Analysis
- max time kernel
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_e17b1f6f07334ea1649a6d95c00bf9e8_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_e17b1f6f07334ea1649a6d95c00bf9e8_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-27_e17b1f6f07334ea1649a6d95c00bf9e8_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260629-cf5pgsbz8m
- SHA256 1f4137d5e1c7edc5317b4773220fecb24533b784527895c33136a7d0396b30d1
- MD5 e17b1f6f07334ea1649a6d95c00bf9e8
- SHA1 e6ec79daf4246c610773c56abaf4fc74d9fb395a
- SHA512 bb4046011603c485c5458e6d2d825fad1102c32d2b9d3e2c0221ee22d5dfc06e0c49e88c0d156cff6150f7c7b5dfbfad0e9ffdc5afe6a4c0f563f4c69014039f
- SSDEEP 12288:NU5rCOTeijNLtBrb0qQWWhuAB4ZHCTZwlH4Hp:NUQOJjBthb5WhZTSlH4Hp
- TLSH T1CFB4F121B245C133E69202711BD6EBE2AA3BBC75572690C73B94963D2FB23E1D375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5084 ADB0.tmp 6112 AEC9.tmp 4972 B050.tmp 5400 B14A.tmp 3380 B215.tmp 1680 B292.tmp 5876 B37C.tmp 4792 B59F.tmp 4460 B65B.tmp 5488 B716.tmp 760 B820.tmp 1612 B8CC.tmp 1476 B9A6.tmp 5948 BA81.tmp 1104 BB5C.tmp 5044 BC37.tmp 5016 BD40.tmp 5072 BE4A.tmp 1700 BEF6.tmp 5180 BF92.tmp 4120 C04D.tmp 4784 C109.tmp 2864 C1B5.tmp 1740 C270.tmp 4948 C36A.tmp 2468 C426.tmp 3040 C520.tmp 1980 C5CC.tmp 4640 C697.tmp 624 C752.tmp 3784 C82D.tmp 1272 C8F8.tmp 5700 C9B4.tmp 1892 CA50.tmp 3388 CADD.tmp 3732 CB4A.tmp 5520 CC05.tmp 3856 CC82.tmp 5324 CCF0.tmp 3252 CD8C.tmp 1588 CE28.tmp 2104 CEC5.tmp 2244 CF32.tmp 5704 CF9F.tmp 2196 D00D.tmp 3032 D099.tmp 4648 D145.tmp 5864 D1F1.tmp 5484 D26E.tmp 1172 D2FB.tmp 1148 D397.tmp 2580 D414.tmp 4252 D481.tmp 6048 D4FE.tmp 5660 D59B.tmp 4708 D627.tmp 1648 D6A4.tmp 2656 D740.tmp 2792 D7DD.tmp 4780 D879.tmp 5392 D906.tmp 1312 D992.tmp 2060 DA2E.tmp 2004 DAAB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 212A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 278E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A09B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B49.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 5084 1196 2026-06-27_e17b1f6f07334ea1649a6d95c00bf9e8_elex_mafia_stealc_tofsee.exe 89 PID 5084 wrote to memory of 6112 5084 ADB0.tmp 90 PID 6112 wrote to memory of 4972 6112 AEC9.tmp 91 PID 4972 wrote to memory of 5400 4972 B050.tmp 92 PID 5400 wrote to memory of 3380 5400 B14A.tmp 93 PID 3380 wrote to memory of 1680 3380 B215.tmp 94 PID 1680 wrote to memory of 5876 1680 B292.tmp 95 PID 5876 wrote to memory of 4792 5876 B37C.tmp 96 PID 4792 wrote to memory of 4460 4792 B59F.tmp 97 PID 4460 wrote to memory of 5488 4460 B65B.tmp 98 PID 5488 wrote to memory of 760 5488 B716.tmp 99 PID 760 wrote to memory of 1612 760 B820.tmp 100 PID 1612 wrote to memory of 1476 1612 B8CC.tmp 101 PID 1476 wrote to memory of 5948 1476 B9A6.tmp 102 PID 5948 wrote to memory of 1104 5948 BA81.tmp 103 PID 1104 wrote to memory of 5044 1104 BB5C.tmp 104 PID 5044 wrote to memory of 5016 5044 BC37.tmp 105 PID 5016 wrote to memory of 5072 5016 BD40.tmp 106 PID 5072 wrote to memory of 1700 5072 BE4A.tmp 107 PID 1700 wrote to memory of 5180 1700 BEF6.tmp 108 PID 5180 wrote to memory of 4120 5180 BF92.tmp 109 PID 4120 wrote to memory of 4784 4120 C04D.tmp 110 PID 4784 wrote to memory of 2864 4784 C109.tmp 111 PID 2864 wrote to memory of 1740 2864 C1B5.tmp 112 PID 1740 wrote to memory of 4948 1740 C270.tmp 113 PID 4948 wrote to memory of 2468 4948 C36A.tmp 114 PID 2468 wrote to memory of 3040 2468 C426.tmp 115 PID 3040 wrote to memory of 1980 3040 C520.tmp 116 PID 1980 wrote to memory of 4640 1980 C5CC.tmp 117 PID 4640 wrote to memory of 624 4640 C697.tmp 118 PID 624 wrote to memory of 3784 624 C752.tmp 119 PID 3784 wrote to memory of 1272 3784 C82D.tmp 120 PID 1272 wrote to memory of 5700 1272 C8F8.tmp 121 PID 5700 wrote to memory of 1892 5700 C9B4.tmp 122 PID 1892 wrote to memory of 3388 1892 CA50.tmp 123 PID 3388 wrote to memory of 3732 3388 CADD.tmp 124 PID 3732 wrote to memory of 5520 3732 CB4A.tmp 125 PID 5520 wrote to memory of 3856 5520 CC05.tmp 126 PID 3856 wrote to memory of 5324 3856 CC82.tmp 127 PID 5324 wrote to memory of 3252 5324 CCF0.tmp 128 PID 3252 wrote to memory of 1588 3252 CD8C.tmp 129 PID 1588 wrote to memory of 2104 1588 CE28.tmp 130 PID 2104 wrote to memory of 2244 2104 CEC5.tmp 131 PID 2244 wrote to memory of 5704 2244 CF32.tmp 132 PID 5704 wrote to memory of 2196 5704 CF9F.tmp 133 PID 2196 wrote to memory of 3032 2196 D00D.tmp 134 PID 3032 wrote to memory of 4648 3032 D099.tmp 135 PID 4648 wrote to memory of 5864 4648 D145.tmp 136 PID 5864 wrote to memory of 5484 5864 D1F1.tmp 137 PID 5484 wrote to memory of 1172 5484 D26E.tmp 138 PID 1172 wrote to memory of 1148 1172 D2FB.tmp 139 PID 1148 wrote to memory of 2580 1148 D397.tmp 140 PID 2580 wrote to memory of 4252 2580 D414.tmp 141 PID 4252 wrote to memory of 6048 4252 D481.tmp 142 PID 6048 wrote to memory of 5660 6048 D4FE.tmp 143 PID 5660 wrote to memory of 4708 5660 D59B.tmp 144 PID 4708 wrote to memory of 1648 4708 D627.tmp 145 PID 1648 wrote to memory of 2656 1648 D6A4.tmp 146 PID 2656 wrote to memory of 2792 2656 D740.tmp 147 PID 2792 wrote to memory of 4780 2792 D7DD.tmp 148 PID 4780 wrote to memory of 5392 4780 D879.tmp 149 PID 5392 wrote to memory of 1312 5392 D906.tmp 150 PID 1312 wrote to memory of 2060 1312 D992.tmp 151 PID 2060 wrote to memory of 2004 2060 DA2E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_e17b1f6f07334ea1649a6d95c00bf9e8_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_e17b1f6f07334ea1649a6d95c00bf9e8_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\B050.tmp"C:\Users\Admin\AppData\Local\Temp\B050.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\B14A.tmp"C:\Users\Admin\AppData\Local\Temp\B14A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\B215.tmp"C:\Users\Admin\AppData\Local\Temp\B215.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\B292.tmp"C:\Users\Admin\AppData\Local\Temp\B292.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\B820.tmp"C:\Users\Admin\AppData\Local\Temp\B820.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\BA81.tmp"C:\Users\Admin\AppData\Local\Temp\BA81.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\BD40.tmp"C:\Users\Admin\AppData\Local\Temp\BD40.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\C36A.tmp"C:\Users\Admin\AppData\Local\Temp\C36A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\C426.tmp"C:\Users\Admin\AppData\Local\Temp\C426.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\C697.tmp"C:\Users\Admin\AppData\Local\Temp\C697.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\CA50.tmp"C:\Users\Admin\AppData\Local\Temp\CA50.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\CC82.tmp"C:\Users\Admin\AppData\Local\Temp\CC82.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\D145.tmp"C:\Users\Admin\AppData\Local\Temp\D145.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\D414.tmp"C:\Users\Admin\AppData\Local\Temp\D414.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\D481.tmp"C:\Users\Admin\AppData\Local\Temp\D481.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D740.tmp"C:\Users\Admin\AppData\Local\Temp\D740.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\D906.tmp"C:\Users\Admin\AppData\Local\Temp\D906.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"65⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\DB57.tmp"C:\Users\Admin\AppData\Local\Temp\DB57.tmp"66⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"67⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\DC42.tmp"C:\Users\Admin\AppData\Local\Temp\DC42.tmp"68⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"69⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"70⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"71⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\DE74.tmp"C:\Users\Admin\AppData\Local\Temp\DE74.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"73⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"74⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"75⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"76⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\E133.tmp"C:\Users\Admin\AppData\Local\Temp\E133.tmp"77⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"78⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"79⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"80⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"81⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"82⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"84⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"87⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"88⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"89⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"90⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\E923.tmp"C:\Users\Admin\AppData\Local\Temp\E923.tmp"91⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"93⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"94⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\EB74.tmp"C:\Users\Admin\AppData\Local\Temp\EB74.tmp"95⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"96⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"97⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"98⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"99⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"100⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"101⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"102⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"104⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"105⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"106⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"107⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"108⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"109⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"110⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\F558.tmp"C:\Users\Admin\AppData\Local\Temp\F558.tmp"112⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"113⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\F632.tmp"C:\Users\Admin\AppData\Local\Temp\F632.tmp"114⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"115⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\F74C.tmp"C:\Users\Admin\AppData\Local\Temp\F74C.tmp"116⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"117⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\F836.tmp"C:\Users\Admin\AppData\Local\Temp\F836.tmp"118⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"119⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\F94F.tmp"C:\Users\Admin\AppData\Local\Temp\F94F.tmp"120⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"121⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"122⤵PID:4544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-