Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample261027-2mlmmagv41
- SHA256 64a3129703bae847536282bb2d6e30202d3dfc3e8b9ec0d2cb22980cc1c14c3c
- MD5 eeb3094c462f7f72ba8f9ed64278c84f
- SHA1 3ab7faa9a16714af16176278d3998b8362ac29eb
- SHA512 9421a8060244c223f04f63888a3af802442993ce269bcbe67fbce7523c459353395dd042b906b1885bc2b839931afbc4d9d12fe05df552f78c49373f4d4ec8e1
- SSDEEP 12288:HU5rCOTeiJTfYDxmJ+RCErrliV1heDKkNZb73ctO:HUQOJJTfImTEroV10ekNV73ctO
- TLSH T181C4E126B544C232E28302711EDAEBA27A3E7C71572694C32BD4A27D2B757E0E375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4384 FFF6.tmp 4776 73.tmp 2676 14E.tmp 4180 1EA.tmp 2752 287.tmp 5016 304.tmp 2120 381.tmp 4792 40D.tmp 3780 4A9.tmp 4720 536.tmp 4536 5E2.tmp 884 6AD.tmp 1528 73A.tmp 4876 7A7.tmp 4832 843.tmp 2784 8E0.tmp 3728 95D.tmp 988 9DA.tmp 1944 A66.tmp 1476 B02.tmp 436 B9F.tmp 4452 C3B.tmp 116 CC8.tmp 1348 D45.tmp 4032 DC2.tmp 5040 E5E.tmp 2136 F19.tmp 3964 FA6.tmp 3512 1023.tmp 4564 10DE.tmp 4388 117B.tmp 3840 1236.tmp 1688 12E2.tmp 3428 134F.tmp 1784 13AD.tmp 1500 13FB.tmp 4700 1449.tmp 1668 14A7.tmp 3880 1515.tmp 2372 1563.tmp 4528 15B1.tmp 3744 160F.tmp 2828 166C.tmp 1704 16BA.tmp 1840 1709.tmp 516 1766.tmp 4100 17B4.tmp 4804 1803.tmp 2268 1851.tmp 3848 18AE.tmp 2812 190C.tmp 3344 195A.tmp 2064 19B8.tmp 2624 1A06.tmp 4348 1A54.tmp 2440 1AB2.tmp 4280 1B00.tmp 3788 1B4E.tmp 5052 1BAC.tmp 4544 1BFA.tmp 3684 1C68.tmp 3036 1CB6.tmp 3304 1D04.tmp 3308 1D52.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 571A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 697E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A241.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 4384 1616 2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe 84 PID 4384 wrote to memory of 4776 4384 FFF6.tmp 85 PID 4776 wrote to memory of 2676 4776 73.tmp 86 PID 2676 wrote to memory of 4180 2676 14E.tmp 87 PID 4180 wrote to memory of 2752 4180 1EA.tmp 88 PID 2752 wrote to memory of 5016 2752 287.tmp 89 PID 5016 wrote to memory of 2120 5016 304.tmp 90 PID 2120 wrote to memory of 4792 2120 381.tmp 91 PID 4792 wrote to memory of 3780 4792 40D.tmp 92 PID 3780 wrote to memory of 4720 3780 4A9.tmp 93 PID 4720 wrote to memory of 4536 4720 536.tmp 94 PID 4536 wrote to memory of 884 4536 5E2.tmp 95 PID 884 wrote to memory of 1528 884 6AD.tmp 96 PID 1528 wrote to memory of 4876 1528 73A.tmp 97 PID 4876 wrote to memory of 4832 4876 7A7.tmp 98 PID 4832 wrote to memory of 2784 4832 843.tmp 99 PID 2784 wrote to memory of 3728 2784 8E0.tmp 100 PID 3728 wrote to memory of 988 3728 95D.tmp 103 PID 988 wrote to memory of 1944 988 9DA.tmp 104 PID 1944 wrote to memory of 1476 1944 A66.tmp 105 PID 1476 wrote to memory of 436 1476 B02.tmp 106 PID 436 wrote to memory of 4452 436 B9F.tmp 107 PID 4452 wrote to memory of 116 4452 C3B.tmp 108 PID 116 wrote to memory of 1348 116 CC8.tmp 109 PID 1348 wrote to memory of 4032 1348 D45.tmp 110 PID 4032 wrote to memory of 5040 4032 DC2.tmp 112 PID 5040 wrote to memory of 2136 5040 E5E.tmp 114 PID 2136 wrote to memory of 3964 2136 F19.tmp 115 PID 3964 wrote to memory of 3512 3964 FA6.tmp 116 PID 3512 wrote to memory of 4564 3512 1023.tmp 117 PID 4564 wrote to memory of 4388 4564 10DE.tmp 118 PID 4388 wrote to memory of 3840 4388 117B.tmp 119 PID 3840 wrote to memory of 1688 3840 1236.tmp 120 PID 1688 wrote to memory of 3428 1688 12E2.tmp 121 PID 3428 wrote to memory of 1784 3428 134F.tmp 122 PID 1784 wrote to memory of 1500 1784 13AD.tmp 123 PID 1500 wrote to memory of 4700 1500 13FB.tmp 124 PID 4700 wrote to memory of 1668 4700 1449.tmp 125 PID 1668 wrote to memory of 3880 1668 14A7.tmp 126 PID 3880 wrote to memory of 2372 3880 1515.tmp 127 PID 2372 wrote to memory of 4528 2372 1563.tmp 128 PID 4528 wrote to memory of 3744 4528 15B1.tmp 129 PID 3744 wrote to memory of 2828 3744 160F.tmp 130 PID 2828 wrote to memory of 1704 2828 166C.tmp 131 PID 1704 wrote to memory of 1840 1704 16BA.tmp 132 PID 1840 wrote to memory of 516 1840 1709.tmp 133 PID 516 wrote to memory of 4100 516 1766.tmp 134 PID 4100 wrote to memory of 4804 4100 17B4.tmp 135 PID 4804 wrote to memory of 2268 4804 1803.tmp 136 PID 2268 wrote to memory of 3848 2268 1851.tmp 137 PID 3848 wrote to memory of 2812 3848 18AE.tmp 138 PID 2812 wrote to memory of 3344 2812 190C.tmp 139 PID 3344 wrote to memory of 2064 3344 195A.tmp 140 PID 2064 wrote to memory of 2624 2064 19B8.tmp 141 PID 2624 wrote to memory of 4348 2624 1A06.tmp 143 PID 4348 wrote to memory of 2440 4348 1A54.tmp 144 PID 2440 wrote to memory of 4280 2440 1AB2.tmp 145 PID 4280 wrote to memory of 3788 4280 1B00.tmp 146 PID 3788 wrote to memory of 5052 3788 1B4E.tmp 147 PID 5052 wrote to memory of 4544 5052 1BAC.tmp 148 PID 4544 wrote to memory of 3684 4544 1BFA.tmp 149 PID 3684 wrote to memory of 3036 3684 1C68.tmp 150 PID 3036 wrote to memory of 3304 3036 1CB6.tmp 151 PID 3304 wrote to memory of 3308 3304 1D04.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_eeb3094c462f7f72ba8f9ed64278c84f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\73.tmp"C:\Users\Admin\AppData\Local\Temp\73.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1EA.tmp"C:\Users\Admin\AppData\Local\Temp\1EA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\287.tmp"C:\Users\Admin\AppData\Local\Temp\287.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\381.tmp"C:\Users\Admin\AppData\Local\Temp\381.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\40D.tmp"C:\Users\Admin\AppData\Local\Temp\40D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4A9.tmp"C:\Users\Admin\AppData\Local\Temp\4A9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\8E0.tmp"C:\Users\Admin\AppData\Local\Temp\8E0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\B9F.tmp"C:\Users\Admin\AppData\Local\Temp\B9F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\C3B.tmp"C:\Users\Admin\AppData\Local\Temp\C3B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\D45.tmp"C:\Users\Admin\AppData\Local\Temp\D45.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\10DE.tmp"C:\Users\Admin\AppData\Local\Temp\10DE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1515.tmp"C:\Users\Admin\AppData\Local\Temp\1515.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\17B4.tmp"C:\Users\Admin\AppData\Local\Temp\17B4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\18AE.tmp"C:\Users\Admin\AppData\Local\Temp\18AE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1D04.tmp"C:\Users\Admin\AppData\Local\Temp\1D04.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\1D52.tmp"C:\Users\Admin\AppData\Local\Temp\1D52.tmp"65⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"66⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"67⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"68⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"69⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\1F17.tmp"C:\Users\Admin\AppData\Local\Temp\1F17.tmp"70⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\1F65.tmp"C:\Users\Admin\AppData\Local\Temp\1F65.tmp"71⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"72⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"74⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"75⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"76⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\2169.tmp"C:\Users\Admin\AppData\Local\Temp\2169.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"78⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\2215.tmp"C:\Users\Admin\AppData\Local\Temp\2215.tmp"79⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\2263.tmp"C:\Users\Admin\AppData\Local\Temp\2263.tmp"80⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"81⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"82⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"83⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"84⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"85⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\2486.tmp"C:\Users\Admin\AppData\Local\Temp\2486.tmp"86⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"87⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\2532.tmp"C:\Users\Admin\AppData\Local\Temp\2532.tmp"88⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"89⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"90⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\261C.tmp"C:\Users\Admin\AppData\Local\Temp\261C.tmp"91⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"92⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"93⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"94⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"95⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"96⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"97⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\286E.tmp"C:\Users\Admin\AppData\Local\Temp\286E.tmp"98⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\28BC.tmp"C:\Users\Admin\AppData\Local\Temp\28BC.tmp"99⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"100⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"101⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\29C5.tmp"C:\Users\Admin\AppData\Local\Temp\29C5.tmp"102⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\2A14.tmp"C:\Users\Admin\AppData\Local\Temp\2A14.tmp"103⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"104⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"105⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"106⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"107⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"108⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2C27.tmp"C:\Users\Admin\AppData\Local\Temp\2C27.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"110⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"111⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"113⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"114⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2E59.tmp"C:\Users\Admin\AppData\Local\Temp\2E59.tmp"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"117⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"120⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"121⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"122⤵PID:820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-