Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 17:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_eac84753073294321e29f2dae8947404_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_eac84753073294321e29f2dae8947404_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_eac84753073294321e29f2dae8947404_elex_mafia_stealc_tofsee.exe
- Size 712KB
- Sample260804-v8bafstvhs
- SHA256 301e4a86c3912941d0303373bb96e9bb916c9985c2a657c851550fe2fd4fe87d
- MD5 eac84753073294321e29f2dae8947404
- SHA1 2a945b908ec8cd19973ff106b9d512464c30c65c
- SHA512 6619ecc77003c49ad0d2f06357604d4f04a704442e54d49fbb01c91484b15f998c92ab8457d928758f8e41de3b1a7d9dfb527166a4c6c1848b92718bad84ce45
- SSDEEP 12288:FU5rCOTeiDtIAtOYSZrpZc9pG9u5QwNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzC:FUQOJDtIAtuVpZcXG9+JNnCvq5TJLCvc
- TLSH T1EDF4B02FB2450372D2C203B2274BDAD2BB2E6975137A95D22568802D1377FB8937B3D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3628 702A.tmp 1276 70E5.tmp 3596 7191.tmp 1584 727C.tmp 3592 72E9.tmp 2564 73E3.tmp 1512 7470.tmp 3632 753B.tmp 1100 75F6.tmp 1684 76A2.tmp 5100 777D.tmp 3980 77FA.tmp 2128 7896.tmp 4636 7971.tmp 3364 7A3C.tmp 2968 7AD8.tmp 2396 7B74.tmp 4500 7C01.tmp 828 7CBD.tmp 4868 7D68.tmp 3076 7E14.tmp 4704 7EC0.tmp 1504 7F6C.tmp 1988 8056.tmp 788 8141.tmp 1004 81ED.tmp 4984 8299.tmp 3156 8335.tmp 4124 83B2.tmp 436 842F.tmp 3872 8519.tmp 4344 85E4.tmp 2760 86AF.tmp 2060 86FE.tmp 1928 874C.tmp 1244 879A.tmp 4924 87E8.tmp 3440 8836.tmp 948 8894.tmp 4976 88E2.tmp 3688 8930.tmp 3868 897E.tmp 4476 89CC.tmp 2240 8A2A.tmp 4340 8A78.tmp 1228 8AC6.tmp 1744 8B14.tmp 3648 8B63.tmp 3424 8BB1.tmp 3752 8BFF.tmp 2888 8C4D.tmp 3916 8C9B.tmp 1588 8D08.tmp 3636 8D57.tmp 3576 8DC4.tmp 1724 8E12.tmp 3276 8E60.tmp 2180 8ECE.tmp 1916 8F3B.tmp 3520 8FA8.tmp 3204 8FF6.tmp 4828 9045.tmp 1528 90A2.tmp 3404 9100.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C678.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A44A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A544.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 212A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 874C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 981F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 727C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CCC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4336 wrote to memory of 3628 4336 2026-08-04_eac84753073294321e29f2dae8947404_elex_mafia_stealc_tofsee.exe 85 PID 3628 wrote to memory of 1276 3628 702A.tmp 86 PID 1276 wrote to memory of 3596 1276 70E5.tmp 87 PID 3596 wrote to memory of 1584 3596 7191.tmp 88 PID 1584 wrote to memory of 3592 1584 727C.tmp 89 PID 3592 wrote to memory of 2564 3592 72E9.tmp 90 PID 2564 wrote to memory of 1512 2564 73E3.tmp 91 PID 1512 wrote to memory of 3632 1512 7470.tmp 92 PID 3632 wrote to memory of 1100 3632 753B.tmp 93 PID 1100 wrote to memory of 1684 1100 75F6.tmp 94 PID 1684 wrote to memory of 5100 1684 76A2.tmp 95 PID 5100 wrote to memory of 3980 5100 777D.tmp 96 PID 3980 wrote to memory of 2128 3980 77FA.tmp 97 PID 2128 wrote to memory of 4636 2128 7896.tmp 98 PID 4636 wrote to memory of 3364 4636 7971.tmp 99 PID 3364 wrote to memory of 2968 3364 7A3C.tmp 102 PID 2968 wrote to memory of 2396 2968 7AD8.tmp 103 PID 2396 wrote to memory of 4500 2396 7B74.tmp 104 PID 4500 wrote to memory of 828 4500 7C01.tmp 105 PID 828 wrote to memory of 4868 828 7CBD.tmp 106 PID 4868 wrote to memory of 3076 4868 7D68.tmp 107 PID 3076 wrote to memory of 4704 3076 7E14.tmp 108 PID 4704 wrote to memory of 1504 4704 7EC0.tmp 110 PID 1504 wrote to memory of 1988 1504 7F6C.tmp 112 PID 1988 wrote to memory of 788 1988 8056.tmp 113 PID 788 wrote to memory of 1004 788 8141.tmp 114 PID 1004 wrote to memory of 4984 1004 81ED.tmp 115 PID 4984 wrote to memory of 3156 4984 8299.tmp 116 PID 3156 wrote to memory of 4124 3156 8335.tmp 117 PID 4124 wrote to memory of 436 4124 83B2.tmp 118 PID 436 wrote to memory of 3872 436 842F.tmp 119 PID 3872 wrote to memory of 4344 3872 8519.tmp 120 PID 4344 wrote to memory of 2760 4344 85E4.tmp 121 PID 2760 wrote to memory of 2060 2760 86AF.tmp 122 PID 2060 wrote to memory of 1928 2060 86FE.tmp 123 PID 1928 wrote to memory of 1244 1928 874C.tmp 124 PID 1244 wrote to memory of 4924 1244 879A.tmp 125 PID 4924 wrote to memory of 3440 4924 87E8.tmp 126 PID 3440 wrote to memory of 948 3440 8836.tmp 127 PID 948 wrote to memory of 4976 948 8894.tmp 128 PID 4976 wrote to memory of 3688 4976 88E2.tmp 129 PID 3688 wrote to memory of 3868 3688 8930.tmp 130 PID 3868 wrote to memory of 4476 3868 897E.tmp 131 PID 4476 wrote to memory of 2240 4476 89CC.tmp 132 PID 2240 wrote to memory of 4340 2240 8A2A.tmp 133 PID 4340 wrote to memory of 1228 4340 8A78.tmp 135 PID 1228 wrote to memory of 1744 1228 8AC6.tmp 136 PID 1744 wrote to memory of 3648 1744 8B14.tmp 137 PID 3648 wrote to memory of 3424 3648 8B63.tmp 138 PID 3424 wrote to memory of 3752 3424 8BB1.tmp 139 PID 3752 wrote to memory of 2888 3752 8BFF.tmp 140 PID 2888 wrote to memory of 3916 2888 8C4D.tmp 141 PID 3916 wrote to memory of 1588 3916 8C9B.tmp 142 PID 1588 wrote to memory of 3636 1588 8D08.tmp 143 PID 3636 wrote to memory of 3576 3636 8D57.tmp 144 PID 3576 wrote to memory of 1724 3576 8DC4.tmp 145 PID 1724 wrote to memory of 3276 1724 8E12.tmp 146 PID 3276 wrote to memory of 2180 3276 8E60.tmp 147 PID 2180 wrote to memory of 1916 2180 8ECE.tmp 148 PID 1916 wrote to memory of 3520 1916 8F3B.tmp 149 PID 3520 wrote to memory of 3204 3520 8FA8.tmp 150 PID 3204 wrote to memory of 4828 3204 8FF6.tmp 151 PID 4828 wrote to memory of 1528 4828 9045.tmp 152 PID 1528 wrote to memory of 3404 1528 90A2.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_eac84753073294321e29f2dae8947404_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_eac84753073294321e29f2dae8947404_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\7971.tmp"C:\Users\Admin\AppData\Local\Temp\7971.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\7C01.tmp"C:\Users\Admin\AppData\Local\Temp\7C01.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\7D68.tmp"C:\Users\Admin\AppData\Local\Temp\7D68.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\7E14.tmp"C:\Users\Admin\AppData\Local\Temp\7E14.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\83B2.tmp"C:\Users\Admin\AppData\Local\Temp\83B2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\842F.tmp"C:\Users\Admin\AppData\Local\Temp\842F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\88E2.tmp"C:\Users\Admin\AppData\Local\Temp\88E2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8930.tmp"C:\Users\Admin\AppData\Local\Temp\8930.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\897E.tmp"C:\Users\Admin\AppData\Local\Temp\897E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\89CC.tmp"C:\Users\Admin\AppData\Local\Temp\89CC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8B14.tmp"C:\Users\Admin\AppData\Local\Temp\8B14.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\9045.tmp"C:\Users\Admin\AppData\Local\Temp\9045.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"65⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"66⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"67⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\9219.tmp"C:\Users\Admin\AppData\Local\Temp\9219.tmp"68⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\9267.tmp"C:\Users\Admin\AppData\Local\Temp\9267.tmp"69⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\92B6.tmp"C:\Users\Admin\AppData\Local\Temp\92B6.tmp"70⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"71⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"72⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"73⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"74⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\946B.tmp"C:\Users\Admin\AppData\Local\Temp\946B.tmp"75⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\94C9.tmp"C:\Users\Admin\AppData\Local\Temp\94C9.tmp"76⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\9536.tmp"C:\Users\Admin\AppData\Local\Temp\9536.tmp"77⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\9584.tmp"C:\Users\Admin\AppData\Local\Temp\9584.tmp"78⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\95D2.tmp"C:\Users\Admin\AppData\Local\Temp\95D2.tmp"79⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9630.tmp"C:\Users\Admin\AppData\Local\Temp\9630.tmp"80⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\967E.tmp"C:\Users\Admin\AppData\Local\Temp\967E.tmp"81⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\96CC.tmp"C:\Users\Admin\AppData\Local\Temp\96CC.tmp"82⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\973A.tmp"C:\Users\Admin\AppData\Local\Temp\973A.tmp"83⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"84⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"85⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9843.tmp"C:\Users\Admin\AppData\Local\Temp\9843.tmp"86⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"87⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\98E0.tmp"C:\Users\Admin\AppData\Local\Temp\98E0.tmp"88⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\992E.tmp"C:\Users\Admin\AppData\Local\Temp\992E.tmp"89⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\998C.tmp"C:\Users\Admin\AppData\Local\Temp\998C.tmp"90⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\99DA.tmp"C:\Users\Admin\AppData\Local\Temp\99DA.tmp"91⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"92⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"93⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"94⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"95⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"96⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"97⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"98⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"99⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"100⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"101⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"102⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"103⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"104⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"105⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\9F19.tmp"C:\Users\Admin\AppData\Local\Temp\9F19.tmp"106⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\9F87.tmp"C:\Users\Admin\AppData\Local\Temp\9F87.tmp"107⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"108⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\A042.tmp"C:\Users\Admin\AppData\Local\Temp\A042.tmp"109⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A090.tmp"C:\Users\Admin\AppData\Local\Temp\A090.tmp"110⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"111⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"112⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"113⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\A217.tmp"C:\Users\Admin\AppData\Local\Temp\A217.tmp"114⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\A284.tmp"C:\Users\Admin\AppData\Local\Temp\A284.tmp"115⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"116⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"117⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"118⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"119⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\A44A.tmp"C:\Users\Admin\AppData\Local\Temp\A44A.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"121⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"122⤵PID:5032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-