Analysis
- max time kernel
121s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-21_d30744b4ce25d7cc1593a73cb8b818c0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_d30744b4ce25d7cc1593a73cb8b818c0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-21_d30744b4ce25d7cc1593a73cb8b818c0_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260922-lycabsdd25
- SHA256 40d2174f2659bf7ef77dd72c1726dc591f784cecfd48195c4fa5feb761ef0a41
- MD5 d30744b4ce25d7cc1593a73cb8b818c0
- SHA1 05e1843aa0160159718e256eb85089ba18b86b68
- SHA512 9d071b0666bae9685d845d8163f9b0e89c9895884e48bdb019a73168bbe630a809dab19cc752a46d3996848b5e87f277f830291cbd692d615b69ae8e718b04ae
- SSDEEP 12288:HU5rCOTeiJbLLS9nbBeXUMklAewCYZy+KSjNZ:HUQOJJLSteXJk5wCY04jN
- TLSH T1E4B4F125B585C032E99311314AE6DBB2193ABC318722A8C73BD4767E6FB12D2D7B5307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3892 B099.tmp 4504 B193.tmp 5376 B26E.tmp 2800 B2EB.tmp 4700 B368.tmp 4456 B404.tmp 4904 B471.tmp 1336 B4EE.tmp 5160 B5C9.tmp 4800 B646.tmp 3068 B6D3.tmp 2788 B77F.tmp 3260 B80B.tmp 3168 B898.tmp 3628 B934.tmp 5148 B9D0.tmp 2744 BA5D.tmp 4168 BAEA.tmp 1592 BB96.tmp 1904 BC32.tmp 1456 BCAF.tmp 3024 BD7A.tmp 1740 BE26.tmp 724 BEB2.tmp 2900 BF2F.tmp 1492 BFEB.tmp 2392 C0C6.tmp 5764 C1B0.tmp 2888 C22D.tmp 2072 C2E9.tmp 2176 C3A4.tmp 5892 C47F.tmp 5076 C51B.tmp 5088 C588.tmp 2184 C605.tmp 5600 C673.tmp 1356 C6FF.tmp 5760 C76D.tmp 5824 C7EA.tmp 4324 C857.tmp 3208 C8D4.tmp 5396 C961.tmp 4724 C9DE.tmp 4552 CA6A.tmp 1648 CAF7.tmp 4404 CB55.tmp 1564 CBD2.tmp 2204 CC4F.tmp 5808 CCCC.tmp 5608 CD49.tmp 1588 CDC6.tmp 4360 CE52.tmp 4616 CECF.tmp 4896 CF5C.tmp 4476 CFD9.tmp 4008 D056.tmp 4176 D0B4.tmp 5368 D131.tmp 2644 D1BD.tmp 2472 D24A.tmp 1340 D2C7.tmp 6000 D363.tmp 2836 D3F0.tmp 3712 D46D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 829A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ABA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2036.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3053.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 583E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2518.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3171.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B77F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B26E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1984.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 155E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7319.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5620 wrote to memory of 3892 5620 2026-09-21_d30744b4ce25d7cc1593a73cb8b818c0_elex_mafia_stealc_tofsee.exe 88 PID 3892 wrote to memory of 4504 3892 B099.tmp 89 PID 4504 wrote to memory of 5376 4504 B193.tmp 90 PID 5376 wrote to memory of 2800 5376 B26E.tmp 91 PID 2800 wrote to memory of 4700 2800 B2EB.tmp 92 PID 4700 wrote to memory of 4456 4700 B368.tmp 93 PID 4456 wrote to memory of 4904 4456 B404.tmp 94 PID 4904 wrote to memory of 1336 4904 B471.tmp 95 PID 1336 wrote to memory of 5160 1336 B4EE.tmp 96 PID 5160 wrote to memory of 4800 5160 B5C9.tmp 97 PID 4800 wrote to memory of 3068 4800 B646.tmp 98 PID 3068 wrote to memory of 2788 3068 B6D3.tmp 99 PID 2788 wrote to memory of 3260 2788 B77F.tmp 100 PID 3260 wrote to memory of 3168 3260 B80B.tmp 101 PID 3168 wrote to memory of 3628 3168 B898.tmp 102 PID 3628 wrote to memory of 5148 3628 B934.tmp 103 PID 5148 wrote to memory of 2744 5148 B9D0.tmp 104 PID 2744 wrote to memory of 4168 2744 BA5D.tmp 105 PID 4168 wrote to memory of 1592 4168 BAEA.tmp 106 PID 1592 wrote to memory of 1904 1592 BB96.tmp 107 PID 1904 wrote to memory of 1456 1904 BC32.tmp 108 PID 1456 wrote to memory of 3024 1456 BCAF.tmp 109 PID 3024 wrote to memory of 1740 3024 BD7A.tmp 110 PID 1740 wrote to memory of 724 1740 BE26.tmp 111 PID 724 wrote to memory of 2900 724 BEB2.tmp 112 PID 2900 wrote to memory of 1492 2900 BF2F.tmp 113 PID 1492 wrote to memory of 2392 1492 BFEB.tmp 114 PID 2392 wrote to memory of 5764 2392 C0C6.tmp 115 PID 5764 wrote to memory of 2888 5764 C1B0.tmp 116 PID 2888 wrote to memory of 2072 2888 C22D.tmp 117 PID 2072 wrote to memory of 2176 2072 C2E9.tmp 118 PID 2176 wrote to memory of 5892 2176 C3A4.tmp 119 PID 5892 wrote to memory of 5076 5892 C47F.tmp 120 PID 5076 wrote to memory of 5088 5076 C51B.tmp 121 PID 5088 wrote to memory of 2184 5088 C588.tmp 122 PID 2184 wrote to memory of 5600 2184 C605.tmp 123 PID 5600 wrote to memory of 1356 5600 C673.tmp 124 PID 1356 wrote to memory of 5760 1356 C6FF.tmp 125 PID 5760 wrote to memory of 5824 5760 C76D.tmp 126 PID 5824 wrote to memory of 4324 5824 C7EA.tmp 127 PID 4324 wrote to memory of 3208 4324 C857.tmp 128 PID 3208 wrote to memory of 5396 3208 C8D4.tmp 129 PID 5396 wrote to memory of 4724 5396 C961.tmp 130 PID 4724 wrote to memory of 4552 4724 C9DE.tmp 131 PID 4552 wrote to memory of 1648 4552 CA6A.tmp 132 PID 1648 wrote to memory of 4404 1648 CAF7.tmp 133 PID 4404 wrote to memory of 1564 4404 CB55.tmp 134 PID 1564 wrote to memory of 2204 1564 CBD2.tmp 135 PID 2204 wrote to memory of 5808 2204 CC4F.tmp 136 PID 5808 wrote to memory of 5608 5808 CCCC.tmp 137 PID 5608 wrote to memory of 1588 5608 CD49.tmp 138 PID 1588 wrote to memory of 4360 1588 CDC6.tmp 139 PID 4360 wrote to memory of 4616 4360 CE52.tmp 140 PID 4616 wrote to memory of 4896 4616 CECF.tmp 141 PID 4896 wrote to memory of 4476 4896 CF5C.tmp 142 PID 4476 wrote to memory of 4008 4476 CFD9.tmp 143 PID 4008 wrote to memory of 4176 4008 D056.tmp 144 PID 4176 wrote to memory of 5368 4176 D0B4.tmp 145 PID 5368 wrote to memory of 2644 5368 D131.tmp 146 PID 2644 wrote to memory of 2472 2644 D1BD.tmp 147 PID 2472 wrote to memory of 1340 2472 D24A.tmp 148 PID 1340 wrote to memory of 6000 1340 D2C7.tmp 149 PID 6000 wrote to memory of 2836 6000 D363.tmp 150 PID 2836 wrote to memory of 3712 2836 D3F0.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_d30744b4ce25d7cc1593a73cb8b818c0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_d30744b4ce25d7cc1593a73cb8b818c0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\B099.tmp"C:\Users\Admin\AppData\Local\Temp\B099.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\B77F.tmp"C:\Users\Admin\AppData\Local\Temp\B77F.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\BE26.tmp"C:\Users\Admin\AppData\Local\Temp\BE26.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\C47F.tmp"C:\Users\Admin\AppData\Local\Temp\C47F.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\CB55.tmp"C:\Users\Admin\AppData\Local\Temp\CB55.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\CE52.tmp"C:\Users\Admin\AppData\Local\Temp\CE52.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\CECF.tmp"C:\Users\Admin\AppData\Local\Temp\CECF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"C:\Users\Admin\AppData\Local\Temp\CF5C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\D056.tmp"C:\Users\Admin\AppData\Local\Temp\D056.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\D131.tmp"C:\Users\Admin\AppData\Local\Temp\D131.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"65⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\D4DA.tmp"C:\Users\Admin\AppData\Local\Temp\D4DA.tmp"66⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\D567.tmp"C:\Users\Admin\AppData\Local\Temp\D567.tmp"67⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"69⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\D69F.tmp"C:\Users\Admin\AppData\Local\Temp\D69F.tmp"70⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"71⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"72⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"73⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"74⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"75⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"77⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"78⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\DB04.tmp"C:\Users\Admin\AppData\Local\Temp\DB04.tmp"79⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"81⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"82⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"83⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"84⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"85⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"86⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\DF0C.tmp"C:\Users\Admin\AppData\Local\Temp\DF0C.tmp"87⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\DF98.tmp"C:\Users\Admin\AppData\Local\Temp\DF98.tmp"88⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"89⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"90⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"91⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"92⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"93⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"94⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"95⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E332.tmp"C:\Users\Admin\AppData\Local\Temp\E332.tmp"96⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"97⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\E41D.tmp"C:\Users\Admin\AppData\Local\Temp\E41D.tmp"98⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"99⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"100⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\E584.tmp"C:\Users\Admin\AppData\Local\Temp\E584.tmp"101⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"102⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\E66E.tmp"C:\Users\Admin\AppData\Local\Temp\E66E.tmp"103⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"104⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"105⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"106⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\E843.tmp"C:\Users\Admin\AppData\Local\Temp\E843.tmp"107⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"108⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"109⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\E98B.tmp"C:\Users\Admin\AppData\Local\Temp\E98B.tmp"110⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"111⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\EA66.tmp"C:\Users\Admin\AppData\Local\Temp\EA66.tmp"112⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"114⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"115⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\EC98.tmp"C:\Users\Admin\AppData\Local\Temp\EC98.tmp"116⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"117⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"118⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"119⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"120⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"121⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"122⤵PID:304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-