Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 23:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_c3ba98e9a2bbdfb59f173f88f3da03db_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_c3ba98e9a2bbdfb59f173f88f3da03db_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-02_c3ba98e9a2bbdfb59f173f88f3da03db_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample261102-3dlrpsfz6j
- SHA256 20acb013e697c733ab1108c4dea08d4a6ec30f9f9d192c55cd8d2078a8152dca
- MD5 c3ba98e9a2bbdfb59f173f88f3da03db
- SHA1 4d933bc098bf45a97d96860b3704c34736bb4bc7
- SHA512 a875e9f8d297c25f45458b9f744729773ceda742fcb1981ad66086076bf22639e1cb94b914c96de182b412f33cb6ce2d2e12c3db1fab608af503f6c2648c681a
- SSDEEP 12288:UU5rCOTeifpI+wXRqsR8CkcjDtckwapICEsRvfJ9rZa73ctO:UUQOJfpI+LsyCkyDtcOIlsRnrrU73ctO
- TLSH T133C4E126B245C232D6D202701ADAEBE26A3E7C76533694C37B94A27D1FB17E0D371346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4200 A766.tmp 4892 A832.tmp 3752 A90C.tmp 3060 A999.tmp 3712 AA74.tmp 3000 AAF1.tmp 3584 ABBC.tmp 4392 AC1A.tmp 4328 ACB6.tmp 1016 AD52.tmp 2264 ADCF.tmp 5096 AE2D.tmp 2052 AEC9.tmp 3324 AF65.tmp 3348 AFD3.tmp 2204 B07F.tmp 2916 B10B.tmp 1852 B198.tmp 2060 B224.tmp 4476 B282.tmp 4500 B32E.tmp 4556 B3AB.tmp 3428 B457.tmp 1904 B503.tmp 3464 B5AF.tmp 4704 B63B.tmp 3944 B6E7.tmp 1864 B764.tmp 1672 B7F1.tmp 1780 B86E.tmp 2540 B8FA.tmp 4524 B968.tmp 1268 B9F4.tmp 3416 BA52.tmp 4376 BAA0.tmp 3980 BAEE.tmp 4188 BB3D.tmp 1808 BB9A.tmp 2320 BBE8.tmp 632 BC37.tmp 856 BC94.tmp 2968 BCE2.tmp 2172 BD31.tmp 4012 BD8E.tmp 1700 BDEC.tmp 3036 BE3A.tmp 2928 BE88.tmp 4156 BED6.tmp 1728 BF25.tmp 1168 BF73.tmp 4016 BFC1.tmp 4752 C01F.tmp 5032 C06D.tmp 1108 C0BB.tmp 3472 C109.tmp 1176 C167.tmp 4808 C203.tmp 4876 C270.tmp 1920 C2BE.tmp 2900 C30D.tmp 3176 C35B.tmp 4208 C3A9.tmp 4332 C3F7.tmp 4536 C445.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E25C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 237C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 309B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D35.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1880 wrote to memory of 4200 1880 2026-11-02_c3ba98e9a2bbdfb59f173f88f3da03db_elex_mafia_stealc_tofsee.exe 84 PID 4200 wrote to memory of 4892 4200 A766.tmp 85 PID 4892 wrote to memory of 3752 4892 A832.tmp 86 PID 3752 wrote to memory of 3060 3752 A90C.tmp 87 PID 3060 wrote to memory of 3712 3060 A999.tmp 88 PID 3712 wrote to memory of 3000 3712 AA74.tmp 89 PID 3000 wrote to memory of 3584 3000 AAF1.tmp 90 PID 3584 wrote to memory of 4392 3584 ABBC.tmp 91 PID 4392 wrote to memory of 4328 4392 AC1A.tmp 92 PID 4328 wrote to memory of 1016 4328 ACB6.tmp 93 PID 1016 wrote to memory of 2264 1016 AD52.tmp 94 PID 2264 wrote to memory of 5096 2264 ADCF.tmp 97 PID 5096 wrote to memory of 2052 5096 AE2D.tmp 98 PID 2052 wrote to memory of 3324 2052 AEC9.tmp 99 PID 3324 wrote to memory of 3348 3324 AF65.tmp 100 PID 3348 wrote to memory of 2204 3348 AFD3.tmp 101 PID 2204 wrote to memory of 2916 2204 B07F.tmp 102 PID 2916 wrote to memory of 1852 2916 B10B.tmp 103 PID 1852 wrote to memory of 2060 1852 B198.tmp 104 PID 2060 wrote to memory of 4476 2060 B224.tmp 106 PID 4476 wrote to memory of 4500 4476 B282.tmp 108 PID 4500 wrote to memory of 4556 4500 B32E.tmp 109 PID 4556 wrote to memory of 3428 4556 B3AB.tmp 110 PID 3428 wrote to memory of 1904 3428 B457.tmp 111 PID 1904 wrote to memory of 3464 1904 B503.tmp 112 PID 3464 wrote to memory of 4704 3464 B5AF.tmp 113 PID 4704 wrote to memory of 3944 4704 B63B.tmp 114 PID 3944 wrote to memory of 1864 3944 B6E7.tmp 115 PID 1864 wrote to memory of 1672 1864 B764.tmp 116 PID 1672 wrote to memory of 1780 1672 B7F1.tmp 117 PID 1780 wrote to memory of 2540 1780 B86E.tmp 118 PID 2540 wrote to memory of 4524 2540 B8FA.tmp 119 PID 4524 wrote to memory of 1268 4524 B968.tmp 120 PID 1268 wrote to memory of 3416 1268 B9F4.tmp 121 PID 3416 wrote to memory of 4376 3416 BA52.tmp 122 PID 4376 wrote to memory of 3980 4376 BAA0.tmp 123 PID 3980 wrote to memory of 4188 3980 BAEE.tmp 124 PID 4188 wrote to memory of 1808 4188 BB3D.tmp 125 PID 1808 wrote to memory of 2320 1808 BB9A.tmp 126 PID 2320 wrote to memory of 632 2320 BBE8.tmp 127 PID 632 wrote to memory of 856 632 BC37.tmp 128 PID 856 wrote to memory of 2968 856 BC94.tmp 129 PID 2968 wrote to memory of 2172 2968 BCE2.tmp 130 PID 2172 wrote to memory of 4012 2172 BD31.tmp 131 PID 4012 wrote to memory of 1700 4012 BD8E.tmp 132 PID 1700 wrote to memory of 3036 1700 BDEC.tmp 134 PID 3036 wrote to memory of 2928 3036 BE3A.tmp 135 PID 2928 wrote to memory of 4156 2928 BE88.tmp 136 PID 4156 wrote to memory of 1728 4156 BED6.tmp 137 PID 1728 wrote to memory of 1168 1728 BF25.tmp 138 PID 1168 wrote to memory of 4016 1168 BF73.tmp 139 PID 4016 wrote to memory of 4752 4016 BFC1.tmp 140 PID 4752 wrote to memory of 5032 4752 C01F.tmp 141 PID 5032 wrote to memory of 1108 5032 C06D.tmp 142 PID 1108 wrote to memory of 3472 1108 C0BB.tmp 143 PID 3472 wrote to memory of 1176 3472 C109.tmp 144 PID 4168 wrote to memory of 4808 4168 C1B5.tmp 146 PID 4808 wrote to memory of 4876 4808 C203.tmp 147 PID 4876 wrote to memory of 1920 4876 C270.tmp 148 PID 1920 wrote to memory of 2900 1920 C2BE.tmp 149 PID 2900 wrote to memory of 3176 2900 C30D.tmp 150 PID 3176 wrote to memory of 4208 3176 C35B.tmp 151 PID 4208 wrote to memory of 4332 4208 C3A9.tmp 152 PID 4332 wrote to memory of 4536 4332 C3F7.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_c3ba98e9a2bbdfb59f173f88f3da03db_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c3ba98e9a2bbdfb59f173f88f3da03db_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\A832.tmp"C:\Users\Admin\AppData\Local\Temp\A832.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\A999.tmp"C:\Users\Admin\AppData\Local\Temp\A999.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\AE2D.tmp"C:\Users\Admin\AppData\Local\Temp\AE2D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\AF65.tmp"C:\Users\Admin\AppData\Local\Temp\AF65.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\B07F.tmp"C:\Users\Admin\AppData\Local\Temp\B07F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\B10B.tmp"C:\Users\Admin\AppData\Local\Temp\B10B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\B224.tmp"C:\Users\Admin\AppData\Local\Temp\B224.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\B282.tmp"C:\Users\Admin\AppData\Local\Temp\B282.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\B503.tmp"C:\Users\Admin\AppData\Local\Temp\B503.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\B63B.tmp"C:\Users\Admin\AppData\Local\Temp\B63B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\BB9A.tmp"C:\Users\Admin\AppData\Local\Temp\BB9A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\BD31.tmp"C:\Users\Admin\AppData\Local\Temp\BD31.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\BED6.tmp"C:\Users\Admin\AppData\Local\Temp\BED6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\C01F.tmp"C:\Users\Admin\AppData\Local\Temp\C01F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"57⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"58⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\C445.tmp"C:\Users\Admin\AppData\Local\Temp\C445.tmp"66⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C493.tmp"C:\Users\Admin\AppData\Local\Temp\C493.tmp"67⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"68⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"69⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"70⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"71⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\C61A.tmp"C:\Users\Admin\AppData\Local\Temp\C61A.tmp"72⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\C678.tmp"C:\Users\Admin\AppData\Local\Temp\C678.tmp"73⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"74⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"75⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"76⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"77⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"78⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"79⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"80⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\C917.tmp"C:\Users\Admin\AppData\Local\Temp\C917.tmp"81⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"82⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"83⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"84⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"85⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\CACD.tmp"C:\Users\Admin\AppData\Local\Temp\CACD.tmp"86⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"87⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"88⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\CC34.tmp"C:\Users\Admin\AppData\Local\Temp\CC34.tmp"90⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"91⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"92⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"93⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"94⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"95⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"96⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"97⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"98⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"99⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"100⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"101⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\D04B.tmp"C:\Users\Admin\AppData\Local\Temp\D04B.tmp"102⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"103⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"104⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D145.tmp"C:\Users\Admin\AppData\Local\Temp\D145.tmp"105⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\D193.tmp"C:\Users\Admin\AppData\Local\Temp\D193.tmp"106⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"107⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"108⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"109⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"110⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"111⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"113⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\D433.tmp"C:\Users\Admin\AppData\Local\Temp\D433.tmp"114⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"115⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"116⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"117⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\D58B.tmp"C:\Users\Admin\AppData\Local\Temp\D58B.tmp"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"119⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"120⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"121⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-