Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_a1798b84cf50add718b7e4f663189c5c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_a1798b84cf50add718b7e4f663189c5c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_a1798b84cf50add718b7e4f663189c5c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260816-ce8prabm21
- SHA256 2f2cf5591009028f61e2ecc3e37a55ed1530334d68561bb342559cacf70b9c88
- MD5 a1798b84cf50add718b7e4f663189c5c
- SHA1 1cc6aee9e7e33d2b49976be82e01615680e9bef6
- SHA512 f328bb0f351cf42a45bd8fc9702b529a1fc1534ebff51d86c5ccee8d87577ed24ba62b3fa6154a2aa77c70f42fc37d8d8c7e4672edd2d42c98f37ff9f7e06d2e
- SSDEEP 12288:wU5rCOTeiDtsF048BjrWZ4z3rzpXHENZ+3/v+I9hUG2VA:wUQOJDtZdr3rlXHENGEA
- TLSH T197E4D02077D8C532E5FB037859B5E6641A7EBD366722D6DF6F8012AE09B1BC08931723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1428 506D.tmp 3296 5176.tmp 2864 529F.tmp 2344 53F7.tmp 1992 5520.tmp 2508 55EB.tmp 2004 5687.tmp 4712 57C0.tmp 1844 58BA.tmp 4304 5995.tmp 3144 5ACD.tmp 1904 5BC7.tmp 4988 5D00.tmp 628 5DFA.tmp 2116 5EF4.tmp 4124 602C.tmp 4628 6107.tmp 4216 629D.tmp 2272 6387.tmp 3732 6491.tmp 4840 657B.tmp 748 6666.tmp 4108 6760.tmp 1744 682B.tmp 2840 6954.tmp 4352 6A1F.tmp 1164 6B67.tmp 1980 6C42.tmp 380 6D1D.tmp 2256 6E55.tmp 3176 6F7E.tmp 4976 70A7.tmp 3452 7191.tmp 3740 721E.tmp 4872 72CA.tmp 60 7347.tmp 3180 73D3.tmp 1304 7470.tmp 5076 752B.tmp 2348 75C7.tmp 4672 7673.tmp 4500 771F.tmp 2368 77AC.tmp 4484 7838.tmp 4668 78E4.tmp 1720 7980.tmp 3432 7A1D.tmp 4732 7A9A.tmp 2984 7B26.tmp 4396 7B84.tmp 2188 7BE2.tmp 3052 7C4F.tmp 2820 7CCC.tmp 4156 7D49.tmp 4112 7DA7.tmp 1732 7DF5.tmp 1960 7E53.tmp 3828 7EA1.tmp 5000 7EFF.tmp 1516 7F5C.tmp 1788 7FCA.tmp 216 8018.tmp 4924 8066.tmp 2196 80D3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C09C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 871D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D58B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 1428 3976 2026-08-16_a1798b84cf50add718b7e4f663189c5c_elex_mafia_stealc_tofsee.exe 85 PID 1428 wrote to memory of 3296 1428 506D.tmp 86 PID 3296 wrote to memory of 2864 3296 5176.tmp 87 PID 2864 wrote to memory of 2344 2864 529F.tmp 88 PID 2344 wrote to memory of 1992 2344 53F7.tmp 89 PID 1992 wrote to memory of 2508 1992 5520.tmp 90 PID 2508 wrote to memory of 2004 2508 55EB.tmp 91 PID 2004 wrote to memory of 4712 2004 5687.tmp 92 PID 4712 wrote to memory of 1844 4712 57C0.tmp 93 PID 1844 wrote to memory of 4304 1844 58BA.tmp 94 PID 4304 wrote to memory of 3144 4304 5995.tmp 95 PID 3144 wrote to memory of 1904 3144 5ACD.tmp 96 PID 1904 wrote to memory of 4988 1904 5BC7.tmp 97 PID 4988 wrote to memory of 628 4988 5D00.tmp 98 PID 628 wrote to memory of 2116 628 5DFA.tmp 99 PID 2116 wrote to memory of 4124 2116 5EF4.tmp 100 PID 4124 wrote to memory of 4628 4124 602C.tmp 101 PID 4628 wrote to memory of 4216 4628 6107.tmp 102 PID 4216 wrote to memory of 2272 4216 629D.tmp 103 PID 2272 wrote to memory of 3732 2272 6387.tmp 104 PID 3732 wrote to memory of 4840 3732 6491.tmp 105 PID 4840 wrote to memory of 748 4840 657B.tmp 106 PID 748 wrote to memory of 4108 748 6666.tmp 107 PID 4108 wrote to memory of 1744 4108 6760.tmp 108 PID 1744 wrote to memory of 2840 1744 682B.tmp 110 PID 2840 wrote to memory of 4352 2840 6954.tmp 111 PID 4352 wrote to memory of 1164 4352 6A1F.tmp 113 PID 1164 wrote to memory of 1980 1164 6B67.tmp 114 PID 1980 wrote to memory of 380 1980 6C42.tmp 115 PID 380 wrote to memory of 2256 380 6D1D.tmp 116 PID 2256 wrote to memory of 3176 2256 6E55.tmp 118 PID 3176 wrote to memory of 4976 3176 6F7E.tmp 119 PID 4976 wrote to memory of 3452 4976 70A7.tmp 120 PID 3452 wrote to memory of 3740 3452 7191.tmp 121 PID 3740 wrote to memory of 4872 3740 721E.tmp 122 PID 4872 wrote to memory of 60 4872 72CA.tmp 123 PID 60 wrote to memory of 3180 60 7347.tmp 125 PID 3180 wrote to memory of 1304 3180 73D3.tmp 126 PID 1304 wrote to memory of 5076 1304 7470.tmp 127 PID 5076 wrote to memory of 2348 5076 752B.tmp 128 PID 2348 wrote to memory of 4672 2348 75C7.tmp 129 PID 4672 wrote to memory of 4500 4672 7673.tmp 130 PID 4500 wrote to memory of 2368 4500 771F.tmp 131 PID 2368 wrote to memory of 4484 2368 77AC.tmp 132 PID 4484 wrote to memory of 4668 4484 7838.tmp 133 PID 4668 wrote to memory of 1720 4668 78E4.tmp 134 PID 1720 wrote to memory of 3432 1720 7980.tmp 135 PID 3432 wrote to memory of 4732 3432 7A1D.tmp 136 PID 4732 wrote to memory of 2984 4732 7A9A.tmp 137 PID 2984 wrote to memory of 4396 2984 7B26.tmp 138 PID 4396 wrote to memory of 2188 4396 7B84.tmp 139 PID 2188 wrote to memory of 3052 2188 7BE2.tmp 140 PID 3052 wrote to memory of 2820 3052 7C4F.tmp 141 PID 2820 wrote to memory of 4156 2820 7CCC.tmp 142 PID 4156 wrote to memory of 4112 4156 7D49.tmp 143 PID 4112 wrote to memory of 1732 4112 7DA7.tmp 144 PID 1732 wrote to memory of 1960 1732 7DF5.tmp 145 PID 1960 wrote to memory of 3828 1960 7E53.tmp 146 PID 3828 wrote to memory of 5000 3828 7EA1.tmp 147 PID 5000 wrote to memory of 1516 5000 7EFF.tmp 148 PID 1516 wrote to memory of 1788 1516 7F5C.tmp 149 PID 1788 wrote to memory of 216 1788 7FCA.tmp 150 PID 216 wrote to memory of 4924 216 8018.tmp 151 PID 4924 wrote to memory of 2196 4924 8066.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_a1798b84cf50add718b7e4f663189c5c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a1798b84cf50add718b7e4f663189c5c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\6666.tmp"C:\Users\Admin\AppData\Local\Temp\6666.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\6760.tmp"C:\Users\Admin\AppData\Local\Temp\6760.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\6B67.tmp"C:\Users\Admin\AppData\Local\Temp\6B67.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\771F.tmp"C:\Users\Admin\AppData\Local\Temp\771F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7B26.tmp"C:\Users\Admin\AppData\Local\Temp\7B26.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\7E53.tmp"C:\Users\Admin\AppData\Local\Temp\7E53.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"65⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"66⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"67⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"68⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"70⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"71⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"72⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"73⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"74⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"75⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"76⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"77⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"78⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"79⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\8671.tmp"C:\Users\Admin\AppData\Local\Temp\8671.tmp"80⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"81⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"83⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"84⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\8826.tmp"C:\Users\Admin\AppData\Local\Temp\8826.tmp"85⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"86⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"87⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\8930.tmp"C:\Users\Admin\AppData\Local\Temp\8930.tmp"88⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\898E.tmp"C:\Users\Admin\AppData\Local\Temp\898E.tmp"89⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"90⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"91⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"92⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"93⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8B34.tmp"C:\Users\Admin\AppData\Local\Temp\8B34.tmp"94⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"95⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"96⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"97⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"98⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"99⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"100⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"101⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"102⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"103⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"104⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"105⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"106⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"107⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"108⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\9016.tmp"C:\Users\Admin\AppData\Local\Temp\9016.tmp"109⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"110⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\90B2.tmp"C:\Users\Admin\AppData\Local\Temp\90B2.tmp"111⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"112⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"113⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"114⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\9229.tmp"C:\Users\Admin\AppData\Local\Temp\9229.tmp"115⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"116⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"117⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\9323.tmp"C:\Users\Admin\AppData\Local\Temp\9323.tmp"118⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\9371.tmp"C:\Users\Admin\AppData\Local\Temp\9371.tmp"119⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"120⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\942D.tmp"C:\Users\Admin\AppData\Local\Temp\942D.tmp"121⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\948A.tmp"C:\Users\Admin\AppData\Local\Temp\948A.tmp"122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-