Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-ee7tkacf89
- SHA256 db33baf49716223e3c39fee8479360adb341ea073db8bb5c77b654e580fdc343
- MD5 e081c7b4608ce86c53d7c7891ea85345
- SHA1 83377acb06efe62850c85011945d18320222dac5
- SHA512 5a67acb6d074449019c93a8966217cf58619612383ff43ead6952f99c2734e8c3014dae26420a6212e49230b9fe7c53afb2b2b5d4711f71fbeac88bfd1e59b1b
- SSDEEP 12288:wU5rCOTeiD5qDiSMxD4CvWGU6xz/kbNZ+3/v+I9hUG2VA:wUQOJD5+iSMxD4Cvw6x4NGEA
- TLSH T1ADE4D02177D88532E5F7037859B5E6614D7EBD32AB22D6CF2F8015AE0A71BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3040 73C4.tmp 976 74BE.tmp 4288 75E7.tmp 4940 7664.tmp 1644 78B5.tmp 4660 79DE.tmp 948 7A6B.tmp 3424 7BD2.tmp 3096 7CDC.tmp 3856 7DB7.tmp 3696 7EB1.tmp 3508 7F5C.tmp 428 8018.tmp 1884 80D3.tmp 220 81AE.tmp 2776 82A8.tmp 4400 8393.tmp 3572 84AC.tmp 972 8596.tmp 3904 8690.tmp 1856 874C.tmp 956 87F8.tmp 4968 88A3.tmp 4296 899D.tmp 2568 8AA7.tmp 3356 8BD0.tmp 1816 8C9B.tmp 2644 8DD4.tmp 1940 8E9F.tmp 3232 8F6A.tmp 4896 9064.tmp 5008 911F.tmp 2384 917D.tmp 5040 91DB.tmp 4316 9296.tmp 360 92E4.tmp 2656 9381.tmp 4272 941D.tmp 2492 94B9.tmp 1932 9546.tmp 4596 95E2.tmp 3412 967E.tmp 4256 96FB.tmp 5096 9778.tmp 3472 9863.tmp 4100 990F.tmp 4152 99BA.tmp 3216 9A37.tmp 1780 9AA5.tmp 2220 9B03.tmp 204 9B51.tmp 1316 9BAE.tmp 2788 9C1C.tmp 2444 9C89.tmp 700 9CF7.tmp 4220 9D74.tmp 632 9DF1.tmp 2268 9E5E.tmp 1964 9ECB.tmp 3104 9F29.tmp 4732 9F96.tmp 4176 9FF4.tmp 4956 A052.tmp 1916 A0BF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B79E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B14A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 167C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 899D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 941D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FA6.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 3040 2040 2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe 86 PID 3040 wrote to memory of 976 3040 73C4.tmp 87 PID 976 wrote to memory of 4288 976 74BE.tmp 88 PID 4288 wrote to memory of 4940 4288 75E7.tmp 89 PID 4940 wrote to memory of 1644 4940 7664.tmp 90 PID 1644 wrote to memory of 4660 1644 78B5.tmp 91 PID 4660 wrote to memory of 948 4660 79DE.tmp 92 PID 948 wrote to memory of 3424 948 7A6B.tmp 94 PID 3424 wrote to memory of 3096 3424 7BD2.tmp 95 PID 3096 wrote to memory of 3856 3096 7CDC.tmp 96 PID 3856 wrote to memory of 3696 3856 7DB7.tmp 97 PID 3696 wrote to memory of 3508 3696 7EB1.tmp 98 PID 3508 wrote to memory of 428 3508 7F5C.tmp 99 PID 428 wrote to memory of 1884 428 8018.tmp 100 PID 1884 wrote to memory of 220 1884 80D3.tmp 101 PID 220 wrote to memory of 2776 220 81AE.tmp 102 PID 2776 wrote to memory of 4400 2776 82A8.tmp 103 PID 4400 wrote to memory of 3572 4400 8393.tmp 104 PID 3572 wrote to memory of 972 3572 84AC.tmp 105 PID 972 wrote to memory of 3904 972 8596.tmp 106 PID 3904 wrote to memory of 1856 3904 8690.tmp 107 PID 1856 wrote to memory of 956 1856 874C.tmp 110 PID 956 wrote to memory of 4968 956 87F8.tmp 111 PID 4968 wrote to memory of 4296 4968 88A3.tmp 112 PID 4296 wrote to memory of 2568 4296 899D.tmp 113 PID 2568 wrote to memory of 3356 2568 8AA7.tmp 114 PID 3356 wrote to memory of 1816 3356 8BD0.tmp 116 PID 1816 wrote to memory of 2644 1816 8C9B.tmp 118 PID 2644 wrote to memory of 1940 2644 8DD4.tmp 120 PID 1940 wrote to memory of 3232 1940 8E9F.tmp 121 PID 3232 wrote to memory of 4896 3232 8F6A.tmp 122 PID 4896 wrote to memory of 5008 4896 9064.tmp 123 PID 5008 wrote to memory of 2384 5008 911F.tmp 124 PID 2384 wrote to memory of 5040 2384 917D.tmp 125 PID 5040 wrote to memory of 4316 5040 91DB.tmp 126 PID 4316 wrote to memory of 360 4316 9296.tmp 127 PID 360 wrote to memory of 2656 360 92E4.tmp 128 PID 2656 wrote to memory of 4272 2656 9381.tmp 129 PID 4272 wrote to memory of 2492 4272 941D.tmp 130 PID 2492 wrote to memory of 1932 2492 94B9.tmp 131 PID 1932 wrote to memory of 4596 1932 9546.tmp 132 PID 4596 wrote to memory of 3412 4596 95E2.tmp 133 PID 3412 wrote to memory of 4256 3412 967E.tmp 134 PID 4256 wrote to memory of 5096 4256 96FB.tmp 135 PID 5096 wrote to memory of 3472 5096 9778.tmp 137 PID 3472 wrote to memory of 4100 3472 9863.tmp 138 PID 4100 wrote to memory of 4152 4100 990F.tmp 139 PID 4152 wrote to memory of 3216 4152 99BA.tmp 140 PID 3216 wrote to memory of 1780 3216 9A37.tmp 141 PID 1780 wrote to memory of 2220 1780 9AA5.tmp 142 PID 2220 wrote to memory of 204 2220 9B03.tmp 143 PID 204 wrote to memory of 1316 204 9B51.tmp 144 PID 1316 wrote to memory of 2788 1316 9BAE.tmp 145 PID 2788 wrote to memory of 2444 2788 9C1C.tmp 146 PID 2444 wrote to memory of 700 2444 9C89.tmp 147 PID 700 wrote to memory of 4220 700 9CF7.tmp 148 PID 4220 wrote to memory of 632 4220 9D74.tmp 149 PID 632 wrote to memory of 2268 632 9DF1.tmp 150 PID 2268 wrote to memory of 1964 2268 9E5E.tmp 151 PID 1964 wrote to memory of 3104 1964 9ECB.tmp 152 PID 3104 wrote to memory of 4732 3104 9F29.tmp 153 PID 4732 wrote to memory of 4176 4732 9F96.tmp 154 PID 4176 wrote to memory of 4956 4176 9FF4.tmp 155 PID 4956 wrote to memory of 1916 4956 A052.tmp 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\8690.tmp"C:\Users\Admin\AppData\Local\Temp\8690.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\91DB.tmp"C:\Users\Admin\AppData\Local\Temp\91DB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\9381.tmp"C:\Users\Admin\AppData\Local\Temp\9381.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\941D.tmp"C:\Users\Admin\AppData\Local\Temp\941D.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\95E2.tmp"C:\Users\Admin\AppData\Local\Temp\95E2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\967E.tmp"C:\Users\Admin\AppData\Local\Temp\967E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\96FB.tmp"C:\Users\Admin\AppData\Local\Temp\96FB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\9778.tmp"C:\Users\Admin\AppData\Local\Temp\9778.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\9863.tmp"C:\Users\Admin\AppData\Local\Temp\9863.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9F29.tmp"C:\Users\Admin\AppData\Local\Temp\9F29.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\9F96.tmp"C:\Users\Admin\AppData\Local\Temp\9F96.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"65⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A17B.tmp"C:\Users\Admin\AppData\Local\Temp\A17B.tmp"67⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"68⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\A236.tmp"C:\Users\Admin\AppData\Local\Temp\A236.tmp"69⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\A284.tmp"C:\Users\Admin\AppData\Local\Temp\A284.tmp"70⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"71⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\A340.tmp"C:\Users\Admin\AppData\Local\Temp\A340.tmp"72⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"73⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"74⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"75⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\A488.tmp"C:\Users\Admin\AppData\Local\Temp\A488.tmp"76⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"77⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"78⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"79⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"80⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"81⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"82⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"83⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"84⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"85⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"86⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"87⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"88⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\A989.tmp"C:\Users\Admin\AppData\Local\Temp\A989.tmp"90⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"91⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\AA26.tmp"C:\Users\Admin\AppData\Local\Temp\AA26.tmp"92⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"93⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"94⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\AB10.tmp"C:\Users\Admin\AppData\Local\Temp\AB10.tmp"95⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"96⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"97⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"98⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"99⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\AC97.tmp"C:\Users\Admin\AppData\Local\Temp\AC97.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"101⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\AD33.tmp"C:\Users\Admin\AppData\Local\Temp\AD33.tmp"102⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\AD81.tmp"C:\Users\Admin\AppData\Local\Temp\AD81.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"104⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\AE2D.tmp"C:\Users\Admin\AppData\Local\Temp\AE2D.tmp"105⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"106⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"107⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\AF46.tmp"C:\Users\Admin\AppData\Local\Temp\AF46.tmp"108⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"109⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"110⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\B050.tmp"C:\Users\Admin\AppData\Local\Temp\B050.tmp"111⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\B09E.tmp"C:\Users\Admin\AppData\Local\Temp\B09E.tmp"112⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"113⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B14A.tmp"C:\Users\Admin\AppData\Local\Temp\B14A.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"115⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"116⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"117⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"118⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B30F.tmp"C:\Users\Admin\AppData\Local\Temp\B30F.tmp"119⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\B35D.tmp"C:\Users\Admin\AppData\Local\Temp\B35D.tmp"120⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"121⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-