Analysis
- max time kernel
121s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 13:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_a2f1724d7e202718629bd1b5e4ce9cfd_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_a2f1724d7e202718629bd1b5e4ce9cfd_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-01_a2f1724d7e202718629bd1b5e4ce9cfd_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample261102-p9cxsact4p
- SHA256 b7d251dd642d24d7817d23c8109351585c132e381157f325da8c5b382b33f666
- MD5 a2f1724d7e202718629bd1b5e4ce9cfd
- SHA1 a7d209bc1c670c2345e8d5259e507013213ef5ed
- SHA512 e97e87a075781b9e94e6df68256894fa197ca44ab6e73ef3837a29c0593dc83d084213feab9f83bbd92658c4d0c7928cea4bcda45311d114ebcc8923468379db
- SSDEEP 12288:NU5rCOTeijcxE5y7rFYAIg9meke2SRIrBhuzKTTZwlH:NUQOJjfw7rxIle2MI1huWTSlH
- TLSH T1A5B4E0257285C132E58302700ADAEBA16A3BBC35572564C73B94627E2FB67D1D378387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3136 36C.tmp 4188 418.tmp 4132 4B4.tmp 6136 531.tmp 260 59F.tmp 4384 63B.tmp 5960 6A8.tmp 4960 754.tmp 244 7E1.tmp 5656 89C.tmp 236 948.tmp 2216 9E4.tmp 3360 ADE.tmp 1356 BD8.tmp 1260 C65.tmp 1732 CD2.tmp 1772 D7E.tmp 5392 E1B.tmp 624 EB7.tmp 2800 F63.tmp 4860 100F.tmp 2892 10CA.tmp 1484 1176.tmp 3040 11E3.tmp 4272 1270.tmp 1756 131C.tmp 1456 1389.tmp 3324 1416.tmp 4844 14B2.tmp 3556 153F.tmp 3044 15FA.tmp 4488 16C5.tmp 2924 1781.tmp 5904 17EE.tmp 1444 188A.tmp 4788 18E8.tmp 1612 1956.tmp 4968 19C3.tmp 2344 1A40.tmp 3520 1ABD.tmp 1476 1B2A.tmp 3764 1BA7.tmp 1928 1C24.tmp 4832 1CB1.tmp 5628 1D1E.tmp 1696 1D9B.tmp 1380 1E28.tmp 1000 1EB5.tmp 3908 1F51.tmp 1940 1FCE.tmp 712 203B.tmp 1820 20D7.tmp 3068 2174.tmp 2304 2200.tmp 1344 227D.tmp 5008 230A.tmp 6044 2377.tmp 5948 23F4.tmp 1628 2462.tmp 1616 24EE.tmp 3720 258B.tmp 760 2617.tmp 5696 2694.tmp 4064 2711.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 417A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 656D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 392D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 227D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D41A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D9F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3136 1672 2026-11-01_a2f1724d7e202718629bd1b5e4ce9cfd_elex_mafia_stealc_tofsee.exe 90 PID 3136 wrote to memory of 4188 3136 36C.tmp 91 PID 4188 wrote to memory of 4132 4188 418.tmp 92 PID 4132 wrote to memory of 6136 4132 4B4.tmp 93 PID 6136 wrote to memory of 260 6136 531.tmp 94 PID 260 wrote to memory of 4384 260 59F.tmp 95 PID 4384 wrote to memory of 5960 4384 63B.tmp 96 PID 5960 wrote to memory of 4960 5960 6A8.tmp 97 PID 4960 wrote to memory of 244 4960 754.tmp 98 PID 244 wrote to memory of 5656 244 7E1.tmp 99 PID 5656 wrote to memory of 236 5656 89C.tmp 100 PID 236 wrote to memory of 2216 236 948.tmp 101 PID 2216 wrote to memory of 3360 2216 9E4.tmp 102 PID 3360 wrote to memory of 1356 3360 ADE.tmp 103 PID 1356 wrote to memory of 1260 1356 BD8.tmp 104 PID 1260 wrote to memory of 1732 1260 C65.tmp 105 PID 1732 wrote to memory of 1772 1732 CD2.tmp 106 PID 1772 wrote to memory of 5392 1772 D7E.tmp 107 PID 5392 wrote to memory of 624 5392 E1B.tmp 108 PID 624 wrote to memory of 2800 624 EB7.tmp 109 PID 2800 wrote to memory of 4860 2800 F63.tmp 110 PID 4860 wrote to memory of 2892 4860 100F.tmp 111 PID 2892 wrote to memory of 1484 2892 10CA.tmp 112 PID 1484 wrote to memory of 3040 1484 1176.tmp 113 PID 3040 wrote to memory of 4272 3040 11E3.tmp 114 PID 4272 wrote to memory of 1756 4272 1270.tmp 115 PID 1756 wrote to memory of 1456 1756 131C.tmp 116 PID 1456 wrote to memory of 3324 1456 1389.tmp 117 PID 3324 wrote to memory of 4844 3324 1416.tmp 118 PID 4844 wrote to memory of 3556 4844 14B2.tmp 119 PID 3556 wrote to memory of 3044 3556 153F.tmp 120 PID 3044 wrote to memory of 4488 3044 15FA.tmp 121 PID 4488 wrote to memory of 2924 4488 16C5.tmp 122 PID 2924 wrote to memory of 5904 2924 1781.tmp 123 PID 5904 wrote to memory of 1444 5904 17EE.tmp 124 PID 1444 wrote to memory of 4788 1444 188A.tmp 125 PID 4788 wrote to memory of 1612 4788 18E8.tmp 126 PID 1612 wrote to memory of 4968 1612 1956.tmp 127 PID 4968 wrote to memory of 2344 4968 19C3.tmp 128 PID 2344 wrote to memory of 3520 2344 1A40.tmp 129 PID 3520 wrote to memory of 1476 3520 1ABD.tmp 130 PID 1476 wrote to memory of 3764 1476 1B2A.tmp 131 PID 3764 wrote to memory of 1928 3764 1BA7.tmp 132 PID 1928 wrote to memory of 4832 1928 1C24.tmp 133 PID 4832 wrote to memory of 5628 4832 1CB1.tmp 134 PID 5628 wrote to memory of 1696 5628 1D1E.tmp 135 PID 1696 wrote to memory of 1380 1696 1D9B.tmp 136 PID 1380 wrote to memory of 1000 1380 1E28.tmp 137 PID 1000 wrote to memory of 3908 1000 1EB5.tmp 138 PID 3908 wrote to memory of 1940 3908 1F51.tmp 139 PID 1940 wrote to memory of 712 1940 1FCE.tmp 140 PID 712 wrote to memory of 1820 712 203B.tmp 141 PID 1820 wrote to memory of 3068 1820 20D7.tmp 142 PID 3068 wrote to memory of 2304 3068 2174.tmp 143 PID 2304 wrote to memory of 1344 2304 2200.tmp 144 PID 1344 wrote to memory of 5008 1344 227D.tmp 145 PID 5008 wrote to memory of 6044 5008 230A.tmp 146 PID 6044 wrote to memory of 5948 6044 2377.tmp 147 PID 5948 wrote to memory of 1628 5948 23F4.tmp 148 PID 1628 wrote to memory of 1616 1628 2462.tmp 149 PID 1616 wrote to memory of 3720 1616 24EE.tmp 150 PID 3720 wrote to memory of 760 3720 258B.tmp 151 PID 760 wrote to memory of 5696 760 2617.tmp 152 PID 5696 wrote to memory of 4064 5696 2694.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_a2f1724d7e202718629bd1b5e4ce9cfd_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a2f1724d7e202718629bd1b5e4ce9cfd_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\63B.tmp"C:\Users\Admin\AppData\Local\Temp\63B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\89C.tmp"C:\Users\Admin\AppData\Local\Temp\89C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\F63.tmp"C:\Users\Admin\AppData\Local\Temp\F63.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\11E3.tmp"C:\Users\Admin\AppData\Local\Temp\11E3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1270.tmp"C:\Users\Admin\AppData\Local\Temp\1270.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\153F.tmp"C:\Users\Admin\AppData\Local\Temp\153F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\15FA.tmp"C:\Users\Admin\AppData\Local\Temp\15FA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\16C5.tmp"C:\Users\Admin\AppData\Local\Temp\16C5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\1781.tmp"C:\Users\Admin\AppData\Local\Temp\1781.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\17EE.tmp"C:\Users\Admin\AppData\Local\Temp\17EE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\188A.tmp"C:\Users\Admin\AppData\Local\Temp\188A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1956.tmp"C:\Users\Admin\AppData\Local\Temp\1956.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\19C3.tmp"C:\Users\Admin\AppData\Local\Temp\19C3.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\1A40.tmp"C:\Users\Admin\AppData\Local\Temp\1A40.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1E28.tmp"C:\Users\Admin\AppData\Local\Temp\1E28.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\203B.tmp"C:\Users\Admin\AppData\Local\Temp\203B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2174.tmp"C:\Users\Admin\AppData\Local\Temp\2174.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\227D.tmp"C:\Users\Admin\AppData\Local\Temp\227D.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\23F4.tmp"C:\Users\Admin\AppData\Local\Temp\23F4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\258B.tmp"C:\Users\Admin\AppData\Local\Temp\258B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\2711.tmp"C:\Users\Admin\AppData\Local\Temp\2711.tmp"65⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\278E.tmp"C:\Users\Admin\AppData\Local\Temp\278E.tmp"66⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\280B.tmp"C:\Users\Admin\AppData\Local\Temp\280B.tmp"67⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2888.tmp"C:\Users\Admin\AppData\Local\Temp\2888.tmp"68⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\2905.tmp"C:\Users\Admin\AppData\Local\Temp\2905.tmp"69⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2992.tmp"C:\Users\Admin\AppData\Local\Temp\2992.tmp"70⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"71⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"72⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2B57.tmp"C:\Users\Admin\AppData\Local\Temp\2B57.tmp"73⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"74⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2C61.tmp"C:\Users\Admin\AppData\Local\Temp\2C61.tmp"75⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"76⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"77⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"78⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\2E35.tmp"C:\Users\Admin\AppData\Local\Temp\2E35.tmp"79⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\2EB2.tmp"C:\Users\Admin\AppData\Local\Temp\2EB2.tmp"80⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"82⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"83⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\30D5.tmp"C:\Users\Admin\AppData\Local\Temp\30D5.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3162.tmp"C:\Users\Admin\AppData\Local\Temp\3162.tmp"85⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\31CF.tmp"C:\Users\Admin\AppData\Local\Temp\31CF.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\324C.tmp"C:\Users\Admin\AppData\Local\Temp\324C.tmp"87⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\32D9.tmp"C:\Users\Admin\AppData\Local\Temp\32D9.tmp"88⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\3337.tmp"C:\Users\Admin\AppData\Local\Temp\3337.tmp"89⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\33B4.tmp"C:\Users\Admin\AppData\Local\Temp\33B4.tmp"90⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\3431.tmp"C:\Users\Admin\AppData\Local\Temp\3431.tmp"91⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\349E.tmp"C:\Users\Admin\AppData\Local\Temp\349E.tmp"92⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\351B.tmp"C:\Users\Admin\AppData\Local\Temp\351B.tmp"93⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3625.tmp"C:\Users\Admin\AppData\Local\Temp\3625.tmp"95⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3692.tmp"C:\Users\Admin\AppData\Local\Temp\3692.tmp"96⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\371F.tmp"C:\Users\Admin\AppData\Local\Temp\371F.tmp"97⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\37AB.tmp"C:\Users\Admin\AppData\Local\Temp\37AB.tmp"98⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\3819.tmp"C:\Users\Admin\AppData\Local\Temp\3819.tmp"99⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\3886.tmp"C:\Users\Admin\AppData\Local\Temp\3886.tmp"100⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\38F3.tmp"C:\Users\Admin\AppData\Local\Temp\38F3.tmp"101⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\3961.tmp"C:\Users\Admin\AppData\Local\Temp\3961.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\39BE.tmp"C:\Users\Admin\AppData\Local\Temp\39BE.tmp"103⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\3A2C.tmp"C:\Users\Admin\AppData\Local\Temp\3A2C.tmp"104⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"105⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\3B35.tmp"C:\Users\Admin\AppData\Local\Temp\3B35.tmp"106⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\3BB2.tmp"C:\Users\Admin\AppData\Local\Temp\3BB2.tmp"107⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3C20.tmp"C:\Users\Admin\AppData\Local\Temp\3C20.tmp"108⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\3C9D.tmp"C:\Users\Admin\AppData\Local\Temp\3C9D.tmp"109⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\3D0A.tmp"C:\Users\Admin\AppData\Local\Temp\3D0A.tmp"110⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\3D78.tmp"C:\Users\Admin\AppData\Local\Temp\3D78.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"112⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\3E52.tmp"C:\Users\Admin\AppData\Local\Temp\3E52.tmp"113⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\3EC0.tmp"C:\Users\Admin\AppData\Local\Temp\3EC0.tmp"114⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"115⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3FC9.tmp"C:\Users\Admin\AppData\Local\Temp\3FC9.tmp"116⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4066.tmp"C:\Users\Admin\AppData\Local\Temp\4066.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\40F2.tmp"C:\Users\Admin\AppData\Local\Temp\40F2.tmp"118⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4160.tmp"C:\Users\Admin\AppData\Local\Temp\4160.tmp"119⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\41FC.tmp"C:\Users\Admin\AppData\Local\Temp\41FC.tmp"120⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\4288.tmp"C:\Users\Admin\AppData\Local\Temp\4288.tmp"121⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\42F6.tmp"C:\Users\Admin\AppData\Local\Temp\42F6.tmp"122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-