Analysis
- max time kernel
113s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_0672cd186114b237b091b8f61f80e57b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_0672cd186114b237b091b8f61f80e57b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_0672cd186114b237b091b8f61f80e57b_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260730-ch3ynsbm2t
- SHA256 af19536a0d9c0b63c1d3168b8e6b15271d7322f004a2bd2f24ce7bf824fbecc5
- MD5 0672cd186114b237b091b8f61f80e57b
- SHA1 7f914e15b999aed94a0d57674ec43c84e6fa899f
- SHA512 5f4247b9418c0aee1fae604b9375c6a0a9e29dc4806269d5a1490017380dbe4013af887c8a000273699160f2cf7b75447d8c051e42d59b324e3fdbf5d30b8b25
- SSDEEP 12288:wU5rCOTeiDC71YbTEEiak4VvEtIHvQNNZ+3/v+I9hUG2VA:wUQOJDWabOaN5U+ENGEA
- TLSH T1ACE4E02173DC8532E5FB037859B5E665497EBD326722D6CF2F9012AE09B1BC08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2884 DD37.tmp 4248 DE12.tmp 4236 DFB8.tmp 1476 E0D1.tmp 2196 E1FA.tmp 4860 E296.tmp 3080 E303.tmp 3952 E47A.tmp 2840 E574.tmp 2584 E6AD.tmp 5008 E7C6.tmp 6108 E8D0.tmp 4840 E9BA.tmp 1448 EAC4.tmp 2696 EBAE.tmp 5836 EC89.tmp 5632 EDC1.tmp 5220 EEEA.tmp 712 EFE4.tmp 2676 F0BF.tmp 2808 F1A9.tmp 4616 F2E2.tmp 1252 F3BD.tmp 4916 F4A7.tmp 4728 F5A1.tmp 3092 F67C.tmp 4520 F795.tmp 4392 F8ED.tmp 1560 FA06.tmp 5284 FB7D.tmp 4000 FC67.tmp 1412 FD90.tmp 5096 FE8A.tmp 2396 FF55.tmp 1316 30.tmp 2012 EC.tmp 1588 197.tmp 3544 263.tmp 4384 2FF.tmp 1516 3AB.tmp 256 466.tmp 3988 502.tmp 4436 5CE.tmp 4240 699.tmp 1180 764.tmp 4048 82F.tmp 3532 929.tmp 4780 9E4.tmp 5664 A81.tmp 3112 B0D.tmp 5592 B8A.tmp 2720 C27.tmp 5332 CB3.tmp 4136 D21.tmp 3752 DBD.tmp 3440 E2A.tmp 5128 EB7.tmp 1432 F34.tmp 4272 FC0.tmp 1836 104D.tmp 5708 10BA.tmp 2420 1137.tmp 5536 11D4.tmp 3492 1280.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 653E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8837.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A818.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 681D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2884 2636 2026-07-29_0672cd186114b237b091b8f61f80e57b_elex_mafia_stealc_tofsee.exe 88 PID 2884 wrote to memory of 4248 2884 DD37.tmp 89 PID 4248 wrote to memory of 4236 4248 DE12.tmp 90 PID 4236 wrote to memory of 1476 4236 DFB8.tmp 91 PID 1476 wrote to memory of 2196 1476 E0D1.tmp 92 PID 2196 wrote to memory of 4860 2196 E1FA.tmp 93 PID 4860 wrote to memory of 3080 4860 E296.tmp 94 PID 3080 wrote to memory of 3952 3080 E303.tmp 95 PID 3952 wrote to memory of 2840 3952 E47A.tmp 96 PID 2840 wrote to memory of 2584 2840 E574.tmp 97 PID 2584 wrote to memory of 5008 2584 E6AD.tmp 98 PID 5008 wrote to memory of 6108 5008 E7C6.tmp 99 PID 6108 wrote to memory of 4840 6108 E8D0.tmp 100 PID 4840 wrote to memory of 1448 4840 E9BA.tmp 101 PID 1448 wrote to memory of 2696 1448 EAC4.tmp 102 PID 2696 wrote to memory of 5836 2696 EBAE.tmp 103 PID 5836 wrote to memory of 5632 5836 EC89.tmp 104 PID 5632 wrote to memory of 5220 5632 EDC1.tmp 105 PID 5220 wrote to memory of 712 5220 EEEA.tmp 106 PID 712 wrote to memory of 2676 712 EFE4.tmp 107 PID 2676 wrote to memory of 2808 2676 F0BF.tmp 108 PID 2808 wrote to memory of 4616 2808 F1A9.tmp 109 PID 4616 wrote to memory of 1252 4616 F2E2.tmp 110 PID 1252 wrote to memory of 4916 1252 F3BD.tmp 111 PID 4916 wrote to memory of 4728 4916 F4A7.tmp 112 PID 4728 wrote to memory of 3092 4728 F5A1.tmp 113 PID 3092 wrote to memory of 4520 3092 F67C.tmp 114 PID 4520 wrote to memory of 4392 4520 F795.tmp 115 PID 4392 wrote to memory of 1560 4392 F8ED.tmp 116 PID 1560 wrote to memory of 5284 1560 FA06.tmp 117 PID 5284 wrote to memory of 4000 5284 FB7D.tmp 118 PID 4000 wrote to memory of 1412 4000 FC67.tmp 119 PID 1412 wrote to memory of 5096 1412 FD90.tmp 120 PID 5096 wrote to memory of 2396 5096 FE8A.tmp 121 PID 2396 wrote to memory of 1316 2396 FF55.tmp 122 PID 1316 wrote to memory of 2012 1316 30.tmp 123 PID 2012 wrote to memory of 1588 2012 EC.tmp 124 PID 1588 wrote to memory of 3544 1588 197.tmp 125 PID 3544 wrote to memory of 4384 3544 263.tmp 126 PID 4384 wrote to memory of 1516 4384 2FF.tmp 127 PID 1516 wrote to memory of 256 1516 3AB.tmp 128 PID 256 wrote to memory of 3988 256 466.tmp 129 PID 3988 wrote to memory of 4436 3988 502.tmp 130 PID 4436 wrote to memory of 4240 4436 5CE.tmp 131 PID 4240 wrote to memory of 1180 4240 699.tmp 132 PID 1180 wrote to memory of 4048 1180 764.tmp 133 PID 4048 wrote to memory of 3532 4048 82F.tmp 134 PID 3532 wrote to memory of 4780 3532 929.tmp 135 PID 4780 wrote to memory of 5664 4780 9E4.tmp 136 PID 5664 wrote to memory of 3112 5664 A81.tmp 137 PID 3112 wrote to memory of 5592 3112 B0D.tmp 138 PID 5592 wrote to memory of 2720 5592 B8A.tmp 139 PID 2720 wrote to memory of 5332 2720 C27.tmp 140 PID 5332 wrote to memory of 4136 5332 CB3.tmp 141 PID 4136 wrote to memory of 3752 4136 D21.tmp 142 PID 3752 wrote to memory of 3440 3752 DBD.tmp 143 PID 3440 wrote to memory of 5128 3440 E2A.tmp 144 PID 5128 wrote to memory of 1432 5128 EB7.tmp 145 PID 1432 wrote to memory of 4272 1432 F34.tmp 146 PID 4272 wrote to memory of 1836 4272 FC0.tmp 147 PID 1836 wrote to memory of 5708 1836 104D.tmp 148 PID 5708 wrote to memory of 2420 5708 10BA.tmp 149 PID 2420 wrote to memory of 5536 2420 1137.tmp 150 PID 5536 wrote to memory of 3492 5536 11D4.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_0672cd186114b237b091b8f61f80e57b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_0672cd186114b237b091b8f61f80e57b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\DE12.tmp"C:\Users\Admin\AppData\Local\Temp\DE12.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\E47A.tmp"C:\Users\Admin\AppData\Local\Temp\E47A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\E574.tmp"C:\Users\Admin\AppData\Local\Temp\E574.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\F67C.tmp"C:\Users\Admin\AppData\Local\Temp\F67C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\82F.tmp"C:\Users\Admin\AppData\Local\Temp\82F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\A81.tmp"C:\Users\Admin\AppData\Local\Temp\A81.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\C27.tmp"C:\Users\Admin\AppData\Local\Temp\C27.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\CB3.tmp"C:\Users\Admin\AppData\Local\Temp\CB3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\FC0.tmp"C:\Users\Admin\AppData\Local\Temp\FC0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\10BA.tmp"C:\Users\Admin\AppData\Local\Temp\10BA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\1137.tmp"C:\Users\Admin\AppData\Local\Temp\1137.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\1280.tmp"C:\Users\Admin\AppData\Local\Temp\1280.tmp"65⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\12ED.tmp"C:\Users\Admin\AppData\Local\Temp\12ED.tmp"66⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"67⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"69⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"70⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\15AC.tmp"C:\Users\Admin\AppData\Local\Temp\15AC.tmp"71⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"72⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"73⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\17B0.tmp"C:\Users\Admin\AppData\Local\Temp\17B0.tmp"74⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"75⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\18D9.tmp"C:\Users\Admin\AppData\Local\Temp\18D9.tmp"76⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\1984.tmp"C:\Users\Admin\AppData\Local\Temp\1984.tmp"77⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\1A01.tmp"C:\Users\Admin\AppData\Local\Temp\1A01.tmp"78⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"79⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"80⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\1B98.tmp"C:\Users\Admin\AppData\Local\Temp\1B98.tmp"81⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"82⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"83⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"C:\Users\Admin\AppData\Local\Temp\1D1E.tmp"84⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"85⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"86⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"87⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1F41.tmp"C:\Users\Admin\AppData\Local\Temp\1F41.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"89⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"90⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\20F7.tmp"C:\Users\Admin\AppData\Local\Temp\20F7.tmp"91⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"92⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"93⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2358.tmp"C:\Users\Admin\AppData\Local\Temp\2358.tmp"95⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\23F4.tmp"C:\Users\Admin\AppData\Local\Temp\23F4.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"97⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"98⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"100⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"101⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"103⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\2859.tmp"C:\Users\Admin\AppData\Local\Temp\2859.tmp"104⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\28D6.tmp"C:\Users\Admin\AppData\Local\Temp\28D6.tmp"105⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2963.tmp"C:\Users\Admin\AppData\Local\Temp\2963.tmp"106⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"107⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"C:\Users\Admin\AppData\Local\Temp\2ABB.tmp"108⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\2B57.tmp"C:\Users\Admin\AppData\Local\Temp\2B57.tmp"109⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"110⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"111⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2CED.tmp"C:\Users\Admin\AppData\Local\Temp\2CED.tmp"112⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"114⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2E74.tmp"C:\Users\Admin\AppData\Local\Temp\2E74.tmp"115⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"116⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"117⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\300A.tmp"C:\Users\Admin\AppData\Local\Temp\300A.tmp"118⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"119⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"120⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\31A0.tmp"C:\Users\Admin\AppData\Local\Temp\31A0.tmp"121⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\324C.tmp"C:\Users\Admin\AppData\Local\Temp\324C.tmp"122⤵PID:508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-