Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 18:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_9ca1cb551e967b6ce0343a82d76284bc_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_9ca1cb551e967b6ce0343a82d76284bc_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_9ca1cb551e967b6ce0343a82d76284bc_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260930-wr8easxend
- SHA256 70ff921c3e263c18c99fb7e089b40ea6f9b53fff214459fcb77b2c2af07a2744
- MD5 9ca1cb551e967b6ce0343a82d76284bc
- SHA1 f1ba971983502210c359381a43a6abfe437663b1
- SHA512 9b4a2bbfa768a8095d9698ebbe7d535ad6d66ef46a6f9ca7b36d5ffaf7be674b10b833f8626fa03beb4b98ad818729938caa7377de99176ff09d95570569ab47
- SSDEEP 6144:zorf3lPvovsgZnqG2C7mOTeiLxDxDA72BMVNOkWEXz5oYnvB/NzR9R308183cAZK:yU5rCOTeiNVa2BMnOpgoodXZv7OkbZ
- TLSH T105B4F121B581C432E59602350EEAEBB21D3A7D725B26A4C77B84777E2FB02D1A374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4756 726C.tmp 3504 72E9.tmp 4824 7376.tmp 1060 7441.tmp 700 74ED.tmp 3784 7598.tmp 4956 7606.tmp 4552 7683.tmp 2092 770F.tmp 4528 7819.tmp 3964 78A6.tmp 3388 7932.tmp 1624 79EE.tmp 1780 7A5B.tmp 1360 7AE8.tmp 5024 7B74.tmp 1804 7C01.tmp 4324 7C9D.tmp 544 7D1A.tmp 1280 7DD6.tmp 4876 7E62.tmp 5092 7F0E.tmp 1792 7F6C.tmp 1704 8008.tmp 1824 8095.tmp 1564 8122.tmp 2488 81BE.tmp 1692 826A.tmp 2568 82C7.tmp 3960 8354.tmp 3384 83D1.tmp 3468 844E.tmp 1200 84EA.tmp 1316 8538.tmp 4504 8587.tmp 1536 85E4.tmp 4760 8632.tmp 4916 8681.tmp 4600 86CF.tmp 2852 872C.tmp 2996 878A.tmp 4888 87E8.tmp 2896 8836.tmp 768 88A3.tmp 2880 88F2.tmp 3488 895F.tmp 2080 89AD.tmp 4000 89FB.tmp 4340 8A49.tmp 3340 8A97.tmp 748 8AE6.tmp 5100 8B34.tmp 4272 8B82.tmp 3484 8BE0.tmp 876 8C2E.tmp 4480 8C7C.tmp 4520 8CCA.tmp 1228 8D18.tmp 1820 8D66.tmp 1084 8DC4.tmp 3372 8E12.tmp 4604 8E60.tmp 1940 8EBE.tmp 3248 8F1C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D07A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D56C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B82B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A69B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 382D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 798B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 167C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 4756 832 2026-09-29_9ca1cb551e967b6ce0343a82d76284bc_elex_mafia_stealc_tofsee.exe 88 PID 4756 wrote to memory of 3504 4756 726C.tmp 90 PID 3504 wrote to memory of 4824 3504 72E9.tmp 91 PID 4824 wrote to memory of 1060 4824 7376.tmp 93 PID 1060 wrote to memory of 700 1060 7441.tmp 94 PID 700 wrote to memory of 3784 700 74ED.tmp 95 PID 3784 wrote to memory of 4956 3784 7598.tmp 96 PID 4956 wrote to memory of 4552 4956 7606.tmp 97 PID 4552 wrote to memory of 2092 4552 7683.tmp 98 PID 2092 wrote to memory of 4528 2092 770F.tmp 99 PID 4528 wrote to memory of 3964 4528 7819.tmp 100 PID 3964 wrote to memory of 3388 3964 78A6.tmp 101 PID 3388 wrote to memory of 1624 3388 7932.tmp 102 PID 1624 wrote to memory of 1780 1624 79EE.tmp 103 PID 1780 wrote to memory of 1360 1780 7A5B.tmp 104 PID 1360 wrote to memory of 5024 1360 7AE8.tmp 105 PID 5024 wrote to memory of 1804 5024 7B74.tmp 106 PID 1804 wrote to memory of 4324 1804 7C01.tmp 107 PID 4324 wrote to memory of 544 4324 7C9D.tmp 108 PID 544 wrote to memory of 1280 544 7D1A.tmp 111 PID 1280 wrote to memory of 4876 1280 7DD6.tmp 112 PID 4876 wrote to memory of 5092 4876 7E62.tmp 113 PID 5092 wrote to memory of 1792 5092 7F0E.tmp 114 PID 1792 wrote to memory of 1704 1792 7F6C.tmp 115 PID 1704 wrote to memory of 1824 1704 8008.tmp 116 PID 1824 wrote to memory of 1564 1824 8095.tmp 117 PID 1564 wrote to memory of 2488 1564 8122.tmp 119 PID 2488 wrote to memory of 1692 2488 81BE.tmp 120 PID 1692 wrote to memory of 2568 1692 826A.tmp 122 PID 2568 wrote to memory of 3960 2568 82C7.tmp 123 PID 3960 wrote to memory of 3384 3960 8354.tmp 124 PID 3384 wrote to memory of 3468 3384 83D1.tmp 125 PID 3468 wrote to memory of 1200 3468 844E.tmp 126 PID 1200 wrote to memory of 1316 1200 84EA.tmp 127 PID 1316 wrote to memory of 4504 1316 8538.tmp 128 PID 4504 wrote to memory of 1536 4504 8587.tmp 129 PID 1536 wrote to memory of 4760 1536 85E4.tmp 130 PID 4760 wrote to memory of 4916 4760 8632.tmp 131 PID 4916 wrote to memory of 4600 4916 8681.tmp 132 PID 4600 wrote to memory of 2852 4600 86CF.tmp 133 PID 2852 wrote to memory of 2996 2852 872C.tmp 134 PID 2996 wrote to memory of 4888 2996 878A.tmp 135 PID 4888 wrote to memory of 2896 4888 87E8.tmp 136 PID 2896 wrote to memory of 768 2896 8836.tmp 137 PID 768 wrote to memory of 2880 768 88A3.tmp 138 PID 2880 wrote to memory of 3488 2880 88F2.tmp 139 PID 3488 wrote to memory of 2080 3488 895F.tmp 140 PID 2080 wrote to memory of 4000 2080 89AD.tmp 141 PID 4000 wrote to memory of 4340 4000 89FB.tmp 142 PID 4340 wrote to memory of 3340 4340 8A49.tmp 143 PID 3340 wrote to memory of 748 3340 8A97.tmp 144 PID 748 wrote to memory of 5100 748 8AE6.tmp 145 PID 5100 wrote to memory of 4272 5100 8B34.tmp 146 PID 4272 wrote to memory of 3484 4272 8B82.tmp 147 PID 3484 wrote to memory of 876 3484 8BE0.tmp 148 PID 876 wrote to memory of 4480 876 8C2E.tmp 149 PID 4480 wrote to memory of 4520 4480 8C7C.tmp 150 PID 4520 wrote to memory of 1228 4520 8CCA.tmp 151 PID 1228 wrote to memory of 1820 1228 8D18.tmp 152 PID 1820 wrote to memory of 1084 1820 8D66.tmp 154 PID 1084 wrote to memory of 3372 1084 8DC4.tmp 155 PID 3372 wrote to memory of 4604 3372 8E12.tmp 156 PID 4604 wrote to memory of 1940 4604 8E60.tmp 157 PID 1940 wrote to memory of 3248 1940 8EBE.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_9ca1cb551e967b6ce0343a82d76284bc_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_9ca1cb551e967b6ce0343a82d76284bc_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\78A6.tmp"C:\Users\Admin\AppData\Local\Temp\78A6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\7C01.tmp"C:\Users\Admin\AppData\Local\Temp\7C01.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\83D1.tmp"C:\Users\Admin\AppData\Local\Temp\83D1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\84EA.tmp"C:\Users\Admin\AppData\Local\Temp\84EA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\8538.tmp"C:\Users\Admin\AppData\Local\Temp\8538.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\8587.tmp"C:\Users\Admin\AppData\Local\Temp\8587.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\89FB.tmp"C:\Users\Admin\AppData\Local\Temp\89FB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8A97.tmp"C:\Users\Admin\AppData\Local\Temp\8A97.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\8B34.tmp"C:\Users\Admin\AppData\Local\Temp\8B34.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"65⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"66⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"67⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\9025.tmp"C:\Users\Admin\AppData\Local\Temp\9025.tmp"68⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"69⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"70⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"71⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"72⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"73⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"74⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\92B6.tmp"C:\Users\Admin\AppData\Local\Temp\92B6.tmp"75⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"76⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\9361.tmp"C:\Users\Admin\AppData\Local\Temp\9361.tmp"77⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\93BF.tmp"C:\Users\Admin\AppData\Local\Temp\93BF.tmp"78⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\940D.tmp"C:\Users\Admin\AppData\Local\Temp\940D.tmp"79⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"80⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"81⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\9507.tmp"C:\Users\Admin\AppData\Local\Temp\9507.tmp"82⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"83⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\95A4.tmp"C:\Users\Admin\AppData\Local\Temp\95A4.tmp"84⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"85⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\964F.tmp"C:\Users\Admin\AppData\Local\Temp\964F.tmp"86⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\96BD.tmp"C:\Users\Admin\AppData\Local\Temp\96BD.tmp"87⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\972A.tmp"C:\Users\Admin\AppData\Local\Temp\972A.tmp"88⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\9798.tmp"C:\Users\Admin\AppData\Local\Temp\9798.tmp"89⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"90⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"91⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\98B1.tmp"C:\Users\Admin\AppData\Local\Temp\98B1.tmp"92⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\98FF.tmp"C:\Users\Admin\AppData\Local\Temp\98FF.tmp"93⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\995D.tmp"C:\Users\Admin\AppData\Local\Temp\995D.tmp"94⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\99AB.tmp"C:\Users\Admin\AppData\Local\Temp\99AB.tmp"95⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\9A18.tmp"C:\Users\Admin\AppData\Local\Temp\9A18.tmp"96⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"97⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"98⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\9B12.tmp"C:\Users\Admin\AppData\Local\Temp\9B12.tmp"99⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"100⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"101⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"102⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"103⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\9C99.tmp"C:\Users\Admin\AppData\Local\Temp\9C99.tmp"104⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"105⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"106⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"107⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"108⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"109⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"110⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"111⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9F39.tmp"C:\Users\Admin\AppData\Local\Temp\9F39.tmp"112⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\9F87.tmp"C:\Users\Admin\AppData\Local\Temp\9F87.tmp"113⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"114⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\A042.tmp"C:\Users\Admin\AppData\Local\Temp\A042.tmp"115⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"116⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"117⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\A14C.tmp"C:\Users\Admin\AppData\Local\Temp\A14C.tmp"118⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\A19A.tmp"C:\Users\Admin\AppData\Local\Temp\A19A.tmp"119⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A207.tmp"C:\Users\Admin\AppData\Local\Temp\A207.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"121⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-