Analysis
- max time kernel
128s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-06_962646a90a93f495cfc8d23851616471_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-06_962646a90a93f495cfc8d23851616471_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-06_962646a90a93f495cfc8d23851616471_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample261007-243bpsxz9q
- SHA256 88160dd187221003433e5d5e4af9ba0559ec01b8ae779550d7948e9a4dbecb4c
- MD5 962646a90a93f495cfc8d23851616471
- SHA1 357869722faed79453bc39b610ba97ab667454da
- SHA512 1c3564cc81647d993e600328c2dc53e1e0320836a4e2428e4003b51e0b1a7bbef16cf5618656317182a9f0b48bc0c52f2a4d1f493d837c6bf180982740cf2c43
- SSDEEP 12288:9U5rCOTei6sOpUHxOB25dxyp4w7ZRRqZoXWjdq:9UQOJ6sOpwSpjRqqGh
- TLSH T130C4F1217944C437E5D212704EE2EBA2696B7C358B26A0C77BD0B72E6FB52E1D374306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4528 31C0.tmp 2472 326B.tmp 5968 32E8.tmp 572 3356.tmp 1008 3402.tmp 4452 34EC.tmp 2032 35F6.tmp 4088 36B1.tmp 3228 373E.tmp 2724 37CA.tmp 2952 3886.tmp 2340 3951.tmp 4912 3A0D.tmp 4276 3AB8.tmp 1140 3B74.tmp 5260 3C2F.tmp 4796 3CBC.tmp 4652 3D78.tmp 5488 3DF5.tmp 4948 3E81.tmp 1936 3F2D.tmp 1200 3FD9.tmp 5688 4085.tmp 4256 4131.tmp 716 41BD.tmp 1516 4269.tmp 1844 4305.tmp 1736 43B1.tmp 3552 443E.tmp 5024 44EA.tmp 6132 4586.tmp 5728 4613.tmp 896 46BF.tmp 4900 474B.tmp 4728 47B9.tmp 3468 4845.tmp 5164 48C2.tmp 5236 493F.tmp 4284 49AD.tmp 972 4A2A.tmp 5724 4AA7.tmp 3332 4B14.tmp 4928 4B81.tmp 4004 4BFE.tmp 4552 4C6C.tmp 3660 4D08.tmp 2188 4D75.tmp 4720 4E02.tmp 2632 4E7F.tmp 5652 4EFC.tmp 1292 4F79.tmp 4880 4FE6.tmp 2872 5083.tmp 5332 50F0.tmp 4784 515D.tmp 5348 51DA.tmp 4332 5257.tmp 3876 52D4.tmp 236 5342.tmp 5216 53CE.tmp 3296 544B.tmp 4752 54D8.tmp 4120 5545.tmp 5632 55E2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D780.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D88A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B71C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7550.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F384.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 737C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A600.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1360.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E396.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4528 4312 2026-10-06_962646a90a93f495cfc8d23851616471_elex_mafia_stealc_tofsee.exe 89 PID 4528 wrote to memory of 2472 4528 31C0.tmp 90 PID 2472 wrote to memory of 5968 2472 326B.tmp 91 PID 5968 wrote to memory of 572 5968 32E8.tmp 92 PID 572 wrote to memory of 1008 572 3356.tmp 93 PID 1008 wrote to memory of 4452 1008 3402.tmp 94 PID 4452 wrote to memory of 2032 4452 34EC.tmp 95 PID 2032 wrote to memory of 4088 2032 35F6.tmp 96 PID 4088 wrote to memory of 3228 4088 36B1.tmp 97 PID 3228 wrote to memory of 2724 3228 373E.tmp 98 PID 2724 wrote to memory of 2952 2724 37CA.tmp 99 PID 2952 wrote to memory of 2340 2952 3886.tmp 100 PID 2340 wrote to memory of 4912 2340 3951.tmp 101 PID 4912 wrote to memory of 4276 4912 3A0D.tmp 102 PID 4276 wrote to memory of 1140 4276 3AB8.tmp 103 PID 1140 wrote to memory of 5260 1140 3B74.tmp 104 PID 5260 wrote to memory of 4796 5260 3C2F.tmp 105 PID 4796 wrote to memory of 4652 4796 3CBC.tmp 106 PID 4652 wrote to memory of 5488 4652 3D78.tmp 107 PID 5488 wrote to memory of 4948 5488 3DF5.tmp 108 PID 4948 wrote to memory of 1936 4948 3E81.tmp 109 PID 1936 wrote to memory of 1200 1936 3F2D.tmp 110 PID 1200 wrote to memory of 5688 1200 3FD9.tmp 111 PID 5688 wrote to memory of 4256 5688 4085.tmp 112 PID 4256 wrote to memory of 716 4256 4131.tmp 113 PID 716 wrote to memory of 1516 716 41BD.tmp 114 PID 1516 wrote to memory of 1844 1516 4269.tmp 115 PID 1844 wrote to memory of 1736 1844 4305.tmp 116 PID 1736 wrote to memory of 3552 1736 43B1.tmp 117 PID 3552 wrote to memory of 5024 3552 443E.tmp 118 PID 5024 wrote to memory of 6132 5024 44EA.tmp 119 PID 6132 wrote to memory of 5728 6132 4586.tmp 120 PID 5728 wrote to memory of 896 5728 4613.tmp 121 PID 896 wrote to memory of 4900 896 46BF.tmp 122 PID 4900 wrote to memory of 4728 4900 474B.tmp 123 PID 4728 wrote to memory of 3468 4728 47B9.tmp 124 PID 3468 wrote to memory of 5164 3468 4845.tmp 125 PID 5164 wrote to memory of 5236 5164 48C2.tmp 126 PID 5236 wrote to memory of 4284 5236 493F.tmp 127 PID 4284 wrote to memory of 972 4284 49AD.tmp 128 PID 972 wrote to memory of 5724 972 4A2A.tmp 129 PID 5724 wrote to memory of 3332 5724 4AA7.tmp 130 PID 3332 wrote to memory of 4928 3332 4B14.tmp 131 PID 4928 wrote to memory of 4004 4928 4B81.tmp 132 PID 4004 wrote to memory of 4552 4004 4BFE.tmp 133 PID 4552 wrote to memory of 3660 4552 4C6C.tmp 134 PID 3660 wrote to memory of 2188 3660 4D08.tmp 135 PID 2188 wrote to memory of 4720 2188 4D75.tmp 136 PID 4720 wrote to memory of 2632 4720 4E02.tmp 137 PID 2632 wrote to memory of 5652 2632 4E7F.tmp 138 PID 5652 wrote to memory of 1292 5652 4EFC.tmp 139 PID 1292 wrote to memory of 4880 1292 4F79.tmp 140 PID 4880 wrote to memory of 2872 4880 4FE6.tmp 141 PID 2872 wrote to memory of 5332 2872 5083.tmp 142 PID 5332 wrote to memory of 4784 5332 50F0.tmp 143 PID 4784 wrote to memory of 5348 4784 515D.tmp 144 PID 5348 wrote to memory of 4332 5348 51DA.tmp 145 PID 4332 wrote to memory of 3876 4332 5257.tmp 146 PID 3876 wrote to memory of 236 3876 52D4.tmp 147 PID 236 wrote to memory of 5216 236 5342.tmp 148 PID 5216 wrote to memory of 3296 5216 53CE.tmp 149 PID 3296 wrote to memory of 4752 3296 544B.tmp 150 PID 4752 wrote to memory of 4120 4752 54D8.tmp 151 PID 4120 wrote to memory of 5632 4120 5545.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_962646a90a93f495cfc8d23851616471_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_962646a90a93f495cfc8d23851616471_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\326B.tmp"C:\Users\Admin\AppData\Local\Temp\326B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\3356.tmp"C:\Users\Admin\AppData\Local\Temp\3356.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\3402.tmp"C:\Users\Admin\AppData\Local\Temp\3402.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\34EC.tmp"C:\Users\Admin\AppData\Local\Temp\34EC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\35F6.tmp"C:\Users\Admin\AppData\Local\Temp\35F6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\373E.tmp"C:\Users\Admin\AppData\Local\Temp\373E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\37CA.tmp"C:\Users\Admin\AppData\Local\Temp\37CA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3886.tmp"C:\Users\Admin\AppData\Local\Temp\3886.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3951.tmp"C:\Users\Admin\AppData\Local\Temp\3951.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\3B74.tmp"C:\Users\Admin\AppData\Local\Temp\3B74.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\3D78.tmp"C:\Users\Admin\AppData\Local\Temp\3D78.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\3DF5.tmp"C:\Users\Admin\AppData\Local\Temp\3DF5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\3E81.tmp"C:\Users\Admin\AppData\Local\Temp\3E81.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\3F2D.tmp"C:\Users\Admin\AppData\Local\Temp\3F2D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3FD9.tmp"C:\Users\Admin\AppData\Local\Temp\3FD9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4085.tmp"C:\Users\Admin\AppData\Local\Temp\4085.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\4131.tmp"C:\Users\Admin\AppData\Local\Temp\4131.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\41BD.tmp"C:\Users\Admin\AppData\Local\Temp\41BD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\4269.tmp"C:\Users\Admin\AppData\Local\Temp\4269.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4305.tmp"C:\Users\Admin\AppData\Local\Temp\4305.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\43B1.tmp"C:\Users\Admin\AppData\Local\Temp\43B1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\443E.tmp"C:\Users\Admin\AppData\Local\Temp\443E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\44EA.tmp"C:\Users\Admin\AppData\Local\Temp\44EA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4586.tmp"C:\Users\Admin\AppData\Local\Temp\4586.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\46BF.tmp"C:\Users\Admin\AppData\Local\Temp\46BF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\474B.tmp"C:\Users\Admin\AppData\Local\Temp\474B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\47B9.tmp"C:\Users\Admin\AppData\Local\Temp\47B9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4845.tmp"C:\Users\Admin\AppData\Local\Temp\4845.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\48C2.tmp"C:\Users\Admin\AppData\Local\Temp\48C2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\493F.tmp"C:\Users\Admin\AppData\Local\Temp\493F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4D08.tmp"C:\Users\Admin\AppData\Local\Temp\4D08.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4D75.tmp"C:\Users\Admin\AppData\Local\Temp\4D75.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4E02.tmp"C:\Users\Admin\AppData\Local\Temp\4E02.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\4F79.tmp"C:\Users\Admin\AppData\Local\Temp\4F79.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5083.tmp"C:\Users\Admin\AppData\Local\Temp\5083.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\50F0.tmp"C:\Users\Admin\AppData\Local\Temp\50F0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\515D.tmp"C:\Users\Admin\AppData\Local\Temp\515D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\51DA.tmp"C:\Users\Admin\AppData\Local\Temp\51DA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\5257.tmp"C:\Users\Admin\AppData\Local\Temp\5257.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\52D4.tmp"C:\Users\Admin\AppData\Local\Temp\52D4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\5342.tmp"C:\Users\Admin\AppData\Local\Temp\5342.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\53CE.tmp"C:\Users\Admin\AppData\Local\Temp\53CE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\544B.tmp"C:\Users\Admin\AppData\Local\Temp\544B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\54D8.tmp"C:\Users\Admin\AppData\Local\Temp\54D8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5545.tmp"C:\Users\Admin\AppData\Local\Temp\5545.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\55E2.tmp"C:\Users\Admin\AppData\Local\Temp\55E2.tmp"65⤵
- Executes dropped EXE
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\566E.tmp"C:\Users\Admin\AppData\Local\Temp\566E.tmp"66⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\56EB.tmp"C:\Users\Admin\AppData\Local\Temp\56EB.tmp"67⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\5768.tmp"C:\Users\Admin\AppData\Local\Temp\5768.tmp"68⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\57F5.tmp"C:\Users\Admin\AppData\Local\Temp\57F5.tmp"69⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\5881.tmp"C:\Users\Admin\AppData\Local\Temp\5881.tmp"70⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\58FE.tmp"C:\Users\Admin\AppData\Local\Temp\58FE.tmp"71⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\595C.tmp"C:\Users\Admin\AppData\Local\Temp\595C.tmp"72⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\59E9.tmp"C:\Users\Admin\AppData\Local\Temp\59E9.tmp"73⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\5A75.tmp"C:\Users\Admin\AppData\Local\Temp\5A75.tmp"74⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"C:\Users\Admin\AppData\Local\Temp\5AD3.tmp"75⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\5B50.tmp"C:\Users\Admin\AppData\Local\Temp\5B50.tmp"76⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\5BBE.tmp"C:\Users\Admin\AppData\Local\Temp\5BBE.tmp"77⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5C3B.tmp"C:\Users\Admin\AppData\Local\Temp\5C3B.tmp"78⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"79⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\5D35.tmp"C:\Users\Admin\AppData\Local\Temp\5D35.tmp"80⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"81⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"83⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\5F86.tmp"C:\Users\Admin\AppData\Local\Temp\5F86.tmp"84⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"85⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6061.tmp"C:\Users\Admin\AppData\Local\Temp\6061.tmp"86⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\60CE.tmp"C:\Users\Admin\AppData\Local\Temp\60CE.tmp"87⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\614B.tmp"C:\Users\Admin\AppData\Local\Temp\614B.tmp"88⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\61C8.tmp"C:\Users\Admin\AppData\Local\Temp\61C8.tmp"89⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\6236.tmp"C:\Users\Admin\AppData\Local\Temp\6236.tmp"90⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\62A3.tmp"C:\Users\Admin\AppData\Local\Temp\62A3.tmp"91⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6301.tmp"C:\Users\Admin\AppData\Local\Temp\6301.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\637E.tmp"C:\Users\Admin\AppData\Local\Temp\637E.tmp"93⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\63FB.tmp"C:\Users\Admin\AppData\Local\Temp\63FB.tmp"94⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\6468.tmp"C:\Users\Admin\AppData\Local\Temp\6468.tmp"95⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\64E5.tmp"C:\Users\Admin\AppData\Local\Temp\64E5.tmp"96⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\6553.tmp"C:\Users\Admin\AppData\Local\Temp\6553.tmp"97⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\65EF.tmp"C:\Users\Admin\AppData\Local\Temp\65EF.tmp"98⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\665C.tmp"C:\Users\Admin\AppData\Local\Temp\665C.tmp"99⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\66CA.tmp"C:\Users\Admin\AppData\Local\Temp\66CA.tmp"100⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6737.tmp"C:\Users\Admin\AppData\Local\Temp\6737.tmp"101⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\67B4.tmp"C:\Users\Admin\AppData\Local\Temp\67B4.tmp"102⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\6C29.tmp"C:\Users\Admin\AppData\Local\Temp\6C29.tmp"103⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6C96.tmp"C:\Users\Admin\AppData\Local\Temp\6C96.tmp"104⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\6D03.tmp"C:\Users\Admin\AppData\Local\Temp\6D03.tmp"105⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\6D71.tmp"C:\Users\Admin\AppData\Local\Temp\6D71.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6DFD.tmp"C:\Users\Admin\AppData\Local\Temp\6DFD.tmp"107⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\6E6B.tmp"C:\Users\Admin\AppData\Local\Temp\6E6B.tmp"108⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6EF7.tmp"C:\Users\Admin\AppData\Local\Temp\6EF7.tmp"109⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6F84.tmp"C:\Users\Admin\AppData\Local\Temp\6F84.tmp"110⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7001.tmp"C:\Users\Admin\AppData\Local\Temp\7001.tmp"111⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"113⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"114⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"115⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"116⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\72FF.tmp"C:\Users\Admin\AppData\Local\Temp\72FF.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\737C.tmp"C:\Users\Admin\AppData\Local\Temp\737C.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"119⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7456.tmp"C:\Users\Admin\AppData\Local\Temp\7456.tmp"120⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\74D3.tmp"C:\Users\Admin\AppData\Local\Temp\74D3.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7550.tmp"C:\Users\Admin\AppData\Local\Temp\7550.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:5816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-