Analysis
- max time kernel
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_d86bcffda06591fefc32b99dc34177fb_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_d86bcffda06591fefc32b99dc34177fb_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-13_d86bcffda06591fefc32b99dc34177fb_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample261014-e8g51afw9s
- SHA256 836d7c39d35542bd1f2a2d04e72d944bf3c02767cfadf0edcf65556b9dd3382a
- MD5 d86bcffda06591fefc32b99dc34177fb
- SHA1 286b639b3f4fe600987e29c6a21750081420c3d7
- SHA512 9dbf9cfe65018abf86184b5e7c01111aeb0b44a973e8eda05013c1ad22b146481685d60eb5471deed41c6bcbd26d3d80997f851d96f2e1927b4905c8d59c91a0
- SSDEEP 12288:9U5rCOTei6pfV7XEfzWfLFBmAAJes4SqZoXWjdqpby1grA70G+o:9UQOJ6dBioWJeeqqGh4yATXo
- TLSH T18FE40121B989C032F6D702304EE2EBB1697ABD319725A4C77B84676E6FB12D1D235307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4940 8C77.tmp 4884 8D42.tmp 5060 8E4C.tmp 4688 8F27.tmp 4328 9011.tmp 2772 908E.tmp 2460 911B.tmp 4580 9215.tmp 2004 930F.tmp 3580 93F9.tmp 1088 94A5.tmp 5404 9560.tmp 2740 95FD.tmp 4132 96E7.tmp 3740 9764.tmp 2112 984E.tmp 2952 9939.tmp 3716 9A13.tmp 1764 9ACF.tmp 4516 9B9A.tmp 4684 9C27.tmp 5956 9CD3.tmp 4832 9D8E.tmp 5192 9E0B.tmp 2644 9EC7.tmp 688 9F92.tmp 5632 A06C.tmp 5692 A147.tmp 3720 A1F3.tmp 4060 A280.tmp 5508 A37A.tmp 4100 A435.tmp 3404 A4E1.tmp 3724 A55E.tmp 2196 A5DB.tmp 1700 A658.tmp 5744 A6F4.tmp 2932 A771.tmp 1924 A7DF.tmp 5764 A84C.tmp 5400 A8C9.tmp 4080 A946.tmp 1276 A9C3.tmp 1708 AA6F.tmp 4792 AB0B.tmp 5380 ABA7.tmp 4736 AC24.tmp 292 ACA1.tmp 2616 AD4D.tmp 3036 ADCA.tmp 3440 AE67.tmp 4540 AEF3.tmp 2732 AF8F.tmp 4260 B01C.tmp 1832 B0A9.tmp 1452 B135.tmp 1580 B1C2.tmp 2724 B24F.tmp 2148 B2EB.tmp 4948 B368.tmp 4192 B3E5.tmp 4496 B462.tmp 4448 B4EE.tmp 2764 B58B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 665C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 508D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 908E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6A4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4940 4172 2026-10-13_d86bcffda06591fefc32b99dc34177fb_elex_mafia_stealc_tofsee.exe 89 PID 4940 wrote to memory of 4884 4940 8C77.tmp 90 PID 4884 wrote to memory of 5060 4884 8D42.tmp 91 PID 5060 wrote to memory of 4688 5060 8E4C.tmp 92 PID 4688 wrote to memory of 4328 4688 8F27.tmp 93 PID 4328 wrote to memory of 2772 4328 9011.tmp 94 PID 2772 wrote to memory of 2460 2772 908E.tmp 95 PID 2460 wrote to memory of 4580 2460 911B.tmp 96 PID 4580 wrote to memory of 2004 4580 9215.tmp 97 PID 2004 wrote to memory of 3580 2004 930F.tmp 98 PID 3580 wrote to memory of 1088 3580 93F9.tmp 99 PID 1088 wrote to memory of 5404 1088 94A5.tmp 100 PID 5404 wrote to memory of 2740 5404 9560.tmp 101 PID 2740 wrote to memory of 4132 2740 95FD.tmp 102 PID 4132 wrote to memory of 3740 4132 96E7.tmp 103 PID 3740 wrote to memory of 2112 3740 9764.tmp 104 PID 2112 wrote to memory of 2952 2112 984E.tmp 105 PID 2952 wrote to memory of 3716 2952 9939.tmp 106 PID 3716 wrote to memory of 1764 3716 9A13.tmp 107 PID 1764 wrote to memory of 4516 1764 9ACF.tmp 108 PID 4516 wrote to memory of 4684 4516 9B9A.tmp 109 PID 4684 wrote to memory of 5956 4684 9C27.tmp 110 PID 5956 wrote to memory of 4832 5956 9CD3.tmp 111 PID 4832 wrote to memory of 5192 4832 9D8E.tmp 112 PID 5192 wrote to memory of 2644 5192 9E0B.tmp 113 PID 2644 wrote to memory of 688 2644 9EC7.tmp 114 PID 688 wrote to memory of 5632 688 9F92.tmp 115 PID 5632 wrote to memory of 5692 5632 A06C.tmp 116 PID 5692 wrote to memory of 3720 5692 A147.tmp 117 PID 3720 wrote to memory of 4060 3720 A1F3.tmp 118 PID 4060 wrote to memory of 5508 4060 A280.tmp 119 PID 5508 wrote to memory of 4100 5508 A37A.tmp 120 PID 4100 wrote to memory of 3404 4100 A435.tmp 121 PID 3404 wrote to memory of 3724 3404 A4E1.tmp 122 PID 3724 wrote to memory of 2196 3724 A55E.tmp 123 PID 2196 wrote to memory of 1700 2196 A5DB.tmp 124 PID 1700 wrote to memory of 5744 1700 A658.tmp 125 PID 5744 wrote to memory of 2932 5744 A6F4.tmp 126 PID 2932 wrote to memory of 1924 2932 A771.tmp 127 PID 1924 wrote to memory of 5764 1924 A7DF.tmp 128 PID 5764 wrote to memory of 5400 5764 A84C.tmp 129 PID 5400 wrote to memory of 4080 5400 A8C9.tmp 130 PID 4080 wrote to memory of 1276 4080 A946.tmp 131 PID 1276 wrote to memory of 1708 1276 A9C3.tmp 132 PID 1708 wrote to memory of 4792 1708 AA6F.tmp 133 PID 4792 wrote to memory of 5380 4792 AB0B.tmp 134 PID 5380 wrote to memory of 4736 5380 ABA7.tmp 135 PID 4736 wrote to memory of 292 4736 AC24.tmp 136 PID 292 wrote to memory of 2616 292 ACA1.tmp 137 PID 2616 wrote to memory of 3036 2616 AD4D.tmp 138 PID 3036 wrote to memory of 3440 3036 ADCA.tmp 139 PID 3440 wrote to memory of 4540 3440 AE67.tmp 140 PID 4540 wrote to memory of 2732 4540 AEF3.tmp 141 PID 2732 wrote to memory of 4260 2732 AF8F.tmp 142 PID 4260 wrote to memory of 1832 4260 B01C.tmp 143 PID 1832 wrote to memory of 1452 1832 B0A9.tmp 144 PID 1452 wrote to memory of 1580 1452 B135.tmp 145 PID 1580 wrote to memory of 2724 1580 B1C2.tmp 146 PID 2724 wrote to memory of 2148 2724 B24F.tmp 147 PID 2148 wrote to memory of 4948 2148 B2EB.tmp 148 PID 4948 wrote to memory of 4192 4948 B368.tmp 149 PID 4192 wrote to memory of 4496 4192 B3E5.tmp 150 PID 4496 wrote to memory of 4448 4496 B462.tmp 151 PID 4448 wrote to memory of 2764 4448 B4EE.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_d86bcffda06591fefc32b99dc34177fb_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d86bcffda06591fefc32b99dc34177fb_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\911B.tmp"C:\Users\Admin\AppData\Local\Temp\911B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\9560.tmp"C:\Users\Admin\AppData\Local\Temp\9560.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\95FD.tmp"C:\Users\Admin\AppData\Local\Temp\95FD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\A37A.tmp"C:\Users\Admin\AppData\Local\Temp\A37A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\A435.tmp"C:\Users\Admin\AppData\Local\Temp\A435.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\A658.tmp"C:\Users\Admin\AppData\Local\Temp\A658.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\A771.tmp"C:\Users\Admin\AppData\Local\Temp\A771.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\A84C.tmp"C:\Users\Admin\AppData\Local\Temp\A84C.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\A946.tmp"C:\Users\Admin\AppData\Local\Temp\A946.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\B58B.tmp"C:\Users\Admin\AppData\Local\Temp\B58B.tmp"65⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"66⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"68⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"C:\Users\Admin\AppData\Local\Temp\B7EC.tmp"69⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"70⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"71⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\B973.tmp"C:\Users\Admin\AppData\Local\Temp\B973.tmp"72⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"73⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"74⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"75⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"77⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"78⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"79⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"80⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"81⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"82⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"83⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"84⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"85⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"86⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"87⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"88⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\C337.tmp"C:\Users\Admin\AppData\Local\Temp\C337.tmp"89⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"90⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\C421.tmp"C:\Users\Admin\AppData\Local\Temp\C421.tmp"91⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\C4AE.tmp"C:\Users\Admin\AppData\Local\Temp\C4AE.tmp"92⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\C52B.tmp"C:\Users\Admin\AppData\Local\Temp\C52B.tmp"93⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"94⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\C615.tmp"C:\Users\Admin\AppData\Local\Temp\C615.tmp"95⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"96⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"97⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"98⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"100⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"101⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\C980.tmp"C:\Users\Admin\AppData\Local\Temp\C980.tmp"102⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"103⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\CA99.tmp"C:\Users\Admin\AppData\Local\Temp\CA99.tmp"104⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"105⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"106⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"107⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"108⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"109⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"110⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\CE52.tmp"C:\Users\Admin\AppData\Local\Temp\CE52.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\CECF.tmp"C:\Users\Admin\AppData\Local\Temp\CECF.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"113⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\CFBA.tmp"C:\Users\Admin\AppData\Local\Temp\CFBA.tmp"114⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"115⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"116⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"117⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"118⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"119⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"120⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\D383.tmp"C:\Users\Admin\AppData\Local\Temp\D383.tmp"121⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-