Analysis
- max time kernel
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_d74251bf2288a82245533a8b8a9dbdc2_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_d74251bf2288a82245533a8b8a9dbdc2_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_d74251bf2288a82245533a8b8a9dbdc2_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260819-vwpbjsgd96
- SHA256 a447362ccfe36e25b5c4c4dbd04e99342d1e4ea2dd807b41580ebfe475f8bf97
- MD5 d74251bf2288a82245533a8b8a9dbdc2
- SHA1 70d0b12120d1e29f36c44b8e2616ea2bbc1de833
- SHA512 d29f6660d6b021596ccdc701f5fdeb0705d7450aa69451f3b2ffa99aa3462258f94b739b86547d8a34c650b0fe2f83548ec79cbcb7299ca2f29b60cf38c7773c
- SSDEEP 12288:9U5rCOTei6xi0nh70ljcKlFGJxDLVqZoXWjdqpby1grA70G+o:9UQOJ6Zh4l3i5qqGh4yATXo
- TLSH T192E401257985C532E9C702314FE6EBB1697ABC315722A4C73B84676E6FB12E1A334307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4884 4298.tmp 5080 4344.tmp 932 43FF.tmp 252 4557.tmp 3624 4680.tmp 4328 472C.tmp 2512 47C8.tmp 5504 48D2.tmp 3364 499D.tmp 5432 4A58.tmp 4368 4B14.tmp 1188 4BCF.tmp 5284 4C7B.tmp 4964 4D66.tmp 2040 4E40.tmp 4592 4EEC.tmp 6020 4FC7.tmp 4628 50E0.tmp 696 518C.tmp 2564 52B5.tmp 3864 5351.tmp 4496 540D.tmp 1740 54B9.tmp 5556 5565.tmp 2992 5610.tmp 1880 56AD.tmp 2468 5749.tmp 6024 57F5.tmp 4732 58EF.tmp 4860 59AA.tmp 3312 5A66.tmp 1356 5B50.tmp 3736 5C2B.tmp 2084 5CB8.tmp 4468 5D35.tmp 2768 5DD1.tmp 5640 5E5D.tmp 3908 5EEA.tmp 5684 5F67.tmp 1568 5FE4.tmp 1636 6042.tmp 4552 60DE.tmp 2928 614B.tmp 4116 61E8.tmp 5044 6265.tmp 5128 62E2.tmp 4324 636E.tmp 2404 63EB.tmp 2288 6478.tmp 2256 6514.tmp 5396 65A1.tmp 1416 663D.tmp 4304 66CA.tmp 3840 6747.tmp 1784 67D3.tmp 2688 6850.tmp 5944 68DD.tmp 2516 6989.tmp 6048 6A44.tmp 4124 6EB9.tmp 5732 6F55.tmp 968 6FF1.tmp 5316 707E.tmp 5848 710B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C59E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E66A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 734D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 507E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F960.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3356 wrote to memory of 4884 3356 2026-08-19_d74251bf2288a82245533a8b8a9dbdc2_elex_mafia_stealc_tofsee.exe 89 PID 4884 wrote to memory of 5080 4884 4298.tmp 90 PID 5080 wrote to memory of 932 5080 4344.tmp 91 PID 932 wrote to memory of 252 932 43FF.tmp 92 PID 252 wrote to memory of 3624 252 4557.tmp 93 PID 3624 wrote to memory of 4328 3624 4680.tmp 94 PID 4328 wrote to memory of 2512 4328 472C.tmp 95 PID 2512 wrote to memory of 5504 2512 47C8.tmp 96 PID 5504 wrote to memory of 3364 5504 48D2.tmp 97 PID 3364 wrote to memory of 5432 3364 499D.tmp 98 PID 5432 wrote to memory of 4368 5432 4A58.tmp 99 PID 4368 wrote to memory of 1188 4368 4B14.tmp 100 PID 1188 wrote to memory of 5284 1188 4BCF.tmp 101 PID 5284 wrote to memory of 4964 5284 4C7B.tmp 102 PID 4964 wrote to memory of 2040 4964 4D66.tmp 103 PID 2040 wrote to memory of 4592 2040 4E40.tmp 104 PID 4592 wrote to memory of 6020 4592 4EEC.tmp 105 PID 6020 wrote to memory of 4628 6020 4FC7.tmp 106 PID 4628 wrote to memory of 696 4628 50E0.tmp 107 PID 696 wrote to memory of 2564 696 518C.tmp 108 PID 2564 wrote to memory of 3864 2564 52B5.tmp 109 PID 3864 wrote to memory of 4496 3864 5351.tmp 110 PID 4496 wrote to memory of 1740 4496 540D.tmp 111 PID 1740 wrote to memory of 5556 1740 54B9.tmp 112 PID 5556 wrote to memory of 2992 5556 5565.tmp 113 PID 2992 wrote to memory of 1880 2992 5610.tmp 114 PID 1880 wrote to memory of 2468 1880 56AD.tmp 115 PID 2468 wrote to memory of 6024 2468 5749.tmp 116 PID 6024 wrote to memory of 4732 6024 57F5.tmp 117 PID 4732 wrote to memory of 4860 4732 58EF.tmp 118 PID 4860 wrote to memory of 3312 4860 59AA.tmp 119 PID 3312 wrote to memory of 1356 3312 5A66.tmp 120 PID 1356 wrote to memory of 3736 1356 5B50.tmp 121 PID 3736 wrote to memory of 2084 3736 5C2B.tmp 122 PID 2084 wrote to memory of 4468 2084 5CB8.tmp 123 PID 4468 wrote to memory of 2768 4468 5D35.tmp 124 PID 2768 wrote to memory of 5640 2768 5DD1.tmp 125 PID 5640 wrote to memory of 3908 5640 5E5D.tmp 126 PID 3908 wrote to memory of 5684 3908 5EEA.tmp 127 PID 5684 wrote to memory of 1568 5684 5F67.tmp 128 PID 1568 wrote to memory of 1636 1568 5FE4.tmp 129 PID 1636 wrote to memory of 4552 1636 6042.tmp 130 PID 4552 wrote to memory of 2928 4552 60DE.tmp 131 PID 2928 wrote to memory of 4116 2928 614B.tmp 132 PID 4116 wrote to memory of 5044 4116 61E8.tmp 133 PID 5044 wrote to memory of 5128 5044 6265.tmp 134 PID 5128 wrote to memory of 4324 5128 62E2.tmp 135 PID 4324 wrote to memory of 2404 4324 636E.tmp 136 PID 2404 wrote to memory of 2288 2404 63EB.tmp 137 PID 2288 wrote to memory of 2256 2288 6478.tmp 138 PID 2256 wrote to memory of 5396 2256 6514.tmp 139 PID 5396 wrote to memory of 1416 5396 65A1.tmp 140 PID 1416 wrote to memory of 4304 1416 663D.tmp 141 PID 4304 wrote to memory of 3840 4304 66CA.tmp 142 PID 3840 wrote to memory of 1784 3840 6747.tmp 143 PID 1784 wrote to memory of 2688 1784 67D3.tmp 144 PID 2688 wrote to memory of 5944 2688 6850.tmp 145 PID 5944 wrote to memory of 2516 5944 68DD.tmp 146 PID 2516 wrote to memory of 6048 2516 6989.tmp 147 PID 6048 wrote to memory of 4124 6048 6A44.tmp 148 PID 4124 wrote to memory of 5732 4124 6EB9.tmp 149 PID 5732 wrote to memory of 968 5732 6F55.tmp 150 PID 968 wrote to memory of 5316 968 6FF1.tmp 151 PID 5316 wrote to memory of 5848 5316 707E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_d74251bf2288a82245533a8b8a9dbdc2_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d74251bf2288a82245533a8b8a9dbdc2_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\4298.tmp"C:\Users\Admin\AppData\Local\Temp\4298.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4344.tmp"C:\Users\Admin\AppData\Local\Temp\4344.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\43FF.tmp"C:\Users\Admin\AppData\Local\Temp\43FF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4557.tmp"C:\Users\Admin\AppData\Local\Temp\4557.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\4680.tmp"C:\Users\Admin\AppData\Local\Temp\4680.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\472C.tmp"C:\Users\Admin\AppData\Local\Temp\472C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\47C8.tmp"C:\Users\Admin\AppData\Local\Temp\47C8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\48D2.tmp"C:\Users\Admin\AppData\Local\Temp\48D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\499D.tmp"C:\Users\Admin\AppData\Local\Temp\499D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\4A58.tmp"C:\Users\Admin\AppData\Local\Temp\4A58.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4E40.tmp"C:\Users\Admin\AppData\Local\Temp\4E40.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\4EEC.tmp"C:\Users\Admin\AppData\Local\Temp\4EEC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\4FC7.tmp"C:\Users\Admin\AppData\Local\Temp\4FC7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\50E0.tmp"C:\Users\Admin\AppData\Local\Temp\50E0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\518C.tmp"C:\Users\Admin\AppData\Local\Temp\518C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\52B5.tmp"C:\Users\Admin\AppData\Local\Temp\52B5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\5351.tmp"C:\Users\Admin\AppData\Local\Temp\5351.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\540D.tmp"C:\Users\Admin\AppData\Local\Temp\540D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\54B9.tmp"C:\Users\Admin\AppData\Local\Temp\54B9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5565.tmp"C:\Users\Admin\AppData\Local\Temp\5565.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\5610.tmp"C:\Users\Admin\AppData\Local\Temp\5610.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\56AD.tmp"C:\Users\Admin\AppData\Local\Temp\56AD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\5749.tmp"C:\Users\Admin\AppData\Local\Temp\5749.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\57F5.tmp"C:\Users\Admin\AppData\Local\Temp\57F5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\58EF.tmp"C:\Users\Admin\AppData\Local\Temp\58EF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\59AA.tmp"C:\Users\Admin\AppData\Local\Temp\59AA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5A66.tmp"C:\Users\Admin\AppData\Local\Temp\5A66.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\5B50.tmp"C:\Users\Admin\AppData\Local\Temp\5B50.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\5C2B.tmp"C:\Users\Admin\AppData\Local\Temp\5C2B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5D35.tmp"C:\Users\Admin\AppData\Local\Temp\5D35.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\5DD1.tmp"C:\Users\Admin\AppData\Local\Temp\5DD1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\5F67.tmp"C:\Users\Admin\AppData\Local\Temp\5F67.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\6042.tmp"C:\Users\Admin\AppData\Local\Temp\6042.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\60DE.tmp"C:\Users\Admin\AppData\Local\Temp\60DE.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\614B.tmp"C:\Users\Admin\AppData\Local\Temp\614B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\61E8.tmp"C:\Users\Admin\AppData\Local\Temp\61E8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\6265.tmp"C:\Users\Admin\AppData\Local\Temp\6265.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\62E2.tmp"C:\Users\Admin\AppData\Local\Temp\62E2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\636E.tmp"C:\Users\Admin\AppData\Local\Temp\636E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\63EB.tmp"C:\Users\Admin\AppData\Local\Temp\63EB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\6478.tmp"C:\Users\Admin\AppData\Local\Temp\6478.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6514.tmp"C:\Users\Admin\AppData\Local\Temp\6514.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\65A1.tmp"C:\Users\Admin\AppData\Local\Temp\65A1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\663D.tmp"C:\Users\Admin\AppData\Local\Temp\663D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\66CA.tmp"C:\Users\Admin\AppData\Local\Temp\66CA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6747.tmp"C:\Users\Admin\AppData\Local\Temp\6747.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\67D3.tmp"C:\Users\Admin\AppData\Local\Temp\67D3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\6850.tmp"C:\Users\Admin\AppData\Local\Temp\6850.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\68DD.tmp"C:\Users\Admin\AppData\Local\Temp\68DD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\6989.tmp"C:\Users\Admin\AppData\Local\Temp\6989.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\6A44.tmp"C:\Users\Admin\AppData\Local\Temp\6A44.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6F55.tmp"C:\Users\Admin\AppData\Local\Temp\6F55.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\707E.tmp"C:\Users\Admin\AppData\Local\Temp\707E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"65⤵
- Executes dropped EXE
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"66⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"67⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\72B1.tmp"C:\Users\Admin\AppData\Local\Temp\72B1.tmp"68⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\734D.tmp"C:\Users\Admin\AppData\Local\Temp\734D.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:256 -
C:\Users\Admin\AppData\Local\Temp\73E9.tmp"C:\Users\Admin\AppData\Local\Temp\73E9.tmp"70⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\7476.tmp"C:\Users\Admin\AppData\Local\Temp\7476.tmp"71⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\74F3.tmp"C:\Users\Admin\AppData\Local\Temp\74F3.tmp"72⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\757F.tmp"C:\Users\Admin\AppData\Local\Temp\757F.tmp"73⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\760C.tmp"C:\Users\Admin\AppData\Local\Temp\760C.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\7699.tmp"C:\Users\Admin\AppData\Local\Temp\7699.tmp"75⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\7735.tmp"C:\Users\Admin\AppData\Local\Temp\7735.tmp"76⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\77B2.tmp"C:\Users\Admin\AppData\Local\Temp\77B2.tmp"77⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\787D.tmp"C:\Users\Admin\AppData\Local\Temp\787D.tmp"78⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\78FA.tmp"C:\Users\Admin\AppData\Local\Temp\78FA.tmp"79⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\7977.tmp"C:\Users\Admin\AppData\Local\Temp\7977.tmp"80⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\7A04.tmp"C:\Users\Admin\AppData\Local\Temp\7A04.tmp"81⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\7A81.tmp"C:\Users\Admin\AppData\Local\Temp\7A81.tmp"82⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"83⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\7C55.tmp"C:\Users\Admin\AppData\Local\Temp\7C55.tmp"85⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"86⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7D6F.tmp"C:\Users\Admin\AppData\Local\Temp\7D6F.tmp"87⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"88⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\7E97.tmp"C:\Users\Admin\AppData\Local\Temp\7E97.tmp"89⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\7F14.tmp"C:\Users\Admin\AppData\Local\Temp\7F14.tmp"90⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"91⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\802E.tmp"C:\Users\Admin\AppData\Local\Temp\802E.tmp"92⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\80CA.tmp"C:\Users\Admin\AppData\Local\Temp\80CA.tmp"93⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"94⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\81E3.tmp"C:\Users\Admin\AppData\Local\Temp\81E3.tmp"95⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\827F.tmp"C:\Users\Admin\AppData\Local\Temp\827F.tmp"96⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\82FC.tmp"C:\Users\Admin\AppData\Local\Temp\82FC.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\8399.tmp"C:\Users\Admin\AppData\Local\Temp\8399.tmp"98⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\8454.tmp"C:\Users\Admin\AppData\Local\Temp\8454.tmp"99⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"100⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\85AC.tmp"C:\Users\Admin\AppData\Local\Temp\85AC.tmp"101⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\8619.tmp"C:\Users\Admin\AppData\Local\Temp\8619.tmp"102⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\86C5.tmp"C:\Users\Admin\AppData\Local\Temp\86C5.tmp"103⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\8742.tmp"C:\Users\Admin\AppData\Local\Temp\8742.tmp"104⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\87CF.tmp"C:\Users\Admin\AppData\Local\Temp\87CF.tmp"105⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\885B.tmp"C:\Users\Admin\AppData\Local\Temp\885B.tmp"106⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\88D8.tmp"C:\Users\Admin\AppData\Local\Temp\88D8.tmp"107⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\8955.tmp"C:\Users\Admin\AppData\Local\Temp\8955.tmp"108⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\89E2.tmp"C:\Users\Admin\AppData\Local\Temp\89E2.tmp"109⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"110⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"111⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"112⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8C24.tmp"C:\Users\Admin\AppData\Local\Temp\8C24.tmp"113⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\8C92.tmp"C:\Users\Admin\AppData\Local\Temp\8C92.tmp"114⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"115⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"116⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\8E37.tmp"C:\Users\Admin\AppData\Local\Temp\8E37.tmp"117⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\8F41.tmp"C:\Users\Admin\AppData\Local\Temp\8F41.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\8FCE.tmp"C:\Users\Admin\AppData\Local\Temp\8FCE.tmp"120⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\904B.tmp"C:\Users\Admin\AppData\Local\Temp\904B.tmp"121⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\90D7.tmp"C:\Users\Admin\AppData\Local\Temp\90D7.tmp"122⤵PID:832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-