Analysis
- max time kernel
117s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_cd8ce417347f0f98f6e46313e7892b41_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_cd8ce417347f0f98f6e46313e7892b41_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-16_cd8ce417347f0f98f6e46313e7892b41_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample261017-heaevaytft
- SHA256 a83a4c116fb32b31e2f6baeffda1b73cbc318509a3a730bef033151a4fece1f8
- MD5 cd8ce417347f0f98f6e46313e7892b41
- SHA1 d95b5cf8b1bd6a7588f556670e7bab9433b09f0d
- SHA512 dd7d673eeedc403f0058601620c82f3f4ab64d659eaf85402fd7a679524934356a842efd3a84de73b614cf6893e79533b347251f444499632df05d27c1fccd21
- SSDEEP 12288:9U5rCOTei64PAsnVvAd/TVGbfLoQ9OnyrwzY2jbwKqZoXWjdq:9UQOJ64jnVvAdrcTLR8yc02JqqGh
- TLSH T1C1C4F1227585C032EAE311344EE2EBB1597EBC315B2694C73B80766E6FB12E2D775306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4916 764.tmp 4604 81F.tmp 2928 919.tmp 5508 A13.tmp 260 B1D.tmp 4384 BE8.tmp 5960 C75.tmp 4960 D01.tmp 244 DAD.tmp 5656 E49.tmp 4980 EE6.tmp 2492 FB1.tmp 2536 104D.tmp 1012 10F9.tmp 5244 1186.tmp 1372 1222.tmp 2632 131C.tmp 4032 1406.tmp 1100 14E1.tmp 6092 158D.tmp 2936 1619.tmp 1788 16C5.tmp 4004 1762.tmp 2568 180D.tmp 5228 18C9.tmp 2448 1956.tmp 5912 1A21.tmp 5956 1AEC.tmp 4280 1B88.tmp 4220 1C63.tmp 1440 1D0F.tmp 4488 1D9B.tmp 2924 1E66.tmp 5904 1F03.tmp 1444 1F80.tmp 4788 201C.tmp 1612 207A.tmp 4968 2106.tmp 2344 2183.tmp 3520 2200.tmp 1476 22BC.tmp 3764 2348.tmp 4904 23F4.tmp 200 2471.tmp 4804 251D.tmp 2648 25AA.tmp 4868 2636.tmp 3388 26E2.tmp 5872 276F.tmp 3416 27EC.tmp 1916 2869.tmp 3708 28F6.tmp 3644 2982.tmp 2488 2A0F.tmp 5384 2AAB.tmp 2888 2B38.tmp 2652 2BC4.tmp 4168 2C32.tmp 1720 2CCE.tmp 4412 2D6A.tmp 3164 2DF7.tmp 760 2E83.tmp 5696 2F4F.tmp 4016 2FBC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 326B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9789.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F55E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C34C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 597B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8960.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B74B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F04D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 468B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 724E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C792.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C593.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 4916 440 2026-10-16_cd8ce417347f0f98f6e46313e7892b41_elex_mafia_stealc_tofsee.exe 90 PID 4916 wrote to memory of 4604 4916 764.tmp 91 PID 4604 wrote to memory of 2928 4604 81F.tmp 92 PID 2928 wrote to memory of 5508 2928 919.tmp 93 PID 5508 wrote to memory of 260 5508 A13.tmp 94 PID 260 wrote to memory of 4384 260 B1D.tmp 95 PID 4384 wrote to memory of 5960 4384 BE8.tmp 96 PID 5960 wrote to memory of 4960 5960 C75.tmp 97 PID 4960 wrote to memory of 244 4960 D01.tmp 98 PID 244 wrote to memory of 5656 244 DAD.tmp 99 PID 5656 wrote to memory of 4980 5656 E49.tmp 100 PID 4980 wrote to memory of 2492 4980 EE6.tmp 101 PID 2492 wrote to memory of 2536 2492 FB1.tmp 102 PID 2536 wrote to memory of 1012 2536 104D.tmp 103 PID 1012 wrote to memory of 5244 1012 10F9.tmp 104 PID 5244 wrote to memory of 1372 5244 1186.tmp 105 PID 1372 wrote to memory of 2632 1372 1222.tmp 106 PID 2632 wrote to memory of 4032 2632 131C.tmp 107 PID 4032 wrote to memory of 1100 4032 1406.tmp 108 PID 1100 wrote to memory of 6092 1100 14E1.tmp 109 PID 6092 wrote to memory of 2936 6092 158D.tmp 110 PID 2936 wrote to memory of 1788 2936 1619.tmp 111 PID 1788 wrote to memory of 4004 1788 16C5.tmp 112 PID 4004 wrote to memory of 2568 4004 1762.tmp 113 PID 2568 wrote to memory of 5228 2568 180D.tmp 114 PID 5228 wrote to memory of 2448 5228 18C9.tmp 115 PID 2448 wrote to memory of 5912 2448 1956.tmp 116 PID 5912 wrote to memory of 5956 5912 1A21.tmp 117 PID 5956 wrote to memory of 4280 5956 1AEC.tmp 118 PID 4280 wrote to memory of 4220 4280 1B88.tmp 119 PID 4220 wrote to memory of 1440 4220 1C63.tmp 120 PID 1440 wrote to memory of 4488 1440 1D0F.tmp 121 PID 4488 wrote to memory of 2924 4488 1D9B.tmp 122 PID 2924 wrote to memory of 5904 2924 1E66.tmp 123 PID 5904 wrote to memory of 1444 5904 1F03.tmp 124 PID 1444 wrote to memory of 4788 1444 1F80.tmp 125 PID 4788 wrote to memory of 1612 4788 201C.tmp 126 PID 1612 wrote to memory of 4968 1612 207A.tmp 127 PID 4968 wrote to memory of 2344 4968 2106.tmp 128 PID 2344 wrote to memory of 3520 2344 2183.tmp 129 PID 3520 wrote to memory of 1476 3520 2200.tmp 130 PID 1476 wrote to memory of 3764 1476 22BC.tmp 131 PID 3764 wrote to memory of 4904 3764 2348.tmp 132 PID 4904 wrote to memory of 200 4904 23F4.tmp 133 PID 200 wrote to memory of 4804 200 2471.tmp 134 PID 4804 wrote to memory of 2648 4804 251D.tmp 135 PID 2648 wrote to memory of 4868 2648 25AA.tmp 136 PID 4868 wrote to memory of 3388 4868 2636.tmp 137 PID 3388 wrote to memory of 5872 3388 26E2.tmp 138 PID 5872 wrote to memory of 3416 5872 276F.tmp 139 PID 3416 wrote to memory of 1916 3416 27EC.tmp 140 PID 1916 wrote to memory of 3708 1916 2869.tmp 141 PID 3708 wrote to memory of 3644 3708 28F6.tmp 142 PID 3644 wrote to memory of 2488 3644 2982.tmp 143 PID 2488 wrote to memory of 5384 2488 2A0F.tmp 144 PID 5384 wrote to memory of 2888 5384 2AAB.tmp 145 PID 2888 wrote to memory of 2652 2888 2B38.tmp 146 PID 2652 wrote to memory of 4168 2652 2BC4.tmp 147 PID 4168 wrote to memory of 1720 4168 2C32.tmp 148 PID 1720 wrote to memory of 4412 1720 2CCE.tmp 149 PID 4412 wrote to memory of 3164 4412 2D6A.tmp 150 PID 3164 wrote to memory of 760 3164 2DF7.tmp 151 PID 760 wrote to memory of 5696 760 2E83.tmp 152 PID 5696 wrote to memory of 4016 5696 2F4F.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_cd8ce417347f0f98f6e46313e7892b41_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_cd8ce417347f0f98f6e46313e7892b41_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\919.tmp"C:\Users\Admin\AppData\Local\Temp\919.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\BE8.tmp"C:\Users\Admin\AppData\Local\Temp\BE8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\E49.tmp"C:\Users\Admin\AppData\Local\Temp\E49.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\EE6.tmp"C:\Users\Admin\AppData\Local\Temp\EE6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\FB1.tmp"C:\Users\Admin\AppData\Local\Temp\FB1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\158D.tmp"C:\Users\Admin\AppData\Local\Temp\158D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\16C5.tmp"C:\Users\Admin\AppData\Local\Temp\16C5.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\1956.tmp"C:\Users\Admin\AppData\Local\Temp\1956.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\1C63.tmp"C:\Users\Admin\AppData\Local\Temp\1C63.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\201C.tmp"C:\Users\Admin\AppData\Local\Temp\201C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\207A.tmp"C:\Users\Admin\AppData\Local\Temp\207A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\23F4.tmp"C:\Users\Admin\AppData\Local\Temp\23F4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2471.tmp"C:\Users\Admin\AppData\Local\Temp\2471.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\28F6.tmp"C:\Users\Admin\AppData\Local\Temp\28F6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2C32.tmp"C:\Users\Admin\AppData\Local\Temp\2C32.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\2E83.tmp"C:\Users\Admin\AppData\Local\Temp\2E83.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\2F4F.tmp"C:\Users\Admin\AppData\Local\Temp\2F4F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"65⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3039.tmp"C:\Users\Admin\AppData\Local\Temp\3039.tmp"66⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\30C6.tmp"C:\Users\Admin\AppData\Local\Temp\30C6.tmp"67⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3152.tmp"C:\Users\Admin\AppData\Local\Temp\3152.tmp"68⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\31DF.tmp"C:\Users\Admin\AppData\Local\Temp\31DF.tmp"69⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\326B.tmp"C:\Users\Admin\AppData\Local\Temp\326B.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\3308.tmp"C:\Users\Admin\AppData\Local\Temp\3308.tmp"71⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3385.tmp"C:\Users\Admin\AppData\Local\Temp\3385.tmp"72⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\3421.tmp"C:\Users\Admin\AppData\Local\Temp\3421.tmp"73⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\34BD.tmp"C:\Users\Admin\AppData\Local\Temp\34BD.tmp"74⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\3569.tmp"C:\Users\Admin\AppData\Local\Temp\3569.tmp"75⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\35F6.tmp"C:\Users\Admin\AppData\Local\Temp\35F6.tmp"76⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\3682.tmp"C:\Users\Admin\AppData\Local\Temp\3682.tmp"77⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\36FF.tmp"C:\Users\Admin\AppData\Local\Temp\36FF.tmp"78⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\378C.tmp"C:\Users\Admin\AppData\Local\Temp\378C.tmp"79⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\3809.tmp"C:\Users\Admin\AppData\Local\Temp\3809.tmp"80⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\3876.tmp"C:\Users\Admin\AppData\Local\Temp\3876.tmp"81⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\38F3.tmp"C:\Users\Admin\AppData\Local\Temp\38F3.tmp"82⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\3970.tmp"C:\Users\Admin\AppData\Local\Temp\3970.tmp"83⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\39CE.tmp"C:\Users\Admin\AppData\Local\Temp\39CE.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"85⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3AD8.tmp"C:\Users\Admin\AppData\Local\Temp\3AD8.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\3B64.tmp"C:\Users\Admin\AppData\Local\Temp\3B64.tmp"87⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"88⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"89⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"90⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\3D58.tmp"C:\Users\Admin\AppData\Local\Temp\3D58.tmp"91⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3E04.tmp"C:\Users\Admin\AppData\Local\Temp\3E04.tmp"92⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3E81.tmp"C:\Users\Admin\AppData\Local\Temp\3E81.tmp"93⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3F0E.tmp"C:\Users\Admin\AppData\Local\Temp\3F0E.tmp"94⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"95⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\4037.tmp"C:\Users\Admin\AppData\Local\Temp\4037.tmp"96⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\40B4.tmp"C:\Users\Admin\AppData\Local\Temp\40B4.tmp"97⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\4150.tmp"C:\Users\Admin\AppData\Local\Temp\4150.tmp"98⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\41CD.tmp"C:\Users\Admin\AppData\Local\Temp\41CD.tmp"99⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4269.tmp"C:\Users\Admin\AppData\Local\Temp\4269.tmp"100⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"101⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\4382.tmp"C:\Users\Admin\AppData\Local\Temp\4382.tmp"102⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\442E.tmp"C:\Users\Admin\AppData\Local\Temp\442E.tmp"103⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\44BB.tmp"C:\Users\Admin\AppData\Local\Temp\44BB.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4538.tmp"C:\Users\Admin\AppData\Local\Temp\4538.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\45D4.tmp"C:\Users\Admin\AppData\Local\Temp\45D4.tmp"106⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\4661.tmp"C:\Users\Admin\AppData\Local\Temp\4661.tmp"107⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\46ED.tmp"C:\Users\Admin\AppData\Local\Temp\46ED.tmp"108⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\477A.tmp"C:\Users\Admin\AppData\Local\Temp\477A.tmp"109⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\47F7.tmp"C:\Users\Admin\AppData\Local\Temp\47F7.tmp"110⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\4874.tmp"C:\Users\Admin\AppData\Local\Temp\4874.tmp"111⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\4910.tmp"C:\Users\Admin\AppData\Local\Temp\4910.tmp"112⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\499D.tmp"C:\Users\Admin\AppData\Local\Temp\499D.tmp"113⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\4A0A.tmp"C:\Users\Admin\AppData\Local\Temp\4A0A.tmp"114⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"115⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\4B24.tmp"C:\Users\Admin\AppData\Local\Temp\4B24.tmp"116⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"117⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"118⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"119⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\4DE3.tmp"C:\Users\Admin\AppData\Local\Temp\4DE3.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\4E50.tmp"C:\Users\Admin\AppData\Local\Temp\4E50.tmp"122⤵PID:5844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-