Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260930-lecfzsts2p
- SHA256 c206b9d10cb588e0adb1e45355f25370844de7b0ec9b6a11fe01460b53a6d987
- MD5 9645d0e97c77a9641fc4f70d8d138147
- SHA1 689730bb1ef54dc76201ff713d99554e04b6a99d
- SHA512 8f7a3a962d3c941aa6538c708df7ec6d0cc6f9286b2aea61a8005135503e5f9e44a303b52c8637e2b9d7d08e99142f93b36abe90d15f0450ae914c7213c01adb
- SSDEEP 12288:NU5rCOTeijWIbDoN3qlBz4XfkgAnkmP7QTZwlH4Hp:NUQOJjWQDowQXcgAzzQTSlH4Hp
- TLSH T1C9B4F126B644C132E6D202710AE6DBE26A3FBC34572694C73B94623D2FB66E1D335347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 832 7347.tmp 4484 7431.tmp 1260 74DD.tmp 4336 75C7.tmp 816 7664.tmp 4104 770F.tmp 2332 779C.tmp 2804 7838.tmp 2908 78F4.tmp 4408 7980.tmp 872 7A4C.tmp 3776 7B17.tmp 1820 7BB3.tmp 4768 7C4F.tmp 3748 7D1A.tmp 3980 7DC6.tmp 1804 7E53.tmp 1168 7EEF.tmp 212 7F8B.tmp 4128 8056.tmp 3544 8102.tmp 5092 81ED.tmp 1792 82A8.tmp 1652 8325.tmp 1564 83A2.tmp 3604 845E.tmp 1692 8519.tmp 2612 85B5.tmp 3288 8661.tmp 4572 870D.tmp 3392 878A.tmp 1136 8817.tmp 4732 88D2.tmp 4916 8930.tmp 3564 898E.tmp 4924 8A0B.tmp 1536 8A69.tmp 1772 8AC6.tmp 4948 8B24.tmp 2828 8B82.tmp 3312 8BD0.tmp 4028 8C3D.tmp 416 8C9B.tmp 4140 8D18.tmp 2952 8D66.tmp 4424 8DF3.tmp 4624 8E51.tmp 4488 8EBE.tmp 2232 8F2B.tmp 4044 8F99.tmp 5064 8FF6.tmp 4868 9093.tmp 2860 90F0.tmp 2320 914E.tmp 876 91DB.tmp 4540 9258.tmp 2240 92D5.tmp 2368 9323.tmp 912 9390.tmp 332 93FE.tmp 5024 944C.tmp 2900 94AA.tmp 5068 9507.tmp 2264 9555.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7664.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 385C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A05D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B14A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1592.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9764.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 520 wrote to memory of 832 520 2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe 87 PID 832 wrote to memory of 4484 832 7347.tmp 88 PID 4484 wrote to memory of 1260 4484 7431.tmp 90 PID 1260 wrote to memory of 4336 1260 74DD.tmp 92 PID 4336 wrote to memory of 816 4336 75C7.tmp 93 PID 816 wrote to memory of 4104 816 7664.tmp 95 PID 4104 wrote to memory of 2332 4104 770F.tmp 96 PID 2332 wrote to memory of 2804 2332 779C.tmp 97 PID 2804 wrote to memory of 2908 2804 7838.tmp 98 PID 2908 wrote to memory of 4408 2908 78F4.tmp 99 PID 4408 wrote to memory of 872 4408 7980.tmp 100 PID 872 wrote to memory of 3776 872 7A4C.tmp 101 PID 3776 wrote to memory of 1820 3776 7B17.tmp 102 PID 1820 wrote to memory of 4768 1820 7BB3.tmp 103 PID 4768 wrote to memory of 3748 4768 7C4F.tmp 104 PID 3748 wrote to memory of 3980 3748 7D1A.tmp 105 PID 3980 wrote to memory of 1804 3980 7DC6.tmp 106 PID 1804 wrote to memory of 1168 1804 7E53.tmp 109 PID 1168 wrote to memory of 212 1168 7EEF.tmp 110 PID 212 wrote to memory of 4128 212 7F8B.tmp 111 PID 4128 wrote to memory of 3544 4128 8056.tmp 112 PID 3544 wrote to memory of 5092 3544 8102.tmp 113 PID 5092 wrote to memory of 1792 5092 81ED.tmp 114 PID 1792 wrote to memory of 1652 1792 82A8.tmp 115 PID 1652 wrote to memory of 1564 1652 8325.tmp 117 PID 1564 wrote to memory of 3604 1564 83A2.tmp 118 PID 3604 wrote to memory of 1692 3604 845E.tmp 120 PID 1692 wrote to memory of 2612 1692 8519.tmp 121 PID 2612 wrote to memory of 3288 2612 85B5.tmp 122 PID 3288 wrote to memory of 4572 3288 8661.tmp 123 PID 4572 wrote to memory of 3392 4572 870D.tmp 124 PID 3392 wrote to memory of 1136 3392 878A.tmp 125 PID 1136 wrote to memory of 4732 1136 8817.tmp 126 PID 4732 wrote to memory of 4916 4732 88D2.tmp 127 PID 4916 wrote to memory of 3564 4916 8930.tmp 128 PID 3564 wrote to memory of 4924 3564 898E.tmp 129 PID 4924 wrote to memory of 1536 4924 8A0B.tmp 130 PID 1536 wrote to memory of 1772 1536 8A69.tmp 131 PID 1772 wrote to memory of 4948 1772 8AC6.tmp 132 PID 4948 wrote to memory of 2828 4948 8B24.tmp 133 PID 2828 wrote to memory of 3312 2828 8B82.tmp 134 PID 3312 wrote to memory of 4028 3312 8BD0.tmp 135 PID 4028 wrote to memory of 416 4028 8C3D.tmp 136 PID 416 wrote to memory of 4140 416 8C9B.tmp 137 PID 4140 wrote to memory of 2952 4140 8D18.tmp 138 PID 2952 wrote to memory of 4424 2952 8D66.tmp 139 PID 4424 wrote to memory of 4624 4424 8DF3.tmp 140 PID 4624 wrote to memory of 4488 4624 8E51.tmp 141 PID 4488 wrote to memory of 2232 4488 8EBE.tmp 142 PID 2232 wrote to memory of 4044 2232 8F2B.tmp 144 PID 4044 wrote to memory of 5064 4044 8F99.tmp 145 PID 5064 wrote to memory of 4868 5064 8FF6.tmp 146 PID 4868 wrote to memory of 2860 4868 9093.tmp 147 PID 2860 wrote to memory of 2320 2860 90F0.tmp 148 PID 2320 wrote to memory of 876 2320 914E.tmp 149 PID 876 wrote to memory of 4540 876 91DB.tmp 150 PID 4540 wrote to memory of 2240 4540 9258.tmp 151 PID 2240 wrote to memory of 2368 2240 92D5.tmp 152 PID 2368 wrote to memory of 912 2368 9323.tmp 153 PID 912 wrote to memory of 332 912 9390.tmp 154 PID 332 wrote to memory of 5024 332 93FE.tmp 155 PID 5024 wrote to memory of 2900 5024 944C.tmp 156 PID 2900 wrote to memory of 5068 2900 94AA.tmp 157 PID 5068 wrote to memory of 2264 5068 9507.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_9645d0e97c77a9641fc4f70d8d138147_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\7B17.tmp"C:\Users\Admin\AppData\Local\Temp\7B17.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\7E53.tmp"C:\Users\Admin\AppData\Local\Temp\7E53.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\870D.tmp"C:\Users\Admin\AppData\Local\Temp\870D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\8817.tmp"C:\Users\Admin\AppData\Local\Temp\8817.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8930.tmp"C:\Users\Admin\AppData\Local\Temp\8930.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\898E.tmp"C:\Users\Admin\AppData\Local\Temp\898E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8A69.tmp"C:\Users\Admin\AppData\Local\Temp\8A69.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\8F2B.tmp"C:\Users\Admin\AppData\Local\Temp\8F2B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8F99.tmp"C:\Users\Admin\AppData\Local\Temp\8F99.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\9093.tmp"C:\Users\Admin\AppData\Local\Temp\9093.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\91DB.tmp"C:\Users\Admin\AppData\Local\Temp\91DB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\92D5.tmp"C:\Users\Admin\AppData\Local\Temp\92D5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\9323.tmp"C:\Users\Admin\AppData\Local\Temp\9323.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\944C.tmp"C:\Users\Admin\AppData\Local\Temp\944C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\94AA.tmp"C:\Users\Admin\AppData\Local\Temp\94AA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\9507.tmp"C:\Users\Admin\AppData\Local\Temp\9507.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"65⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\95B3.tmp"C:\Users\Admin\AppData\Local\Temp\95B3.tmp"66⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"67⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\967E.tmp"C:\Users\Admin\AppData\Local\Temp\967E.tmp"68⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\96EC.tmp"C:\Users\Admin\AppData\Local\Temp\96EC.tmp"69⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"70⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"71⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\9824.tmp"C:\Users\Admin\AppData\Local\Temp\9824.tmp"72⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\9872.tmp"C:\Users\Admin\AppData\Local\Temp\9872.tmp"73⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\98D0.tmp"C:\Users\Admin\AppData\Local\Temp\98D0.tmp"74⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"75⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"76⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"77⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"78⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"79⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\9B12.tmp"C:\Users\Admin\AppData\Local\Temp\9B12.tmp"80⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9B70.tmp"C:\Users\Admin\AppData\Local\Temp\9B70.tmp"81⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"82⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"83⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"84⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"85⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"86⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"87⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"88⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"89⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"90⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"91⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"92⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\A033.tmp"C:\Users\Admin\AppData\Local\Temp\A033.tmp"94⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"95⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"96⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A14C.tmp"C:\Users\Admin\AppData\Local\Temp\A14C.tmp"97⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"98⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\A236.tmp"C:\Users\Admin\AppData\Local\Temp\A236.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"100⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"101⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\A35F.tmp"C:\Users\Admin\AppData\Local\Temp\A35F.tmp"102⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"103⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\A41B.tmp"C:\Users\Admin\AppData\Local\Temp\A41B.tmp"104⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\A488.tmp"C:\Users\Admin\AppData\Local\Temp\A488.tmp"105⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"106⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"107⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"108⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"109⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\A66C.tmp"C:\Users\Admin\AppData\Local\Temp\A66C.tmp"110⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"111⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"112⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"113⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"114⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"115⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"116⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"117⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"118⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"119⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"120⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"121⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\AA64.tmp"C:\Users\Admin\AppData\Local\Temp\AA64.tmp"122⤵PID:3756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-