Analysis
- max time kernel
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_89d2d0f186a690ba2a71fd13afb4eb24_darkgate_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_89d2d0f186a690ba2a71fd13afb4eb24_darkgate_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_89d2d0f186a690ba2a71fd13afb4eb24_darkgate_elex_mafia_stealc_tofsee.exe
- Size 898KB
- Sample260808-zksxtayvbw
- SHA256 68373b82433497179917dd66b80a9e398a3557fe4fb65371cd33f877d3cc2c29
- MD5 89d2d0f186a690ba2a71fd13afb4eb24
- SHA1 d4bf3125a8d8d359285073afe542f4b15f423f6f
- SHA512 bbfb3a36642fb67a38b984d3a756ad09a8fda581ec79a3b0a671f9dbf0d3ae5cff224bd5632b5007fd73ab119317284353c1d6cf2cc729f8450e6b7777d1acf4
- SSDEEP 12288:/U5rCOTeiDVIdoBX88D8HExSME4E42UNZcYkB7sLxHn:/UQOJDVIg8cgM1jN2YD
- TLSH T189157C3328555567C4AC00BE2ABCBB48CCEFF9319764A46F666455FC49238A29CEC31F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1624 B089.tmp 3792 B135.tmp 6464 B29D.tmp 4324 B404.tmp 7096 B52D.tmp 6596 B627.tmp 5788 B711.tmp 5124 B82B.tmp 4164 B8F6.tmp 7120 B9C1.tmp 6044 BA9C.tmp 6028 BB67.tmp 2684 BC41.tmp 4108 BCDE.tmp 2976 BDA9.tmp 1888 BE93.tmp 5484 BF5E.tmp 3436 C039.tmp 4716 C0D5.tmp 6868 C1C0.tmp 2900 C29A.tmp 2664 C3A4.tmp 3292 C49E.tmp 6244 C55A.tmp 1288 C654.tmp 4724 C72E.tmp 5220 C809.tmp 5956 C8D4.tmp 6152 C99F.tmp 1012 CA4B.tmp 4268 CB26.tmp 6840 CC3F.tmp 5052 CD0A.tmp 6808 CD87.tmp 2904 CE33.tmp 6688 CEDF.tmp 2576 CF5C.tmp 1964 CFD9.tmp 5812 D066.tmp 1088 D0E3.tmp 4908 D16F.tmp 5928 D1FC.tmp 4148 D269.tmp 3280 D2E6.tmp 7108 D363.tmp 5804 D42E.tmp 5488 D4BB.tmp 2556 D557.tmp 6712 D5C5.tmp 6668 D642.tmp 6396 D6CE.tmp 6164 D74B.tmp 6520 D7E8.tmp 1256 D874.tmp 4308 D8F1.tmp 6380 D96E.tmp 6728 D9FB.tmp 4708 DA78.tmp 7028 DB04.tmp 3764 DB81.tmp 5112 DC0E.tmp 3488 DC8B.tmp 3428 DCF8.tmp 3932 DD95.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 514E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B39D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D67B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8113.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F40B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 851F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7720.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 828F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6412 wrote to memory of 1624 6412 2026-08-08_89d2d0f186a690ba2a71fd13afb4eb24_darkgate_elex_mafia_stealc_tofsee.exe 88 PID 1624 wrote to memory of 3792 1624 B089.tmp 89 PID 3792 wrote to memory of 6464 3792 B135.tmp 90 PID 6464 wrote to memory of 4324 6464 B29D.tmp 91 PID 4324 wrote to memory of 7096 4324 B404.tmp 92 PID 7096 wrote to memory of 6596 7096 B52D.tmp 93 PID 6596 wrote to memory of 5788 6596 B627.tmp 94 PID 5788 wrote to memory of 5124 5788 B711.tmp 95 PID 5124 wrote to memory of 4164 5124 B82B.tmp 96 PID 4164 wrote to memory of 7120 4164 B8F6.tmp 97 PID 7120 wrote to memory of 6044 7120 B9C1.tmp 98 PID 6044 wrote to memory of 6028 6044 BA9C.tmp 99 PID 6028 wrote to memory of 2684 6028 BB67.tmp 100 PID 2684 wrote to memory of 4108 2684 BC41.tmp 101 PID 4108 wrote to memory of 2976 4108 BCDE.tmp 102 PID 2976 wrote to memory of 1888 2976 BDA9.tmp 103 PID 1888 wrote to memory of 5484 1888 BE93.tmp 104 PID 5484 wrote to memory of 3436 5484 BF5E.tmp 105 PID 3436 wrote to memory of 4716 3436 C039.tmp 106 PID 4716 wrote to memory of 6868 4716 C0D5.tmp 107 PID 6868 wrote to memory of 2900 6868 C1C0.tmp 108 PID 2900 wrote to memory of 2664 2900 C29A.tmp 109 PID 2664 wrote to memory of 3292 2664 C3A4.tmp 110 PID 3292 wrote to memory of 6244 3292 C49E.tmp 111 PID 6244 wrote to memory of 1288 6244 C55A.tmp 112 PID 1288 wrote to memory of 4724 1288 C654.tmp 113 PID 4724 wrote to memory of 5220 4724 C72E.tmp 114 PID 5220 wrote to memory of 5956 5220 C809.tmp 115 PID 5956 wrote to memory of 6152 5956 C8D4.tmp 116 PID 6152 wrote to memory of 1012 6152 C99F.tmp 117 PID 1012 wrote to memory of 4268 1012 CA4B.tmp 118 PID 4268 wrote to memory of 6840 4268 CB26.tmp 119 PID 6840 wrote to memory of 5052 6840 CC3F.tmp 120 PID 5052 wrote to memory of 6808 5052 CD0A.tmp 121 PID 6808 wrote to memory of 2904 6808 CD87.tmp 122 PID 2904 wrote to memory of 6688 2904 CE33.tmp 123 PID 6688 wrote to memory of 2576 6688 CEDF.tmp 124 PID 2576 wrote to memory of 1964 2576 CF5C.tmp 125 PID 1964 wrote to memory of 5812 1964 CFD9.tmp 126 PID 5812 wrote to memory of 1088 5812 D066.tmp 127 PID 1088 wrote to memory of 4908 1088 D0E3.tmp 128 PID 4908 wrote to memory of 5928 4908 D16F.tmp 129 PID 5928 wrote to memory of 4148 5928 D1FC.tmp 130 PID 4148 wrote to memory of 3280 4148 D269.tmp 131 PID 3280 wrote to memory of 7108 3280 D2E6.tmp 132 PID 7108 wrote to memory of 5804 7108 D363.tmp 133 PID 5804 wrote to memory of 5488 5804 D42E.tmp 134 PID 5488 wrote to memory of 2556 5488 D4BB.tmp 135 PID 2556 wrote to memory of 6712 2556 D557.tmp 136 PID 6712 wrote to memory of 6668 6712 D5C5.tmp 137 PID 6668 wrote to memory of 6396 6668 D642.tmp 138 PID 6396 wrote to memory of 6164 6396 D6CE.tmp 139 PID 6164 wrote to memory of 6520 6164 D74B.tmp 140 PID 6520 wrote to memory of 1256 6520 D7E8.tmp 141 PID 1256 wrote to memory of 4308 1256 D874.tmp 142 PID 4308 wrote to memory of 6380 4308 D8F1.tmp 143 PID 6380 wrote to memory of 6728 6380 D96E.tmp 144 PID 6728 wrote to memory of 4708 6728 D9FB.tmp 145 PID 4708 wrote to memory of 7028 4708 DA78.tmp 146 PID 7028 wrote to memory of 3764 7028 DB04.tmp 147 PID 3764 wrote to memory of 5112 3764 DB81.tmp 148 PID 5112 wrote to memory of 3488 5112 DC0E.tmp 149 PID 3488 wrote to memory of 3428 3488 DC8B.tmp 150 PID 3428 wrote to memory of 3932 3428 DCF8.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_89d2d0f186a690ba2a71fd13afb4eb24_darkgate_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_89d2d0f186a690ba2a71fd13afb4eb24_darkgate_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6412 -
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6464 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7096 -
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6596 -
C:\Users\Admin\AppData\Local\Temp\B711.tmp"C:\Users\Admin\AppData\Local\Temp\B711.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7120 -
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\BC41.tmp"C:\Users\Admin\AppData\Local\Temp\BC41.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\C039.tmp"C:\Users\Admin\AppData\Local\Temp\C039.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6868 -
C:\Users\Admin\AppData\Local\Temp\C29A.tmp"C:\Users\Admin\AppData\Local\Temp\C29A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\C55A.tmp"C:\Users\Admin\AppData\Local\Temp\C55A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6244 -
C:\Users\Admin\AppData\Local\Temp\C654.tmp"C:\Users\Admin\AppData\Local\Temp\C654.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\C72E.tmp"C:\Users\Admin\AppData\Local\Temp\C72E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6152 -
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6840 -
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6808 -
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6688 -
C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7108 -
C:\Users\Admin\AppData\Local\Temp\D42E.tmp"C:\Users\Admin\AppData\Local\Temp\D42E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\D557.tmp"C:\Users\Admin\AppData\Local\Temp\D557.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6712 -
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6668 -
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6396 -
C:\Users\Admin\AppData\Local\Temp\D74B.tmp"C:\Users\Admin\AppData\Local\Temp\D74B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6164 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6380 -
C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6728 -
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\DB04.tmp"C:\Users\Admin\AppData\Local\Temp\DB04.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7028 -
C:\Users\Admin\AppData\Local\Temp\DB81.tmp"C:\Users\Admin\AppData\Local\Temp\DB81.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\DCF8.tmp"C:\Users\Admin\AppData\Local\Temp\DCF8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\DD95.tmp"C:\Users\Admin\AppData\Local\Temp\DD95.tmp"65⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"66⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"67⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\E006.tmp"C:\Users\Admin\AppData\Local\Temp\E006.tmp"69⤵PID:7016
-
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"71⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"72⤵PID:7112
-
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"73⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"74⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"75⤵PID:6568
-
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"76⤵PID:6816
-
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"77⤵PID:7144
-
C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"78⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\E594.tmp"C:\Users\Admin\AppData\Local\Temp\E594.tmp"79⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\E620.tmp"C:\Users\Admin\AppData\Local\Temp\E620.tmp"80⤵PID:6264
-
C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"81⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\E768.tmp"C:\Users\Admin\AppData\Local\Temp\E768.tmp"82⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"83⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"84⤵PID:6772
-
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"85⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\E99B.tmp"C:\Users\Admin\AppData\Local\Temp\E99B.tmp"86⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"87⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"88⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\EB41.tmp"C:\Users\Admin\AppData\Local\Temp\EB41.tmp"89⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"90⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"91⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"92⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"93⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"94⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"95⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\EF67.tmp"C:\Users\Admin\AppData\Local\Temp\EF67.tmp"96⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"97⤵PID:6888
-
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"98⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\F12C.tmp"C:\Users\Admin\AppData\Local\Temp\F12C.tmp"99⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"100⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"101⤵PID:6196
-
C:\Users\Admin\AppData\Local\Temp\F294.tmp"C:\Users\Admin\AppData\Local\Temp\F294.tmp"102⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"103⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"104⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"106⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\F505.tmp"C:\Users\Admin\AppData\Local\Temp\F505.tmp"107⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\F582.tmp"C:\Users\Admin\AppData\Local\Temp\F582.tmp"108⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"109⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"110⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\F747.tmp"C:\Users\Admin\AppData\Local\Temp\F747.tmp"111⤵PID:6884
-
C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\F90C.tmp"C:\Users\Admin\AppData\Local\Temp\F90C.tmp"114⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"115⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"116⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"117⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"118⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"119⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"120⤵PID:7128
-
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"121⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-