 AAB2.tmp 109 PID 1816 wrote to memory of 5728 1816 AB3F.tmp 110 PID 5728 wrote to memory of 5688 5728 ABCB.tmp 111 PID 5688 wrote to memory of 4344 5688 AC48.tmp 112 PID 4344 wrote to memory of 4392 4344 ACB6.tmp 113 PID 4392 wrote to memory of 372 4392 AD23.tmp 114 PID 372 wrote to memory of 4280 372 ADB0.tmp 116 PID 4280 wrote to memory of 1116 4280 AE6B.tmp 118 PID 1116 wrote to memory of 4296 1116 AF27.tmp 119 PID 4296 wrote to memory of 5736 4296 AF94.tmp 120 PID 5736 wrote to memory of 3144 5736 B011.tmp 121 PID 3144 wrote to memory of 4320 3144 B0CD.tmp 122 PID 4320 wrote to memory of 5020 4320 B1B7.tmp 123 PID 5020 wrote to memory of 3292 5020 B263.tmp 124 PID 3292 wrote to memory of 208 3292 B2E0.tmp 125 PID 208 wrote to memory of 2424 208 B38C.tmp 126 PID 2424 wrote to memory of 5372 2424 B3EA.tmp 127 PID 5372 wrote to memory of 1124 5372 B438.tmp 129 PID 1124 wrote to memory of 1004 1124 B486.tmp 130 PID 1004 wrote to memory of 4068 1004 B4D4.tmp 131 PID 4068 wrote to memory of 1328 4068 B532.tmp 132 PID 1328 wrote to memory of 1560 1328 B580.tmp 134 PID 1560 wrote to memory of 5584 1560 B5CE.tmp 135 PID 5584 wrote to memory of 5084 5584 B61C.tmp 136 PID 5084 wrote to memory of 2580 5084 B66A.tmp 137 PID 2580 wrote to memory of 4668 2580 B6C8.tmp 138 PID 4668 wrote to memory of 3448 4668 B716.tmp 139 PID 3448 wrote to memory of 4464 3448 B774.tmp 140 PID 4464 wrote to memory of 3320 4464 B7D2.tmp 142 PID 3320 wrote to memory of 2056 3320 BB1D.tmp 143 PID 2056 wrote to memory of 720 2056 BB7B.tmp 144 PID 720 wrote to memory of 3224 720 BBD9.tmp 145 PID 3224 wrote to memory of 1516 3224 BC37.tmp 146 PID 1516 wrote to memory of 5156 1516 BC94.tmp 148 PID 5156 wrote to memory of 3076 5156 BCE2.tmp 149 PID 3076 wrote to memory of 3156 3076 BD40.tmp 151 PID 3156 wrote to memory of 1792 3156 BD8E.tmp 152 PID 1792 wrote to memory of 1468 1792 BDDC.tmp 153 PID 1468 wrote to memory of 5160 1468 BE2B.tmp 154 PID 5160 wrote to memory of 4688 5160 BE79.tmp 155 PID 4688 wrote to memory of 5908 4688 BEC7.tmp 157 PID 5908 wrote to memory of 4516 5908 BF25.tmp 158 PID 4516 wrote to memory of 4312 4516 BF73.tmp 159 PID 4312 wrote to memory of 5536 4312 BFC1.tmp 160 PID 5536 wrote to memory of 5420 5536 C00F.tmp 161 PID 5420 wrote to memory of 2320 5420 C05D.tmp 162
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_8e89fd63a7a7ca756450b796ba064f64_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_8e89fd63a7a7ca756450b796ba064f64_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A023.tmp"C:\Users\Admin\AppData\Local\Temp\A023.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\A265.tmp"C:\Users\Admin\AppData\Local\Temp\A265.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\A553.tmp"C:\Users\Admin\AppData\Local\Temp\A553.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\AF27.tmp"C:\Users\Admin\AppData\Local\Temp\AF27.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\AF94.tmp"C:\Users\Admin\AppData\Local\Temp\AF94.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\B38C.tmp"C:\Users\Admin\AppData\Local\Temp\B38C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B438.tmp"C:\Users\Admin\AppData\Local\Temp\B438.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\B486.tmp"C:\Users\Admin\AppData\Local\Temp\B486.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\B532.tmp"C:\Users\Admin\AppData\Local\Temp\B532.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\B580.tmp"C:\Users\Admin\AppData\Local\Temp\B580.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\B66A.tmp"C:\Users\Admin\AppData\Local\Temp\B66A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\B774.tmp"C:\Users\Admin\AppData\Local\Temp\B774.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\B7D2.tmp"C:\Users\Admin\AppData\Local\Temp\B7D2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\BD40.tmp"C:\Users\Admin\AppData\Local\Temp\BD40.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\C00F.tmp"C:\Users\Admin\AppData\Local\Temp\C00F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"65⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"66⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"67⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"68⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\C222.tmp"C:\Users\Admin\AppData\Local\Temp\C222.tmp"69⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"70⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"71⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\C32C.tmp"C:\Users\Admin\AppData\Local\Temp\C32C.tmp"72⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\C37A.tmp"C:\Users\Admin\AppData\Local\Temp\C37A.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"74⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"75⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"76⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"77⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\C510.tmp"C:\Users\Admin\AppData\Local\Temp\C510.tmp"78⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\C57E.tmp"C:\Users\Admin\AppData\Local\Temp\C57E.tmp"79⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"80⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\C61A.tmp"C:\Users\Admin\AppData\Local\Temp\C61A.tmp"81⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\C668.tmp"C:\Users\Admin\AppData\Local\Temp\C668.tmp"82⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"83⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"84⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"85⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"86⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"87⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\C85C.tmp"C:\Users\Admin\AppData\Local\Temp\C85C.tmp"88⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"89⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"90⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"91⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"92⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\CA40.tmp"C:\Users\Admin\AppData\Local\Temp\CA40.tmp"93⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"94⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"95⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"96⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"97⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"98⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"99⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"100⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"101⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"102⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"103⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"104⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"105⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"106⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"107⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\CF90.tmp"C:\Users\Admin\AppData\Local\Temp\CF90.tmp"108⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"109⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\D04B.tmp"C:\Users\Admin\AppData\Local\Temp\D04B.tmp"110⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"111⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"112⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"113⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"114⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"115⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"116⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\D27E.tmp"C:\Users\Admin\AppData\Local\Temp\D27E.tmp"117⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"118⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"119⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\D378.tmp"C:\Users\Admin\AppData\Local\Temp\D378.tmp"120⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"121⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"122⤵PID:3460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-