Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_02ca79690dd6456a87fdfb3d8cac428d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_02ca79690dd6456a87fdfb3d8cac428d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_02ca79690dd6456a87fdfb3d8cac428d_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260804-vcvdfsvgpf
- SHA256 4b176c9769b96382681a8059335dbdac88484c756d74ae72f4e85301f80baabe
- MD5 02ca79690dd6456a87fdfb3d8cac428d
- SHA1 10236466f8e19ffd51398ada4ce58747eaf60f5f
- SHA512 b8ea2f6e3b8c002f6162c9fea563bb6bdc7e70f39e4bb6e0d0345b721045709c40b0ef9680ad6447af72a205fffe5955a21a24d28b19299e4a972f713cd9a4c8
- SSDEEP 12288:wU5rCOTeiDCG4qVM7+I17gVVLSCgZXrN3V4cONZ+3/v+I9hUG2VA:wUQOJDNg7+I17sLtYv4cONGEA
- TLSH T132E4D02173D88532E6FB037859B5E6554E7EBD326722D6DF2F8016AE09B1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3884 5AEC.tmp 3472 5BF6.tmp 4892 5CC1.tmp 2204 5DAB.tmp 4656 5EB5.tmp 1380 5FAF.tmp 1696 60B9.tmp 1784 6193.tmp 4768 629D.tmp 4756 63C6.tmp 4244 6491.tmp 3300 656C.tmp 1368 6666.tmp 2492 678F.tmp 4668 6869.tmp 4684 6963.tmp 4336 6A4E.tmp 4196 6B48.tmp 3252 6C42.tmp 1128 6D1D.tmp 4836 6E36.tmp 4052 6F30.tmp 2096 700B.tmp 592 70E5.tmp 3012 720E.tmp 5024 72E9.tmp 4824 73C4.tmp 2236 74BE.tmp 4676 75E7.tmp 512 76D1.tmp 2156 77BB.tmp 2244 7896.tmp 4452 7980.tmp 4164 79FD.tmp 1388 7A8A.tmp 3728 7B17.tmp 3656 7BC3.tmp 4576 7C4F.tmp 4388 7D0B.tmp 5112 7DB7.tmp 3724 7E43.tmp 832 7F3D.tmp 3464 7FCA.tmp 4932 8056.tmp 4508 80D3.tmp 2240 8141.tmp 2404 81DD.tmp 4112 8299.tmp 4728 8316.tmp 3940 8373.tmp 4512 83C1.tmp 4596 8410.tmp 4560 846D.tmp 4156 84CB.tmp 4140 8519.tmp 4764 8567.tmp 3260 85B5.tmp 3648 8604.tmp 4088 8652.tmp 1728 86AF.tmp 1236 86FE.tmp 5084 876B.tmp 2788 87C9.tmp 1836 8836.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A88F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 618F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4396 wrote to memory of 3884 4396 2026-08-04_02ca79690dd6456a87fdfb3d8cac428d_elex_mafia_stealc_tofsee.exe 84 PID 3884 wrote to memory of 3472 3884 5AEC.tmp 85 PID 3472 wrote to memory of 4892 3472 5BF6.tmp 86 PID 4892 wrote to memory of 2204 4892 5CC1.tmp 87 PID 2204 wrote to memory of 4656 2204 5DAB.tmp 88 PID 4656 wrote to memory of 1380 4656 5EB5.tmp 89 PID 1380 wrote to memory of 1696 1380 5FAF.tmp 90 PID 1696 wrote to memory of 1784 1696 60B9.tmp 91 PID 1784 wrote to memory of 4768 1784 6193.tmp 92 PID 4768 wrote to memory of 4756 4768 629D.tmp 93 PID 4756 wrote to memory of 4244 4756 63C6.tmp 94 PID 4244 wrote to memory of 3300 4244 6491.tmp 95 PID 3300 wrote to memory of 1368 3300 656C.tmp 96 PID 1368 wrote to memory of 2492 1368 6666.tmp 97 PID 2492 wrote to memory of 4668 2492 678F.tmp 98 PID 4668 wrote to memory of 4684 4668 6869.tmp 101 PID 4684 wrote to memory of 4336 4684 6963.tmp 102 PID 4336 wrote to memory of 4196 4336 6A4E.tmp 103 PID 4196 wrote to memory of 3252 4196 6B48.tmp 104 PID 3252 wrote to memory of 1128 3252 6C42.tmp 105 PID 1128 wrote to memory of 4836 1128 6D1D.tmp 109 PID 4836 wrote to memory of 4052 4836 6E36.tmp 110 PID 4052 wrote to memory of 2096 4052 6F30.tmp 111 PID 2096 wrote to memory of 592 2096 700B.tmp 114 PID 592 wrote to memory of 3012 592 70E5.tmp 115 PID 3012 wrote to memory of 5024 3012 720E.tmp 116 PID 5024 wrote to memory of 4824 5024 72E9.tmp 118 PID 4824 wrote to memory of 2236 4824 73C4.tmp 119 PID 2236 wrote to memory of 4676 2236 74BE.tmp 120 PID 4676 wrote to memory of 512 4676 75E7.tmp 121 PID 512 wrote to memory of 2156 512 76D1.tmp 122 PID 2156 wrote to memory of 2244 2156 77BB.tmp 123 PID 2244 wrote to memory of 4452 2244 7896.tmp 125 PID 4452 wrote to memory of 4164 4452 7980.tmp 126 PID 4164 wrote to memory of 1388 4164 79FD.tmp 127 PID 1388 wrote to memory of 3728 1388 7A8A.tmp 128 PID 3728 wrote to memory of 3656 3728 7B17.tmp 129 PID 3656 wrote to memory of 4576 3656 7BC3.tmp 130 PID 4576 wrote to memory of 4388 4576 7C4F.tmp 131 PID 4388 wrote to memory of 5112 4388 7D0B.tmp 132 PID 5112 wrote to memory of 3724 5112 7DB7.tmp 133 PID 3724 wrote to memory of 832 3724 7E43.tmp 134 PID 832 wrote to memory of 3464 832 7F3D.tmp 135 PID 3464 wrote to memory of 4932 3464 7FCA.tmp 136 PID 4932 wrote to memory of 4508 4932 8056.tmp 137 PID 4508 wrote to memory of 2240 4508 80D3.tmp 138 PID 2240 wrote to memory of 2404 2240 8141.tmp 139 PID 2404 wrote to memory of 4112 2404 81DD.tmp 140 PID 4112 wrote to memory of 4728 4112 8299.tmp 141 PID 4728 wrote to memory of 3940 4728 8316.tmp 142 PID 3940 wrote to memory of 4512 3940 8373.tmp 143 PID 4512 wrote to memory of 4596 4512 83C1.tmp 144 PID 4596 wrote to memory of 4560 4596 8410.tmp 145 PID 4560 wrote to memory of 4156 4560 846D.tmp 146 PID 4156 wrote to memory of 4140 4156 84CB.tmp 147 PID 4140 wrote to memory of 4764 4140 8519.tmp 150 PID 4764 wrote to memory of 3260 4764 8567.tmp 151 PID 3260 wrote to memory of 3648 3260 85B5.tmp 152 PID 3648 wrote to memory of 4088 3648 8604.tmp 153 PID 4088 wrote to memory of 1728 4088 8652.tmp 154 PID 1728 wrote to memory of 1236 1728 86AF.tmp 155 PID 1236 wrote to memory of 5084 1236 86FE.tmp 156 PID 5084 wrote to memory of 2788 5084 876B.tmp 157 PID 2788 wrote to memory of 1836 2788 87C9.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_02ca79690dd6456a87fdfb3d8cac428d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_02ca79690dd6456a87fdfb3d8cac428d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\6666.tmp"C:\Users\Admin\AppData\Local\Temp\6666.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\7B17.tmp"C:\Users\Admin\AppData\Local\Temp\7B17.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8604.tmp"C:\Users\Admin\AppData\Local\Temp\8604.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\876B.tmp"C:\Users\Admin\AppData\Local\Temp\876B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"65⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"66⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"67⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"68⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"69⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"70⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"71⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"72⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"73⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"74⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"75⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"78⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"79⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\8D28.tmp"C:\Users\Admin\AppData\Local\Temp\8D28.tmp"80⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"81⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"82⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"83⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"84⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"85⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"86⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"87⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"88⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"89⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"90⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\90B2.tmp"C:\Users\Admin\AppData\Local\Temp\90B2.tmp"91⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"92⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"93⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"94⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"95⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"96⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"97⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"98⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\9333.tmp"C:\Users\Admin\AppData\Local\Temp\9333.tmp"99⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"100⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"101⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\942D.tmp"C:\Users\Admin\AppData\Local\Temp\942D.tmp"102⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"103⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\94C9.tmp"C:\Users\Admin\AppData\Local\Temp\94C9.tmp"104⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9517.tmp"C:\Users\Admin\AppData\Local\Temp\9517.tmp"105⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\9575.tmp"C:\Users\Admin\AppData\Local\Temp\9575.tmp"106⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"107⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\9611.tmp"C:\Users\Admin\AppData\Local\Temp\9611.tmp"108⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\965F.tmp"C:\Users\Admin\AppData\Local\Temp\965F.tmp"109⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\96BD.tmp"C:\Users\Admin\AppData\Local\Temp\96BD.tmp"110⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"111⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"112⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"113⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"114⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"115⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\98B1.tmp"C:\Users\Admin\AppData\Local\Temp\98B1.tmp"116⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"117⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"118⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"119⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"120⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9A76.tmp"C:\Users\Admin\AppData\Local\Temp\9A76.tmp"121⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"122⤵PID:3788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-