Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 15:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_e9f552b9279d68c7cbd71f5ab8a8ee05_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_e9f552b9279d68c7cbd71f5ab8a8ee05_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_e9f552b9279d68c7cbd71f5ab8a8ee05_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260808-styfbsttc1
- SHA256 b8d2b7aac34eb298759cf3a5fbcb35b919be99001429dc941782b0e59097da32
- MD5 e9f552b9279d68c7cbd71f5ab8a8ee05
- SHA1 266a2b5922363c4f4ffec59ead69dcd7fa19542e
- SHA512 9def84064c7662cc35905426dca03a75da3ada3b627af811456a6a95b1979fab5b57e8a0b9e57479e291620d6da1752708cdaf5174867aaf9537c5fb5c1011f9
- SSDEEP 12288:NU5rCOTeij5LFzDCm6zGXzkXxCNjoD+yTZwlH:NUQOJj5LB2m6Ig+yTSlH
- TLSH T10AB4F125B684C532E69202714AD6EBB26A3F7C31572294C73B94676E2FB03E1D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2064 68B8.tmp 1892 6983.tmp 4496 6A1F.tmp 2556 6AEA.tmp 1592 6B86.tmp 2164 6C13.tmp 552 6CA0.tmp 3812 6D4B.tmp 3844 6DC8.tmp 4176 6E55.tmp 4428 6FFB.tmp 4144 7088.tmp 4864 7182.tmp 3344 722D.tmp 3460 72AA.tmp 1040 7347.tmp 1944 73D3.tmp 3144 7470.tmp 4808 74DD.tmp 3804 7589.tmp 4356 7635.tmp 1268 76D1.tmp 824 775E.tmp 2688 7829.tmp 1836 7942.tmp 4344 79DE.tmp 5108 7A7A.tmp 1236 7AF7.tmp 364 7B94.tmp 3052 7C20.tmp 1468 7CBD.tmp 2116 7D59.tmp 2584 7E14.tmp 3112 7E82.tmp 2524 7EDF.tmp 3628 7F3D.tmp 1860 7F9B.tmp 4740 7FE9.tmp 1116 8047.tmp 1620 8095.tmp 4688 80F3.tmp 1372 8141.tmp 2520 819F.tmp 4340 81ED.tmp 4880 823B.tmp 4840 8299.tmp 4924 82F6.tmp 4260 8354.tmp 1104 83A2.tmp 4576 8400.tmp 1832 844E.tmp 4952 84AC.tmp 2292 850A.tmp 4240 8567.tmp 4008 85B5.tmp 1764 8623.tmp 4056 8681.tmp 4744 86EE.tmp 984 873C.tmp 3664 878A.tmp 3596 8807.tmp 3260 8855.tmp 3964 88A3.tmp 764 8901.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D20C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 232E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 844E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 676 wrote to memory of 2064 676 2026-08-08_e9f552b9279d68c7cbd71f5ab8a8ee05_elex_mafia_stealc_tofsee.exe 87 PID 2064 wrote to memory of 1892 2064 68B8.tmp 88 PID 1892 wrote to memory of 4496 1892 6983.tmp 89 PID 4496 wrote to memory of 2556 4496 6A1F.tmp 90 PID 2556 wrote to memory of 1592 2556 6AEA.tmp 91 PID 1592 wrote to memory of 2164 1592 6B86.tmp 92 PID 2164 wrote to memory of 552 2164 6C13.tmp 93 PID 552 wrote to memory of 3812 552 6CA0.tmp 94 PID 3812 wrote to memory of 3844 3812 6D4B.tmp 95 PID 3844 wrote to memory of 4176 3844 6DC8.tmp 96 PID 4176 wrote to memory of 4428 4176 6E55.tmp 97 PID 4428 wrote to memory of 4144 4428 6FFB.tmp 98 PID 4144 wrote to memory of 4864 4144 7088.tmp 99 PID 4864 wrote to memory of 3344 4864 7182.tmp 100 PID 3344 wrote to memory of 3460 3344 722D.tmp 101 PID 3460 wrote to memory of 1040 3460 72AA.tmp 102 PID 1040 wrote to memory of 1944 1040 7347.tmp 103 PID 1944 wrote to memory of 3144 1944 73D3.tmp 104 PID 3144 wrote to memory of 4808 3144 7470.tmp 105 PID 4808 wrote to memory of 3804 4808 74DD.tmp 106 PID 3804 wrote to memory of 4356 3804 7589.tmp 107 PID 4356 wrote to memory of 1268 4356 7635.tmp 108 PID 1268 wrote to memory of 824 1268 76D1.tmp 109 PID 824 wrote to memory of 2688 824 775E.tmp 110 PID 2688 wrote to memory of 1836 2688 7829.tmp 111 PID 1836 wrote to memory of 4344 1836 7942.tmp 112 PID 4344 wrote to memory of 5108 4344 79DE.tmp 113 PID 5108 wrote to memory of 1236 5108 7A7A.tmp 114 PID 1236 wrote to memory of 364 1236 7AF7.tmp 115 PID 364 wrote to memory of 3052 364 7B94.tmp 116 PID 3052 wrote to memory of 1468 3052 7C20.tmp 119 PID 1468 wrote to memory of 2116 1468 7CBD.tmp 120 PID 2116 wrote to memory of 2584 2116 7D59.tmp 121 PID 2584 wrote to memory of 3112 2584 7E14.tmp 122 PID 3112 wrote to memory of 2524 3112 7E82.tmp 123 PID 2524 wrote to memory of 3628 2524 7EDF.tmp 124 PID 3628 wrote to memory of 1860 3628 7F3D.tmp 125 PID 1860 wrote to memory of 4740 1860 7F9B.tmp 126 PID 4740 wrote to memory of 1116 4740 7FE9.tmp 127 PID 1116 wrote to memory of 1620 1116 8047.tmp 128 PID 1620 wrote to memory of 4688 1620 8095.tmp 130 PID 4688 wrote to memory of 1372 4688 80F3.tmp 131 PID 1372 wrote to memory of 2520 1372 8141.tmp 132 PID 2520 wrote to memory of 4340 2520 819F.tmp 134 PID 4340 wrote to memory of 4880 4340 81ED.tmp 135 PID 4880 wrote to memory of 4840 4880 823B.tmp 136 PID 4840 wrote to memory of 4924 4840 8299.tmp 137 PID 4924 wrote to memory of 4260 4924 82F6.tmp 138 PID 4260 wrote to memory of 1104 4260 8354.tmp 139 PID 1104 wrote to memory of 4576 1104 83A2.tmp 140 PID 4576 wrote to memory of 1832 4576 8400.tmp 141 PID 1832 wrote to memory of 4952 1832 844E.tmp 142 PID 4952 wrote to memory of 2292 4952 84AC.tmp 143 PID 2292 wrote to memory of 4240 2292 850A.tmp 144 PID 4240 wrote to memory of 4008 4240 8567.tmp 145 PID 4008 wrote to memory of 1764 4008 85B5.tmp 146 PID 1764 wrote to memory of 4056 1764 8623.tmp 147 PID 4056 wrote to memory of 4744 4056 8681.tmp 148 PID 4744 wrote to memory of 984 4744 86EE.tmp 149 PID 984 wrote to memory of 3664 984 873C.tmp 150 PID 3664 wrote to memory of 3596 3664 878A.tmp 151 PID 3596 wrote to memory of 3260 3596 8807.tmp 152 PID 3260 wrote to memory of 3964 3260 8855.tmp 153 PID 3964 wrote to memory of 764 3964 88A3.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_e9f552b9279d68c7cbd71f5ab8a8ee05_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_e9f552b9279d68c7cbd71f5ab8a8ee05_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\7182.tmp"C:\Users\Admin\AppData\Local\Temp\7182.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\722D.tmp"C:\Users\Admin\AppData\Local\Temp\722D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\7B94.tmp"C:\Users\Admin\AppData\Local\Temp\7B94.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\7E14.tmp"C:\Users\Admin\AppData\Local\Temp\7E14.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\850A.tmp"C:\Users\Admin\AppData\Local\Temp\850A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"65⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"66⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\89CC.tmp"C:\Users\Admin\AppData\Local\Temp\89CC.tmp"67⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"68⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\8A69.tmp"C:\Users\Admin\AppData\Local\Temp\8A69.tmp"69⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"70⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\8B14.tmp"C:\Users\Admin\AppData\Local\Temp\8B14.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"72⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"73⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"74⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\8CAB.tmp"C:\Users\Admin\AppData\Local\Temp\8CAB.tmp"75⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"76⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\8D47.tmp"C:\Users\Admin\AppData\Local\Temp\8D47.tmp"77⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"78⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"79⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\8E41.tmp"C:\Users\Admin\AppData\Local\Temp\8E41.tmp"80⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"81⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"82⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"83⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8F99.tmp"C:\Users\Admin\AppData\Local\Temp\8F99.tmp"84⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"85⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"86⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"87⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"88⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"89⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"90⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\91EA.tmp"C:\Users\Admin\AppData\Local\Temp\91EA.tmp"91⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"92⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"93⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\92F4.tmp"C:\Users\Admin\AppData\Local\Temp\92F4.tmp"94⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9342.tmp"C:\Users\Admin\AppData\Local\Temp\9342.tmp"95⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"96⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"97⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\942D.tmp"C:\Users\Admin\AppData\Local\Temp\942D.tmp"98⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\948A.tmp"C:\Users\Admin\AppData\Local\Temp\948A.tmp"99⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"100⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"101⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"102⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\95F2.tmp"C:\Users\Admin\AppData\Local\Temp\95F2.tmp"103⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\965F.tmp"C:\Users\Admin\AppData\Local\Temp\965F.tmp"104⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"105⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\971B.tmp"C:\Users\Admin\AppData\Local\Temp\971B.tmp"106⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\9788.tmp"C:\Users\Admin\AppData\Local\Temp\9788.tmp"107⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\97E6.tmp"C:\Users\Admin\AppData\Local\Temp\97E6.tmp"108⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"109⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\9882.tmp"C:\Users\Admin\AppData\Local\Temp\9882.tmp"110⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\98D0.tmp"C:\Users\Admin\AppData\Local\Temp\98D0.tmp"111⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"112⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"113⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"114⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\9A47.tmp"C:\Users\Admin\AppData\Local\Temp\9A47.tmp"115⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"116⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"117⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\9B31.tmp"C:\Users\Admin\AppData\Local\Temp\9B31.tmp"118⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"119⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"120⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"121⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\9C99.tmp"C:\Users\Admin\AppData\Local\Temp\9C99.tmp"122⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-