Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 13:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_b79bf7c1d6d827c724dfdc4fea527cb4_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_b79bf7c1d6d827c724dfdc4fea527cb4_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_b79bf7c1d6d827c724dfdc4fea527cb4_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-q42jmabl71
- SHA256 c008b2a92afa8c00babc5b5550ffd27f9df24e612f3dc6496fe9c3844ceb11e3
- MD5 b79bf7c1d6d827c724dfdc4fea527cb4
- SHA1 3eaa6bb488e97c472a496157a672bd7adc677d39
- SHA512 5949f03e67d9aa3d1ee77ba40095dff59c8c34e0ecb2eac46c8b683242b13688110a3c90b0b7c988b7e6e407027a1173610209c39f056addc789560a7cd49d7d
- SSDEEP 12288:wU5rCOTeiDdCk+uAeWSplaWATS7f4WNZ+3/v+I9hUG2VA:wUQOJDAkiJatfPNGEA
- TLSH T1D7E4E11177D8C536E9FB037859B5E6514D7EBD22A722D6DF2F8012AE09B1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2008 604B.tmp 3144 6126.tmp 1232 61F1.tmp 3920 6349.tmp 4144 64A1.tmp 3536 659B.tmp 1032 66E3.tmp 2088 67CD.tmp 3484 6915.tmp 564 6A3E.tmp 1464 6B48.tmp 3496 6C71.tmp 3380 6D5B.tmp 4432 6E65.tmp 1272 6F6E.tmp 3788 7088.tmp 4436 7162.tmp 3160 724D.tmp 1604 7376.tmp 3116 7441.tmp 3424 755A.tmp 2240 7673.tmp 2360 777D.tmp 2392 7886.tmp 1064 7980.tmp 2488 7A7A.tmp 1316 7B74.tmp 4792 7C7E.tmp 3236 7D49.tmp 4196 7E14.tmp 560 7F0E.tmp 3076 8018.tmp 4408 8112.tmp 4420 81AE.tmp 5088 823B.tmp 4680 82D7.tmp 2552 8373.tmp 1928 8410.tmp 4384 84CB.tmp 3688 8558.tmp 2864 85F4.tmp 4948 86A0.tmp 4928 874C.tmp 2604 87D8.tmp 656 8894.tmp 392 8920.tmp 4308 898E.tmp 1720 8A0B.tmp 3852 8A78.tmp 4400 8AD6.tmp 4376 8B24.tmp 4352 8B72.tmp 1420 8BE0.tmp 4560 8C3D.tmp 1660 8C8B.tmp 1652 8CE9.tmp 3396 8D37.tmp 1040 8D95.tmp 1704 8DE3.tmp 2748 8E31.tmp 4744 8E8F.tmp 804 8EED.tmp 4828 8F3B.tmp 308 8FA8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 644E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7441.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 907E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C196.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 965A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 2008 4884 2026-08-02_b79bf7c1d6d827c724dfdc4fea527cb4_elex_mafia_stealc_tofsee.exe 85 PID 2008 wrote to memory of 3144 2008 604B.tmp 86 PID 3144 wrote to memory of 1232 3144 6126.tmp 87 PID 1232 wrote to memory of 3920 1232 61F1.tmp 88 PID 3920 wrote to memory of 4144 3920 6349.tmp 89 PID 4144 wrote to memory of 3536 4144 64A1.tmp 90 PID 3536 wrote to memory of 1032 3536 659B.tmp 91 PID 1032 wrote to memory of 2088 1032 66E3.tmp 92 PID 2088 wrote to memory of 3484 2088 67CD.tmp 94 PID 3484 wrote to memory of 564 3484 6915.tmp 95 PID 564 wrote to memory of 1464 564 6A3E.tmp 96 PID 1464 wrote to memory of 3496 1464 6B48.tmp 97 PID 3496 wrote to memory of 3380 3496 6C71.tmp 98 PID 3380 wrote to memory of 4432 3380 6D5B.tmp 99 PID 4432 wrote to memory of 1272 4432 6E65.tmp 100 PID 1272 wrote to memory of 3788 1272 6F6E.tmp 101 PID 3788 wrote to memory of 4436 3788 7088.tmp 102 PID 4436 wrote to memory of 3160 4436 7162.tmp 103 PID 3160 wrote to memory of 1604 3160 724D.tmp 104 PID 1604 wrote to memory of 3116 1604 7376.tmp 105 PID 3116 wrote to memory of 3424 3116 7441.tmp 106 PID 3424 wrote to memory of 2240 3424 755A.tmp 107 PID 2240 wrote to memory of 2360 2240 7673.tmp 108 PID 2360 wrote to memory of 2392 2360 777D.tmp 109 PID 2392 wrote to memory of 1064 2392 7886.tmp 110 PID 1064 wrote to memory of 2488 1064 7980.tmp 111 PID 2488 wrote to memory of 1316 2488 7A7A.tmp 112 PID 1316 wrote to memory of 4792 1316 7B74.tmp 113 PID 4792 wrote to memory of 3236 4792 7C7E.tmp 114 PID 3236 wrote to memory of 4196 3236 7D49.tmp 115 PID 4196 wrote to memory of 560 4196 7E14.tmp 116 PID 560 wrote to memory of 3076 560 7F0E.tmp 117 PID 3076 wrote to memory of 4408 3076 8018.tmp 118 PID 4408 wrote to memory of 4420 4408 8112.tmp 119 PID 4420 wrote to memory of 5088 4420 81AE.tmp 120 PID 5088 wrote to memory of 4680 5088 823B.tmp 121 PID 4680 wrote to memory of 2552 4680 82D7.tmp 122 PID 2552 wrote to memory of 1928 2552 8373.tmp 123 PID 1928 wrote to memory of 4384 1928 8410.tmp 124 PID 4384 wrote to memory of 3688 4384 84CB.tmp 125 PID 3688 wrote to memory of 2864 3688 8558.tmp 126 PID 2864 wrote to memory of 4948 2864 85F4.tmp 127 PID 4948 wrote to memory of 4928 4948 86A0.tmp 128 PID 4928 wrote to memory of 2604 4928 874C.tmp 129 PID 2604 wrote to memory of 656 2604 87D8.tmp 130 PID 656 wrote to memory of 392 656 8894.tmp 131 PID 392 wrote to memory of 4308 392 8920.tmp 132 PID 4308 wrote to memory of 1720 4308 898E.tmp 133 PID 1720 wrote to memory of 3852 1720 8A0B.tmp 134 PID 3852 wrote to memory of 4400 3852 8A78.tmp 135 PID 4400 wrote to memory of 4376 4400 8AD6.tmp 136 PID 4376 wrote to memory of 4352 4376 8B24.tmp 137 PID 4352 wrote to memory of 1420 4352 8B72.tmp 138 PID 1420 wrote to memory of 4560 1420 8BE0.tmp 139 PID 4560 wrote to memory of 1660 4560 8C3D.tmp 140 PID 1660 wrote to memory of 1652 1660 8C8B.tmp 141 PID 1652 wrote to memory of 3396 1652 8CE9.tmp 142 PID 3396 wrote to memory of 1040 3396 8D37.tmp 143 PID 1040 wrote to memory of 1704 1040 8D95.tmp 144 PID 1704 wrote to memory of 2748 1704 8DE3.tmp 145 PID 2748 wrote to memory of 4744 2748 8E31.tmp 146 PID 4744 wrote to memory of 804 4744 8E8F.tmp 147 PID 804 wrote to memory of 4828 804 8EED.tmp 148 PID 4828 wrote to memory of 308 4828 8F3B.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_b79bf7c1d6d827c724dfdc4fea527cb4_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b79bf7c1d6d827c724dfdc4fea527cb4_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\61F1.tmp"C:\Users\Admin\AppData\Local\Temp\61F1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\659B.tmp"C:\Users\Admin\AppData\Local\Temp\659B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\7E14.tmp"C:\Users\Admin\AppData\Local\Temp\7E14.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\85F4.tmp"C:\Users\Admin\AppData\Local\Temp\85F4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\8920.tmp"C:\Users\Admin\AppData\Local\Temp\8920.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\898E.tmp"C:\Users\Admin\AppData\Local\Temp\898E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8B72.tmp"C:\Users\Admin\AppData\Local\Temp\8B72.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\8D37.tmp"C:\Users\Admin\AppData\Local\Temp\8D37.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"65⤵
- Executes dropped EXE
PID:308 -
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"66⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"67⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\90B2.tmp"C:\Users\Admin\AppData\Local\Temp\90B2.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"69⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"70⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"71⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"72⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"73⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"74⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"75⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\9342.tmp"C:\Users\Admin\AppData\Local\Temp\9342.tmp"76⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"77⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"78⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"79⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\949A.tmp"C:\Users\Admin\AppData\Local\Temp\949A.tmp"80⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"81⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"82⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\95A4.tmp"C:\Users\Admin\AppData\Local\Temp\95A4.tmp"83⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\95F2.tmp"C:\Users\Admin\AppData\Local\Temp\95F2.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\9640.tmp"C:\Users\Admin\AppData\Local\Temp\9640.tmp"85⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"86⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\96EC.tmp"C:\Users\Admin\AppData\Local\Temp\96EC.tmp"87⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\973A.tmp"C:\Users\Admin\AppData\Local\Temp\973A.tmp"88⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"89⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"90⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"91⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"92⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"93⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\994D.tmp"C:\Users\Admin\AppData\Local\Temp\994D.tmp"94⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\99AB.tmp"C:\Users\Admin\AppData\Local\Temp\99AB.tmp"95⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\9A09.tmp"C:\Users\Admin\AppData\Local\Temp\9A09.tmp"96⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"98⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"99⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"100⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"101⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"102⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"103⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\9C99.tmp"C:\Users\Admin\AppData\Local\Temp\9C99.tmp"104⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"105⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\9D45.tmp"C:\Users\Admin\AppData\Local\Temp\9D45.tmp"106⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"107⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"108⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"109⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"110⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"111⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"112⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"113⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\A013.tmp"C:\Users\Admin\AppData\Local\Temp\A013.tmp"114⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"115⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"116⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"117⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"118⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"119⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"120⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"121⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"122⤵PID:4584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-