Analysis
- max time kernel
127s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_8ac535011fa8c74cac1c41972b20f32f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_8ac535011fa8c74cac1c41972b20f32f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_8ac535011fa8c74cac1c41972b20f32f_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260803-dsty7abm9z
- SHA256 81e035af93559520a75cc3d58c957d9a08fbf7237e640f3eb722e488dc71af5f
- MD5 8ac535011fa8c74cac1c41972b20f32f
- SHA1 ff080f4f05dab883eb038e1b228e4b1dd9b1f226
- SHA512 2de05a8561b42e7d9a77a523157b3f6b06ef82f07da282f3d745961e35634cb280c6b1eb786cc0f2f001978182d961d1eea8c63d99cfae6cf9028eff8a64b607
- SSDEEP 12288:9U5rCOTei6QefkA397mMpmkMXIYaJAbSIPb/ga0qZoXWjdqpby1grA70G+o:9UQOJ6Qef7NrEjnExIPb70qqGh4yATXo
- TLSH T10EE40121BA84C432FAC612314FE1EBB21A6A7D745B2664C77BC46B7D2F712D1A334316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4980 469F.tmp 4908 473C.tmp 2632 4826.tmp 1800 48F1.tmp 3140 4A1A.tmp 4380 4B24.tmp 2200 4BFE.tmp 1552 4CBA.tmp 5988 4D27.tmp 5752 4E21.tmp 5936 4F1B.tmp 4816 5015.tmp 3924 514E.tmp 616 5277.tmp 5624 5303.tmp 2036 53BF.tmp 4036 54B9.tmp 6108 55C2.tmp 2892 566E.tmp 2392 5797.tmp 4524 5853.tmp 4020 592D.tmp 2000 5A27.tmp 1364 5B02.tmp 1044 5BFC.tmp 4560 5CF6.tmp 5708 5DB2.tmp 4452 5E4E.tmp 612 5F29.tmp 6088 6003.tmp 2152 60FD.tmp 5588 61A9.tmp 2056 6255.tmp 696 62E2.tmp 5816 635F.tmp 4604 63FB.tmp 1716 6497.tmp 2164 6533.tmp 1524 65B0.tmp 1080 663D.tmp 2652 66CA.tmp 5512 6756.tmp 3328 67E3.tmp 1176 6870.tmp 5336 690C.tmp 1268 6998.tmp 4780 6A25.tmp 5904 6AA2.tmp 5704 6B1F.tmp 2772 6BAC.tmp 4224 6C67.tmp 1740 6D03.tmp 5848 6DA0.tmp 2852 6E3C.tmp 3128 6EB9.tmp 4556 6F46.tmp 5000 6FC3.tmp 4348 705F.tmp 3136 70CC.tmp 3928 7149.tmp 2748 71B7.tmp 5256 7224.tmp 8 72A1.tmp 5640 734D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9007.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 347A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 514E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 563B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 588C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 873D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 138F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 409F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9612.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5715.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9915.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 4980 4444 2026-08-02_8ac535011fa8c74cac1c41972b20f32f_elex_mafia_stealc_tofsee.exe 90 PID 4980 wrote to memory of 4908 4980 469F.tmp 91 PID 4908 wrote to memory of 2632 4908 473C.tmp 92 PID 2632 wrote to memory of 1800 2632 4826.tmp 93 PID 1800 wrote to memory of 3140 1800 48F1.tmp 94 PID 3140 wrote to memory of 4380 3140 4A1A.tmp 95 PID 4380 wrote to memory of 2200 4380 4B24.tmp 96 PID 2200 wrote to memory of 1552 2200 4BFE.tmp 97 PID 1552 wrote to memory of 5988 1552 4CBA.tmp 98 PID 5988 wrote to memory of 5752 5988 4D27.tmp 99 PID 5752 wrote to memory of 5936 5752 4E21.tmp 100 PID 5936 wrote to memory of 4816 5936 4F1B.tmp 101 PID 4816 wrote to memory of 3924 4816 5015.tmp 102 PID 3924 wrote to memory of 616 3924 514E.tmp 103 PID 616 wrote to memory of 5624 616 5277.tmp 104 PID 5624 wrote to memory of 2036 5624 5303.tmp 105 PID 2036 wrote to memory of 4036 2036 53BF.tmp 106 PID 4036 wrote to memory of 6108 4036 54B9.tmp 107 PID 6108 wrote to memory of 2892 6108 55C2.tmp 108 PID 2892 wrote to memory of 2392 2892 566E.tmp 109 PID 2392 wrote to memory of 4524 2392 5797.tmp 110 PID 4524 wrote to memory of 4020 4524 5853.tmp 111 PID 4020 wrote to memory of 2000 4020 592D.tmp 112 PID 2000 wrote to memory of 1364 2000 5A27.tmp 113 PID 1364 wrote to memory of 1044 1364 5B02.tmp 114 PID 1044 wrote to memory of 4560 1044 5BFC.tmp 115 PID 4560 wrote to memory of 5708 4560 5CF6.tmp 116 PID 5708 wrote to memory of 4452 5708 5DB2.tmp 117 PID 4452 wrote to memory of 612 4452 5E4E.tmp 118 PID 612 wrote to memory of 6088 612 5F29.tmp 119 PID 6088 wrote to memory of 2152 6088 6003.tmp 120 PID 2152 wrote to memory of 5588 2152 60FD.tmp 121 PID 5588 wrote to memory of 2056 5588 61A9.tmp 122 PID 2056 wrote to memory of 696 2056 6255.tmp 123 PID 696 wrote to memory of 5816 696 62E2.tmp 124 PID 5816 wrote to memory of 4604 5816 635F.tmp 125 PID 4604 wrote to memory of 1716 4604 63FB.tmp 126 PID 1716 wrote to memory of 2164 1716 6497.tmp 127 PID 2164 wrote to memory of 1524 2164 6533.tmp 128 PID 1524 wrote to memory of 1080 1524 65B0.tmp 129 PID 1080 wrote to memory of 2652 1080 663D.tmp 130 PID 2652 wrote to memory of 5512 2652 66CA.tmp 131 PID 5512 wrote to memory of 3328 5512 6756.tmp 132 PID 3328 wrote to memory of 1176 3328 67E3.tmp 133 PID 1176 wrote to memory of 5336 1176 6870.tmp 134 PID 5336 wrote to memory of 1268 5336 690C.tmp 135 PID 1268 wrote to memory of 4780 1268 6998.tmp 136 PID 4780 wrote to memory of 5904 4780 6A25.tmp 137 PID 5904 wrote to memory of 5704 5904 6AA2.tmp 138 PID 5704 wrote to memory of 2772 5704 6B1F.tmp 139 PID 2772 wrote to memory of 4224 2772 6BAC.tmp 140 PID 4224 wrote to memory of 1740 4224 6C67.tmp 141 PID 1740 wrote to memory of 5848 1740 6D03.tmp 142 PID 5848 wrote to memory of 2852 5848 6DA0.tmp 143 PID 2852 wrote to memory of 3128 2852 6E3C.tmp 144 PID 3128 wrote to memory of 4556 3128 6EB9.tmp 145 PID 4556 wrote to memory of 5000 4556 6F46.tmp 146 PID 5000 wrote to memory of 4348 5000 6FC3.tmp 147 PID 4348 wrote to memory of 3136 4348 705F.tmp 148 PID 3136 wrote to memory of 3928 3136 70CC.tmp 149 PID 3928 wrote to memory of 2748 3928 7149.tmp 150 PID 2748 wrote to memory of 5256 2748 71B7.tmp 151 PID 5256 wrote to memory of 8 5256 7224.tmp 152 PID 8 wrote to memory of 5640 8 72A1.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ac535011fa8c74cac1c41972b20f32f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ac535011fa8c74cac1c41972b20f32f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\469F.tmp"C:\Users\Admin\AppData\Local\Temp\469F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\473C.tmp"C:\Users\Admin\AppData\Local\Temp\473C.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4826.tmp"C:\Users\Admin\AppData\Local\Temp\4826.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\48F1.tmp"C:\Users\Admin\AppData\Local\Temp\48F1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4B24.tmp"C:\Users\Admin\AppData\Local\Temp\4B24.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4CBA.tmp"C:\Users\Admin\AppData\Local\Temp\4CBA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\4D27.tmp"C:\Users\Admin\AppData\Local\Temp\4D27.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\4E21.tmp"C:\Users\Admin\AppData\Local\Temp\4E21.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\4F1B.tmp"C:\Users\Admin\AppData\Local\Temp\4F1B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\5015.tmp"C:\Users\Admin\AppData\Local\Temp\5015.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\514E.tmp"C:\Users\Admin\AppData\Local\Temp\514E.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5277.tmp"C:\Users\Admin\AppData\Local\Temp\5277.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\5303.tmp"C:\Users\Admin\AppData\Local\Temp\5303.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\53BF.tmp"C:\Users\Admin\AppData\Local\Temp\53BF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\54B9.tmp"C:\Users\Admin\AppData\Local\Temp\54B9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\566E.tmp"C:\Users\Admin\AppData\Local\Temp\566E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\5797.tmp"C:\Users\Admin\AppData\Local\Temp\5797.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5853.tmp"C:\Users\Admin\AppData\Local\Temp\5853.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\592D.tmp"C:\Users\Admin\AppData\Local\Temp\592D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\5A27.tmp"C:\Users\Admin\AppData\Local\Temp\5A27.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\5B02.tmp"C:\Users\Admin\AppData\Local\Temp\5B02.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\5BFC.tmp"C:\Users\Admin\AppData\Local\Temp\5BFC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5DB2.tmp"C:\Users\Admin\AppData\Local\Temp\5DB2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\5E4E.tmp"C:\Users\Admin\AppData\Local\Temp\5E4E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5F29.tmp"C:\Users\Admin\AppData\Local\Temp\5F29.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\6003.tmp"C:\Users\Admin\AppData\Local\Temp\6003.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\60FD.tmp"C:\Users\Admin\AppData\Local\Temp\60FD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\61A9.tmp"C:\Users\Admin\AppData\Local\Temp\61A9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\6255.tmp"C:\Users\Admin\AppData\Local\Temp\6255.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\62E2.tmp"C:\Users\Admin\AppData\Local\Temp\62E2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\635F.tmp"C:\Users\Admin\AppData\Local\Temp\635F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\63FB.tmp"C:\Users\Admin\AppData\Local\Temp\63FB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6497.tmp"C:\Users\Admin\AppData\Local\Temp\6497.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6533.tmp"C:\Users\Admin\AppData\Local\Temp\6533.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\65B0.tmp"C:\Users\Admin\AppData\Local\Temp\65B0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\663D.tmp"C:\Users\Admin\AppData\Local\Temp\663D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\66CA.tmp"C:\Users\Admin\AppData\Local\Temp\66CA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\6756.tmp"C:\Users\Admin\AppData\Local\Temp\6756.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\67E3.tmp"C:\Users\Admin\AppData\Local\Temp\67E3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\6870.tmp"C:\Users\Admin\AppData\Local\Temp\6870.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\690C.tmp"C:\Users\Admin\AppData\Local\Temp\690C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\6998.tmp"C:\Users\Admin\AppData\Local\Temp\6998.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\6A25.tmp"C:\Users\Admin\AppData\Local\Temp\6A25.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\6AA2.tmp"C:\Users\Admin\AppData\Local\Temp\6AA2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\6B1F.tmp"C:\Users\Admin\AppData\Local\Temp\6B1F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6C67.tmp"C:\Users\Admin\AppData\Local\Temp\6C67.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\6D03.tmp"C:\Users\Admin\AppData\Local\Temp\6D03.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\6F46.tmp"C:\Users\Admin\AppData\Local\Temp\6F46.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\70CC.tmp"C:\Users\Admin\AppData\Local\Temp\70CC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\71B7.tmp"C:\Users\Admin\AppData\Local\Temp\71B7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\734D.tmp"C:\Users\Admin\AppData\Local\Temp\734D.tmp"65⤵
- Executes dropped EXE
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\73E9.tmp"C:\Users\Admin\AppData\Local\Temp\73E9.tmp"66⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\7476.tmp"C:\Users\Admin\AppData\Local\Temp\7476.tmp"67⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\7502.tmp"C:\Users\Admin\AppData\Local\Temp\7502.tmp"68⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\759F.tmp"C:\Users\Admin\AppData\Local\Temp\759F.tmp"69⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\761C.tmp"C:\Users\Admin\AppData\Local\Temp\761C.tmp"70⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\76B8.tmp"C:\Users\Admin\AppData\Local\Temp\76B8.tmp"71⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"72⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\7800.tmp"C:\Users\Admin\AppData\Local\Temp\7800.tmp"73⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\78AC.tmp"C:\Users\Admin\AppData\Local\Temp\78AC.tmp"74⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\7948.tmp"C:\Users\Admin\AppData\Local\Temp\7948.tmp"75⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"76⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\7A52.tmp"C:\Users\Admin\AppData\Local\Temp\7A52.tmp"77⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"78⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"79⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7C36.tmp"C:\Users\Admin\AppData\Local\Temp\7C36.tmp"80⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"81⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"82⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"83⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"84⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\7F72.tmp"C:\Users\Admin\AppData\Local\Temp\7F72.tmp"85⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"86⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\807C.tmp"C:\Users\Admin\AppData\Local\Temp\807C.tmp"87⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\8108.tmp"C:\Users\Admin\AppData\Local\Temp\8108.tmp"88⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\81A5.tmp"C:\Users\Admin\AppData\Local\Temp\81A5.tmp"89⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\8231.tmp"C:\Users\Admin\AppData\Local\Temp\8231.tmp"90⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\82BE.tmp"C:\Users\Admin\AppData\Local\Temp\82BE.tmp"91⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\835A.tmp"C:\Users\Admin\AppData\Local\Temp\835A.tmp"92⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\8406.tmp"C:\Users\Admin\AppData\Local\Temp\8406.tmp"93⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\8493.tmp"C:\Users\Admin\AppData\Local\Temp\8493.tmp"94⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\853F.tmp"C:\Users\Admin\AppData\Local\Temp\853F.tmp"95⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\85DB.tmp"C:\Users\Admin\AppData\Local\Temp\85DB.tmp"96⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\8667.tmp"C:\Users\Admin\AppData\Local\Temp\8667.tmp"97⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\86D5.tmp"C:\Users\Admin\AppData\Local\Temp\86D5.tmp"98⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8761.tmp"C:\Users\Admin\AppData\Local\Temp\8761.tmp"99⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\87EE.tmp"C:\Users\Admin\AppData\Local\Temp\87EE.tmp"100⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\887B.tmp"C:\Users\Admin\AppData\Local\Temp\887B.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8907.tmp"C:\Users\Admin\AppData\Local\Temp\8907.tmp"102⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\89A4.tmp"C:\Users\Admin\AppData\Local\Temp\89A4.tmp"103⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\8A21.tmp"C:\Users\Admin\AppData\Local\Temp\8A21.tmp"104⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"105⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"106⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"107⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\8C34.tmp"C:\Users\Admin\AppData\Local\Temp\8C34.tmp"108⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"109⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"110⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"111⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\8E86.tmp"C:\Users\Admin\AppData\Local\Temp\8E86.tmp"112⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\8F22.tmp"C:\Users\Admin\AppData\Local\Temp\8F22.tmp"113⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\8F9F.tmp"C:\Users\Admin\AppData\Local\Temp\8F9F.tmp"114⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\901C.tmp"C:\Users\Admin\AppData\Local\Temp\901C.tmp"115⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\90E7.tmp"C:\Users\Admin\AppData\Local\Temp\90E7.tmp"116⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\9154.tmp"C:\Users\Admin\AppData\Local\Temp\9154.tmp"117⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\91F1.tmp"C:\Users\Admin\AppData\Local\Temp\91F1.tmp"118⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\927D.tmp"C:\Users\Admin\AppData\Local\Temp\927D.tmp"119⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9329.tmp"C:\Users\Admin\AppData\Local\Temp\9329.tmp"120⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\93B6.tmp"C:\Users\Admin\AppData\Local\Temp\93B6.tmp"121⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\9442.tmp"C:\Users\Admin\AppData\Local\Temp\9442.tmp"122⤵PID:4792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-