Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_be5ac9d9ce296b30195a1c4e44395e62_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_be5ac9d9ce296b30195a1c4e44395e62_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-27_be5ac9d9ce296b30195a1c4e44395e62_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260629-dw2hfab16w
- SHA256 65e6d9e57c9475f941bbd7aaf05b77ca1d50ef8c30d79c0e15f9ecd6fc195db6
- MD5 be5ac9d9ce296b30195a1c4e44395e62
- SHA1 4fc721177537155f2d02fc72d9993c536d68ec7e
- SHA512 e3551499c7a535426422884ce698abe62b095d92385f10dbe9ecf630317221ab15eb28f111ca8c9c373195aca7093d6d2c123902686ec8a425cb6a983957cd2d
- SSDEEP 12288:wU5rCOTeiDTySPnHXgfp0CJ8h5NZ+3/v+I9hUG2VA:wUQOJDTy+Qe5NGEA
- TLSH T110E4D02177D8C532D5F7037859B5E6654D7EBD22A722D6CF2F8026AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4920 FA5E.tmp 2256 FAFA.tmp 3512 FBD5.tmp 3840 FC90.tmp 3804 FD2C.tmp 1756 FDB9.tmp 1240 FE26.tmp 5540 FEA3.tmp 408 FF40.tmp 1924 FFFB.tmp 432 A7.tmp 1132 114.tmp 4380 172.tmp 5192 1FF.tmp 1148 25C.tmp 5220 2BA.tmp 3956 328.tmp 2548 3D3.tmp 3224 412.tmp 452 4CD.tmp 2776 54A.tmp 1508 5B8.tmp 6080 606.tmp 892 644.tmp 4992 71F.tmp 3808 76D.tmp 5532 7FA.tmp 2412 877.tmp 4588 8D5.tmp 3908 952.tmp 5748 A2C.tmp 2792 A7B.tmp 4340 AF8.tmp 1600 B84.tmp 3220 BC3.tmp 3320 C01.tmp 5792 C5F.tmp 896 CBD.tmp 5932 CFB.tmp 5508 D3A.tmp 4160 D88.tmp 2688 DD6.tmp 1188 E14.tmp 5212 E63.tmp 3336 ED0.tmp 2980 F0E.tmp 5840 F5D.tmp 5604 F9B.tmp 772 FE9.tmp 6036 1037.tmp 2488 1085.tmp 220 10D4.tmp 4120 1122.tmp 5296 1160.tmp 5716 11AE.tmp 5656 11FC.tmp 4404 124B.tmp 4412 1299.tmp 3364 12F6.tmp 6104 1345.tmp 932 1393.tmp 5240 13E1.tmp 4592 142F.tmp 1096 148D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 357D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 363E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3350.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 874C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0CD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4920 4860 2026-06-27_be5ac9d9ce296b30195a1c4e44395e62_elex_mafia_stealc_tofsee.exe 86 PID 4920 wrote to memory of 2256 4920 FA5E.tmp 87 PID 2256 wrote to memory of 3512 2256 FAFA.tmp 88 PID 3512 wrote to memory of 3840 3512 FBD5.tmp 89 PID 3840 wrote to memory of 3804 3840 FC90.tmp 90 PID 3804 wrote to memory of 1756 3804 FD2C.tmp 91 PID 1756 wrote to memory of 1240 1756 FDB9.tmp 92 PID 1240 wrote to memory of 5540 1240 FE26.tmp 93 PID 5540 wrote to memory of 408 5540 FEA3.tmp 94 PID 408 wrote to memory of 1924 408 FF40.tmp 95 PID 1924 wrote to memory of 432 1924 FFFB.tmp 96 PID 432 wrote to memory of 1132 432 A7.tmp 97 PID 1132 wrote to memory of 4380 1132 114.tmp 98 PID 4380 wrote to memory of 5192 4380 172.tmp 99 PID 5192 wrote to memory of 1148 5192 1FF.tmp 100 PID 1148 wrote to memory of 5220 1148 25C.tmp 101 PID 5220 wrote to memory of 3956 5220 2BA.tmp 102 PID 3956 wrote to memory of 2548 3956 328.tmp 103 PID 2548 wrote to memory of 3224 2548 3D3.tmp 104 PID 3224 wrote to memory of 452 3224 412.tmp 105 PID 452 wrote to memory of 2776 452 4CD.tmp 106 PID 2776 wrote to memory of 1508 2776 54A.tmp 107 PID 1508 wrote to memory of 6080 1508 5B8.tmp 108 PID 6080 wrote to memory of 892 6080 606.tmp 109 PID 892 wrote to memory of 4992 892 644.tmp 110 PID 4992 wrote to memory of 3808 4992 71F.tmp 111 PID 3808 wrote to memory of 5532 3808 76D.tmp 112 PID 5532 wrote to memory of 2412 5532 7FA.tmp 113 PID 2412 wrote to memory of 4588 2412 877.tmp 114 PID 4588 wrote to memory of 3908 4588 8D5.tmp 115 PID 3908 wrote to memory of 5748 3908 952.tmp 116 PID 5748 wrote to memory of 2792 5748 A2C.tmp 117 PID 2792 wrote to memory of 4340 2792 A7B.tmp 118 PID 4340 wrote to memory of 1600 4340 AF8.tmp 119 PID 1600 wrote to memory of 3220 1600 B84.tmp 120 PID 3220 wrote to memory of 3320 3220 BC3.tmp 121 PID 3320 wrote to memory of 5792 3320 C01.tmp 122 PID 5792 wrote to memory of 896 5792 C5F.tmp 123 PID 896 wrote to memory of 5932 896 CBD.tmp 124 PID 5932 wrote to memory of 5508 5932 CFB.tmp 125 PID 5508 wrote to memory of 4160 5508 D3A.tmp 126 PID 4160 wrote to memory of 2688 4160 D88.tmp 127 PID 2688 wrote to memory of 1188 2688 DD6.tmp 128 PID 1188 wrote to memory of 5212 1188 E14.tmp 129 PID 5212 wrote to memory of 3336 5212 E63.tmp 130 PID 3336 wrote to memory of 2980 3336 ED0.tmp 131 PID 2980 wrote to memory of 5840 2980 F0E.tmp 132 PID 5840 wrote to memory of 5604 5840 F5D.tmp 133 PID 5604 wrote to memory of 772 5604 F9B.tmp 134 PID 772 wrote to memory of 6036 772 FE9.tmp 135 PID 6036 wrote to memory of 2488 6036 1037.tmp 136 PID 2488 wrote to memory of 220 2488 1085.tmp 137 PID 220 wrote to memory of 4120 220 10D4.tmp 138 PID 4120 wrote to memory of 5296 4120 1122.tmp 139 PID 5296 wrote to memory of 5716 5296 1160.tmp 140 PID 5716 wrote to memory of 5656 5716 11AE.tmp 141 PID 5656 wrote to memory of 4404 5656 11FC.tmp 142 PID 4404 wrote to memory of 4412 4404 124B.tmp 143 PID 4412 wrote to memory of 3364 4412 1299.tmp 144 PID 3364 wrote to memory of 6104 3364 12F6.tmp 145 PID 6104 wrote to memory of 932 6104 1345.tmp 146 PID 932 wrote to memory of 5240 932 1393.tmp 147 PID 5240 wrote to memory of 4592 5240 13E1.tmp 148 PID 4592 wrote to memory of 1096 4592 142F.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_be5ac9d9ce296b30195a1c4e44395e62_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_be5ac9d9ce296b30195a1c4e44395e62_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"65⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"66⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"67⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"68⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"69⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"70⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"71⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"72⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"73⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"75⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"76⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"77⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"78⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"79⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"80⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"81⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"82⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"83⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"84⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"85⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"86⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"87⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"88⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"89⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"90⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"91⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"92⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"93⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"94⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"95⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"96⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"97⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"98⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"99⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"100⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"101⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"102⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"103⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"104⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"105⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"106⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"107⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"108⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"109⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"110⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"111⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"112⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"113⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"114⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"115⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"116⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"117⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"118⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"119⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"120⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"121⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-