Analysis
- max time kernel
126s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_23352c0c3fc333dd350c5cb77b662365_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_23352c0c3fc333dd350c5cb77b662365_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_23352c0c3fc333dd350c5cb77b662365_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260806-3ebccswtey
- SHA256 14c687a573a2ad466cf01050e47c6acb940948010f373eb0820a004ed38b0bba
- MD5 23352c0c3fc333dd350c5cb77b662365
- SHA1 6fc341d9d1872350d64bc4bc918b0bd0ab024d05
- SHA512 5cb14bab3aff6ff6aa40adcffe67ac3c60901badd2423393c76f9acbd9106421af6189ae10703a64bfd29b7a9a456fe3cd2152dd4a1ddeb11d8f247d7e8858e2
- SSDEEP 12288:9U5rCOTei6ORn0LqKUv/3VBuyKJvI6DBhZ8qZoXWjdqpby1grA70G+o:9UQOJ6i0O333DuI6DzZ8qqGh4yATXo
- TLSH T1C7E402217984C436EA8602314EE6EBB2597ABC715B2264C73BC4772D2FB12E1D378357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5976 C9DE.tmp 3004 CAE7.tmp 5196 CBB3.tmp 2632 CD58.tmp 3248 CDD5.tmp 1660 CEB0.tmp 4596 CF4C.tmp 4188 D037.tmp 4740 D102.tmp 3416 D18F.tmp 1652 D269.tmp 52 D354.tmp 4932 D42E.tmp 5540 D538.tmp 1428 D603.tmp 3292 D680.tmp 4532 D72C.tmp 840 D7F7.tmp 2488 D893.tmp 708 D96E.tmp 3232 DA68.tmp 5940 DB14.tmp 4676 DBEF.tmp 3884 DC7B.tmp 1608 DD08.tmp 3224 DDF2.tmp 5184 DE7F.tmp 2768 DF3B.tmp 4600 E035.tmp 1500 E0F0.tmp 1008 E19C.tmp 2612 E277.tmp 3412 E313.tmp 1956 E3BF.tmp 1696 E46B.tmp 1392 E507.tmp 3128 E5B3.tmp 5392 E65F.tmp 948 E70B.tmp 3144 E7B6.tmp 2652 E872.tmp 3492 E90E.tmp 3616 E99B.tmp 4592 EA27.tmp 4892 EA95.tmp 2736 EB12.tmp 5796 EB9E.tmp 200 EC1B.tmp 2408 ECB8.tmp 2932 ED54.tmp 868 EDF0.tmp 4352 EE6D.tmp 4372 EEDB.tmp 6072 EF86.tmp 5592 F023.tmp 5100 F0BF.tmp 4988 F15B.tmp 4388 F1E8.tmp 3280 F265.tmp 4316 F2E2.tmp 5980 F38E.tmp 4744 F40B.tmp 4280 F497.tmp 1116 F514.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A276.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 347F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D62D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 417F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 519C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 687F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 398B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 5976 2096 2026-08-06_23352c0c3fc333dd350c5cb77b662365_elex_mafia_stealc_tofsee.exe 88 PID 5976 wrote to memory of 3004 5976 C9DE.tmp 89 PID 3004 wrote to memory of 5196 3004 CAE7.tmp 90 PID 5196 wrote to memory of 2632 5196 CBB3.tmp 91 PID 2632 wrote to memory of 3248 2632 CD58.tmp 92 PID 3248 wrote to memory of 1660 3248 CDD5.tmp 93 PID 1660 wrote to memory of 4596 1660 CEB0.tmp 94 PID 4596 wrote to memory of 4188 4596 CF4C.tmp 95 PID 4188 wrote to memory of 4740 4188 D037.tmp 96 PID 4740 wrote to memory of 3416 4740 D102.tmp 97 PID 3416 wrote to memory of 1652 3416 D18F.tmp 98 PID 1652 wrote to memory of 52 1652 D269.tmp 99 PID 52 wrote to memory of 4932 52 D354.tmp 100 PID 4932 wrote to memory of 5540 4932 D42E.tmp 101 PID 5540 wrote to memory of 1428 5540 D538.tmp 102 PID 1428 wrote to memory of 3292 1428 D603.tmp 103 PID 3292 wrote to memory of 4532 3292 D680.tmp 104 PID 4532 wrote to memory of 840 4532 D72C.tmp 105 PID 840 wrote to memory of 2488 840 D7F7.tmp 106 PID 2488 wrote to memory of 708 2488 D893.tmp 107 PID 708 wrote to memory of 3232 708 D96E.tmp 108 PID 3232 wrote to memory of 5940 3232 DA68.tmp 109 PID 5940 wrote to memory of 4676 5940 DB14.tmp 110 PID 4676 wrote to memory of 3884 4676 DBEF.tmp 111 PID 3884 wrote to memory of 1608 3884 DC7B.tmp 112 PID 1608 wrote to memory of 3224 1608 DD08.tmp 113 PID 3224 wrote to memory of 5184 3224 DDF2.tmp 114 PID 5184 wrote to memory of 2768 5184 DE7F.tmp 115 PID 2768 wrote to memory of 4600 2768 DF3B.tmp 116 PID 4600 wrote to memory of 1500 4600 E035.tmp 117 PID 1500 wrote to memory of 1008 1500 E0F0.tmp 118 PID 1008 wrote to memory of 2612 1008 E19C.tmp 119 PID 2612 wrote to memory of 3412 2612 E277.tmp 120 PID 3412 wrote to memory of 1956 3412 E313.tmp 121 PID 1956 wrote to memory of 1696 1956 E3BF.tmp 122 PID 1696 wrote to memory of 1392 1696 E46B.tmp 123 PID 1392 wrote to memory of 3128 1392 E507.tmp 124 PID 3128 wrote to memory of 5392 3128 E5B3.tmp 125 PID 5392 wrote to memory of 948 5392 E65F.tmp 126 PID 948 wrote to memory of 3144 948 E70B.tmp 127 PID 3144 wrote to memory of 2652 3144 E7B6.tmp 128 PID 2652 wrote to memory of 3492 2652 E872.tmp 129 PID 3492 wrote to memory of 3616 3492 E90E.tmp 130 PID 3616 wrote to memory of 4592 3616 E99B.tmp 131 PID 4592 wrote to memory of 4892 4592 EA27.tmp 132 PID 4892 wrote to memory of 2736 4892 EA95.tmp 133 PID 2736 wrote to memory of 5796 2736 EB12.tmp 134 PID 5796 wrote to memory of 200 5796 EB9E.tmp 135 PID 200 wrote to memory of 2408 200 EC1B.tmp 136 PID 2408 wrote to memory of 2932 2408 ECB8.tmp 137 PID 2932 wrote to memory of 868 2932 ED54.tmp 138 PID 868 wrote to memory of 4352 868 EDF0.tmp 139 PID 4352 wrote to memory of 4372 4352 EE6D.tmp 140 PID 4372 wrote to memory of 6072 4372 EEDB.tmp 141 PID 6072 wrote to memory of 5592 6072 EF86.tmp 142 PID 5592 wrote to memory of 5100 5592 F023.tmp 143 PID 5100 wrote to memory of 4988 5100 F0BF.tmp 144 PID 4988 wrote to memory of 4388 4988 F15B.tmp 145 PID 4388 wrote to memory of 3280 4388 F1E8.tmp 146 PID 3280 wrote to memory of 4316 3280 F265.tmp 147 PID 4316 wrote to memory of 5980 4316 F2E2.tmp 148 PID 5980 wrote to memory of 4744 5980 F38E.tmp 149 PID 4744 wrote to memory of 4280 4744 F40B.tmp 150 PID 4280 wrote to memory of 1116 4280 F497.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_23352c0c3fc333dd350c5cb77b662365_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_23352c0c3fc333dd350c5cb77b662365_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\CD58.tmp"C:\Users\Admin\AppData\Local\Temp\CD58.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\D037.tmp"C:\Users\Admin\AppData\Local\Temp\D037.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\D42E.tmp"C:\Users\Admin\AppData\Local\Temp\D42E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\D538.tmp"C:\Users\Admin\AppData\Local\Temp\D538.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\D603.tmp"C:\Users\Admin\AppData\Local\Temp\D603.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\D680.tmp"C:\Users\Admin\AppData\Local\Temp\D680.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\DC7B.tmp"C:\Users\Admin\AppData\Local\Temp\DC7B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\E872.tmp"C:\Users\Admin\AppData\Local\Temp\E872.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\E90E.tmp"C:\Users\Admin\AppData\Local\Temp\E90E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\E99B.tmp"C:\Users\Admin\AppData\Local\Temp\E99B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\ECB8.tmp"C:\Users\Admin\AppData\Local\Temp\ECB8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\F514.tmp"C:\Users\Admin\AppData\Local\Temp\F514.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\F591.tmp"C:\Users\Admin\AppData\Local\Temp\F591.tmp"66⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"67⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"68⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\F737.tmp"C:\Users\Admin\AppData\Local\Temp\F737.tmp"69⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"70⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\F841.tmp"C:\Users\Admin\AppData\Local\Temp\F841.tmp"71⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"72⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\F979.tmp"C:\Users\Admin\AppData\Local\Temp\F979.tmp"73⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"74⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"75⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\FB10.tmp"C:\Users\Admin\AppData\Local\Temp\FB10.tmp"76⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"77⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"C:\Users\Admin\AppData\Local\Temp\FC0A.tmp"78⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"79⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"80⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"82⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"84⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"85⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"86⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\13A.tmp"C:\Users\Admin\AppData\Local\Temp\13A.tmp"88⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\1A7.tmp"C:\Users\Admin\AppData\Local\Temp\1A7.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\234.tmp"C:\Users\Admin\AppData\Local\Temp\234.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"92⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\37C.tmp"C:\Users\Admin\AppData\Local\Temp\37C.tmp"93⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"94⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\512.tmp"C:\Users\Admin\AppData\Local\Temp\512.tmp"96⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"98⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"99⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"100⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"101⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"102⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"103⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"104⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"105⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\B3C.tmp"C:\Users\Admin\AppData\Local\Temp\B3C.tmp"107⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\BC9.tmp"C:\Users\Admin\AppData\Local\Temp\BC9.tmp"108⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"109⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"110⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\D6F.tmp"C:\Users\Admin\AppData\Local\Temp\D6F.tmp"111⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\DDC.tmp"C:\Users\Admin\AppData\Local\Temp\DDC.tmp"112⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\E59.tmp"C:\Users\Admin\AppData\Local\Temp\E59.tmp"113⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\ED6.tmp"C:\Users\Admin\AppData\Local\Temp\ED6.tmp"114⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\F63.tmp"C:\Users\Admin\AppData\Local\Temp\F63.tmp"115⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"116⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\107C.tmp"C:\Users\Admin\AppData\Local\Temp\107C.tmp"117⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"118⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"119⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\1231.tmp"C:\Users\Admin\AppData\Local\Temp\1231.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\12BE.tmp"C:\Users\Admin\AppData\Local\Temp\12BE.tmp"121⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"122⤵PID:5596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-