Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 10:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_fa4af15152ff7381932ca6024c3c0c2f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_fa4af15152ff7381932ca6024c3c0c2f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-12_fa4af15152ff7381932ca6024c3c0c2f_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260712-mthf8aas5s
- SHA256 67e3e7ea0c9c0165cda75f79d3d3f53d4e8b4b5be3f3035dd492588e7cdc2397
- MD5 fa4af15152ff7381932ca6024c3c0c2f
- SHA1 3bb94cd467d30f476235574086daff98959c5193
- SHA512 e67b4f7a724f4e3752c8a1a0bec92f964132617882d07db1aace991f5345fcdb5368d086e53cb3f82e8d65d2515e50dbe2936103bd1048c18f653b151dc80b64
- SSDEEP 12288:HU5rCOTeiJjdSbvQ9rMQb7FTV49kAaxfNZ:HUQOJJYbvQrJTV49kpfN
- TLSH T1F2B4F125B585C032E6D212354AE6EBB26D3BBC705B2294C77B80672E6FB52D1E375303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3020 C03E.tmp 3204 C109.tmp 3848 C196.tmp 412 C251.tmp 960 C31C.tmp 1640 C3D8.tmp 3328 C464.tmp 4332 C4F1.tmp 3536 C5AC.tmp 1324 C639.tmp 2780 C6A6.tmp 4756 C714.tmp 2152 C7B0.tmp 4888 C82D.tmp 2684 C8E9.tmp 4844 C975.tmp 4984 CA11.tmp 1884 CA7F.tmp 4728 CB2B.tmp 1340 CB98.tmp 1864 CC25.tmp 4404 CC92.tmp 4280 CD5D.tmp 3348 CE19.tmp 4228 CEA5.tmp 3828 CF22.tmp 4400 CF90.tmp 4004 D00D.tmp 4824 D099.tmp 628 D126.tmp 3012 D1B3.tmp 2244 D220.tmp 4396 D2BC.tmp 3240 D31A.tmp 3460 D368.tmp 896 D3C6.tmp 3212 D424.tmp 1216 D472.tmp 3956 D4C0.tmp 3024 D51E.tmp 4804 D56C.tmp 4080 D5D9.tmp 4848 D637.tmp 3948 D685.tmp 3920 D6C3.tmp 4244 D712.tmp 4552 D760.tmp 3480 D7AE.tmp 3052 D7FC.tmp 4700 D84A.tmp 4468 D898.tmp 2948 D8E6.tmp 3840 D934.tmp 4188 D983.tmp 3292 D9D1.tmp 2764 DA1F.tmp 2532 DA6D.tmp 3756 DACB.tmp 2496 DB19.tmp 4520 DB67.tmp 1532 DBB5.tmp 4740 DC13.tmp 2656 DC61.tmp 4164 DCBF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 527B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 209E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 3020 4316 2026-07-12_fa4af15152ff7381932ca6024c3c0c2f_elex_mafia_stealc_tofsee.exe 86 PID 3020 wrote to memory of 3204 3020 C03E.tmp 87 PID 3204 wrote to memory of 3848 3204 C109.tmp 88 PID 3848 wrote to memory of 412 3848 C196.tmp 89 PID 412 wrote to memory of 960 412 C251.tmp 90 PID 960 wrote to memory of 1640 960 C31C.tmp 91 PID 1640 wrote to memory of 3328 1640 C3D8.tmp 92 PID 3328 wrote to memory of 4332 3328 C464.tmp 93 PID 4332 wrote to memory of 3536 4332 C4F1.tmp 94 PID 3536 wrote to memory of 1324 3536 C5AC.tmp 95 PID 1324 wrote to memory of 2780 1324 C639.tmp 96 PID 2780 wrote to memory of 4756 2780 C6A6.tmp 97 PID 4756 wrote to memory of 2152 4756 C714.tmp 98 PID 2152 wrote to memory of 4888 2152 C7B0.tmp 99 PID 4888 wrote to memory of 2684 4888 C82D.tmp 100 PID 2684 wrote to memory of 4844 2684 C8E9.tmp 101 PID 4844 wrote to memory of 4984 4844 C975.tmp 102 PID 4984 wrote to memory of 1884 4984 CA11.tmp 103 PID 1884 wrote to memory of 4728 1884 CA7F.tmp 104 PID 4728 wrote to memory of 1340 4728 CB2B.tmp 105 PID 1340 wrote to memory of 1864 1340 CB98.tmp 106 PID 1864 wrote to memory of 4404 1864 CC25.tmp 107 PID 4404 wrote to memory of 4280 4404 CC92.tmp 108 PID 4280 wrote to memory of 3348 4280 CD5D.tmp 109 PID 3348 wrote to memory of 4228 3348 CE19.tmp 110 PID 4228 wrote to memory of 3828 4228 CEA5.tmp 111 PID 3828 wrote to memory of 4400 3828 CF22.tmp 112 PID 4400 wrote to memory of 4004 4400 CF90.tmp 113 PID 4004 wrote to memory of 4824 4004 D00D.tmp 114 PID 4824 wrote to memory of 628 4824 D099.tmp 115 PID 628 wrote to memory of 3012 628 D126.tmp 116 PID 3012 wrote to memory of 2244 3012 D1B3.tmp 117 PID 2244 wrote to memory of 4396 2244 D220.tmp 118 PID 4396 wrote to memory of 3240 4396 D2BC.tmp 119 PID 3240 wrote to memory of 3460 3240 D31A.tmp 120 PID 3460 wrote to memory of 896 3460 D368.tmp 121 PID 896 wrote to memory of 3212 896 D3C6.tmp 122 PID 3212 wrote to memory of 1216 3212 D424.tmp 123 PID 1216 wrote to memory of 3956 1216 D472.tmp 124 PID 3956 wrote to memory of 3024 3956 D4C0.tmp 125 PID 3024 wrote to memory of 4804 3024 D51E.tmp 126 PID 4804 wrote to memory of 4080 4804 D56C.tmp 127 PID 4080 wrote to memory of 4848 4080 D5D9.tmp 128 PID 4848 wrote to memory of 3948 4848 D637.tmp 129 PID 3948 wrote to memory of 3920 3948 D685.tmp 130 PID 3920 wrote to memory of 4244 3920 D6C3.tmp 131 PID 4244 wrote to memory of 4552 4244 D712.tmp 132 PID 4552 wrote to memory of 3480 4552 D760.tmp 133 PID 3480 wrote to memory of 3052 3480 D7AE.tmp 134 PID 3052 wrote to memory of 4700 3052 D7FC.tmp 135 PID 4700 wrote to memory of 4468 4700 D84A.tmp 136 PID 4468 wrote to memory of 2948 4468 D898.tmp 137 PID 2948 wrote to memory of 3840 2948 D8E6.tmp 138 PID 3840 wrote to memory of 4188 3840 D934.tmp 139 PID 4188 wrote to memory of 3292 4188 D983.tmp 140 PID 3292 wrote to memory of 2764 3292 D9D1.tmp 141 PID 2764 wrote to memory of 2532 2764 DA1F.tmp 142 PID 2532 wrote to memory of 3756 2532 DA6D.tmp 143 PID 3756 wrote to memory of 2496 3756 DACB.tmp 144 PID 2496 wrote to memory of 4520 2496 DB19.tmp 145 PID 4520 wrote to memory of 1532 4520 DB67.tmp 146 PID 1532 wrote to memory of 4740 1532 DBB5.tmp 147 PID 4740 wrote to memory of 2656 4740 DC13.tmp 148 PID 2656 wrote to memory of 4164 2656 DC61.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_fa4af15152ff7381932ca6024c3c0c2f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_fa4af15152ff7381932ca6024c3c0c2f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\C03E.tmp"C:\Users\Admin\AppData\Local\Temp\C03E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\C196.tmp"C:\Users\Admin\AppData\Local\Temp\C196.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\C251.tmp"C:\Users\Admin\AppData\Local\Temp\C251.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\C31C.tmp"C:\Users\Admin\AppData\Local\Temp\C31C.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\CF90.tmp"C:\Users\Admin\AppData\Local\Temp\CF90.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\D220.tmp"C:\Users\Admin\AppData\Local\Temp\D220.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D56C.tmp"C:\Users\Admin\AppData\Local\Temp\D56C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\D760.tmp"C:\Users\Admin\AppData\Local\Temp\D760.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\D7AE.tmp"C:\Users\Admin\AppData\Local\Temp\D7AE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D84A.tmp"C:\Users\Admin\AppData\Local\Temp\D84A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\D898.tmp"C:\Users\Admin\AppData\Local\Temp\D898.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\DACB.tmp"C:\Users\Admin\AppData\Local\Temp\DACB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"65⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"66⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"67⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"68⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"69⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\DE84.tmp"C:\Users\Admin\AppData\Local\Temp\DE84.tmp"70⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\DED2.tmp"C:\Users\Admin\AppData\Local\Temp\DED2.tmp"71⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\DF20.tmp"C:\Users\Admin\AppData\Local\Temp\DF20.tmp"72⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"73⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"74⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"75⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\E078.tmp"C:\Users\Admin\AppData\Local\Temp\E078.tmp"76⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"77⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"78⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"79⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"80⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"81⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\E24D.tmp"C:\Users\Admin\AppData\Local\Temp\E24D.tmp"82⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\E29B.tmp"C:\Users\Admin\AppData\Local\Temp\E29B.tmp"83⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"84⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"85⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"86⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"87⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"88⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"89⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"90⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"91⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"92⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"94⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"95⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"96⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"97⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"98⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"99⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\E857.tmp"C:\Users\Admin\AppData\Local\Temp\E857.tmp"100⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"101⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"102⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"103⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"104⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"105⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"106⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"107⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"108⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"109⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\EBA3.tmp"C:\Users\Admin\AppData\Local\Temp\EBA3.tmp"110⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"111⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"113⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\ED49.tmp"C:\Users\Admin\AppData\Local\Temp\ED49.tmp"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\ED97.tmp"C:\Users\Admin\AppData\Local\Temp\ED97.tmp"116⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\EE05.tmp"C:\Users\Admin\AppData\Local\Temp\EE05.tmp"117⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\EE53.tmp"C:\Users\Admin\AppData\Local\Temp\EE53.tmp"118⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"119⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"120⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"121⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"122⤵PID:4988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-