Analysis
- max time kernel
124s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 16:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_deccf603f402d4dbe0a62f5b086e2824_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_deccf603f402d4dbe0a62f5b086e2824_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_deccf603f402d4dbe0a62f5b086e2824_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample261023-varjsae17j
- SHA256 9833de8aeb1f313ff2e7e0fa88d1b7b8a6b12dba5f814424c01231bdf7d09ed5
- MD5 deccf603f402d4dbe0a62f5b086e2824
- SHA1 6ebde1b583ba31afb1e3aaff6802c2a67e34bd8f
- SHA512 7b07dbc2aa8c99701e761a54b58d979da88b60817a436310eb56720e01e976fce3c2653662d3e0455d4e9f719549f382427e341c1cd262dc16da10220b0ca974
- SSDEEP 12288:9U5rCOTei6aE5ccj/TbYnC+R2kYgH9qZoXWjdq:9UQOJ6JbTQC+2kv9qqGh
- TLSH T193C4F122B544C032E99212314EE2EBB1996E7C714B2664C73BC0B76E6FB52E1D379347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5056 31A0.tmp 1444 326B.tmp 1952 3317.tmp 4152 33C3.tmp 5036 34FC.tmp 6116 3625.tmp 960 36B1.tmp 3996 375D.tmp 4608 37DA.tmp 296 3857.tmp 5012 38C4.tmp 2844 39AF.tmp 2536 3A3B.tmp 5140 3AE7.tmp 3880 3B64.tmp 3412 3BE1.tmp 5764 3C4F.tmp 5184 3CEB.tmp 2812 3D68.tmp 4020 3E33.tmp 3972 3EB0.tmp 1832 3F1D.tmp 1700 3FE9.tmp 4116 4085.tmp 2636 4140.tmp 4128 41BD.tmp 2920 4279.tmp 4224 4305.tmp 3024 43A2.tmp 5416 442E.tmp 1080 44CB.tmp 5068 4557.tmp 4348 4613.tmp 2972 4690.tmp 1212 46FD.tmp 3476 476A.tmp 1884 47F7.tmp 1544 4874.tmp 2840 48E1.tmp 3580 495E.tmp 5716 49BC.tmp 1112 4A2A.tmp 3500 4AA7.tmp 5836 4B04.tmp 4460 4B72.tmp 696 4BEF.tmp 3748 4C7B.tmp 908 4CE9.tmp 3480 4D56.tmp 5596 4DD3.tmp 3708 4E50.tmp 4008 4EDD.tmp 2328 4F4A.tmp 3540 4FB7.tmp 2444 5034.tmp 4732 50B1.tmp 5748 511F.tmp 1692 51BB.tmp 4804 5228.tmp 956 52A5.tmp 5504 5313.tmp 3280 5380.tmp 5396 53FD.tmp 4068 547A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 784E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E698.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6732.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 245D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F355.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6255.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5324 wrote to memory of 5056 5324 2026-10-22_deccf603f402d4dbe0a62f5b086e2824_elex_mafia_stealc_tofsee.exe 89 PID 5056 wrote to memory of 1444 5056 31A0.tmp 90 PID 1444 wrote to memory of 1952 1444 326B.tmp 91 PID 1952 wrote to memory of 4152 1952 3317.tmp 92 PID 4152 wrote to memory of 5036 4152 33C3.tmp 93 PID 5036 wrote to memory of 6116 5036 34FC.tmp 94 PID 6116 wrote to memory of 960 6116 3625.tmp 95 PID 960 wrote to memory of 3996 960 36B1.tmp 96 PID 3996 wrote to memory of 4608 3996 375D.tmp 97 PID 4608 wrote to memory of 296 4608 37DA.tmp 98 PID 296 wrote to memory of 5012 296 3857.tmp 99 PID 5012 wrote to memory of 2844 5012 38C4.tmp 100 PID 2844 wrote to memory of 2536 2844 39AF.tmp 101 PID 2536 wrote to memory of 5140 2536 3A3B.tmp 102 PID 5140 wrote to memory of 3880 5140 3AE7.tmp 103 PID 3880 wrote to memory of 3412 3880 3B64.tmp 104 PID 3412 wrote to memory of 5764 3412 3BE1.tmp 105 PID 5764 wrote to memory of 5184 5764 3C4F.tmp 106 PID 5184 wrote to memory of 2812 5184 3CEB.tmp 107 PID 2812 wrote to memory of 4020 2812 3D68.tmp 108 PID 4020 wrote to memory of 3972 4020 3E33.tmp 109 PID 3972 wrote to memory of 1832 3972 3EB0.tmp 110 PID 1832 wrote to memory of 1700 1832 3F1D.tmp 111 PID 1700 wrote to memory of 4116 1700 3FE9.tmp 112 PID 4116 wrote to memory of 2636 4116 4085.tmp 113 PID 2636 wrote to memory of 4128 2636 4140.tmp 114 PID 4128 wrote to memory of 2920 4128 41BD.tmp 115 PID 2920 wrote to memory of 4224 2920 4279.tmp 116 PID 4224 wrote to memory of 3024 4224 4305.tmp 117 PID 3024 wrote to memory of 5416 3024 43A2.tmp 118 PID 5416 wrote to memory of 1080 5416 442E.tmp 119 PID 1080 wrote to memory of 5068 1080 44CB.tmp 120 PID 5068 wrote to memory of 4348 5068 4557.tmp 121 PID 4348 wrote to memory of 2972 4348 4613.tmp 122 PID 2972 wrote to memory of 1212 2972 4690.tmp 123 PID 1212 wrote to memory of 3476 1212 46FD.tmp 124 PID 3476 wrote to memory of 1884 3476 476A.tmp 125 PID 1884 wrote to memory of 1544 1884 47F7.tmp 126 PID 1544 wrote to memory of 2840 1544 4874.tmp 127 PID 2840 wrote to memory of 3580 2840 48E1.tmp 128 PID 3580 wrote to memory of 5716 3580 495E.tmp 129 PID 5716 wrote to memory of 1112 5716 49BC.tmp 130 PID 1112 wrote to memory of 3500 1112 4A2A.tmp 131 PID 3500 wrote to memory of 5836 3500 4AA7.tmp 132 PID 5836 wrote to memory of 4460 5836 4B04.tmp 133 PID 4460 wrote to memory of 696 4460 4B72.tmp 134 PID 696 wrote to memory of 3748 696 4BEF.tmp 135 PID 3748 wrote to memory of 908 3748 4C7B.tmp 136 PID 908 wrote to memory of 3480 908 4CE9.tmp 137 PID 3480 wrote to memory of 5596 3480 4D56.tmp 138 PID 5596 wrote to memory of 3708 5596 4DD3.tmp 139 PID 3708 wrote to memory of 4008 3708 4E50.tmp 140 PID 4008 wrote to memory of 2328 4008 4EDD.tmp 141 PID 2328 wrote to memory of 3540 2328 4F4A.tmp 142 PID 3540 wrote to memory of 2444 3540 4FB7.tmp 143 PID 2444 wrote to memory of 4732 2444 5034.tmp 144 PID 4732 wrote to memory of 5748 4732 50B1.tmp 145 PID 5748 wrote to memory of 1692 5748 511F.tmp 146 PID 1692 wrote to memory of 4804 1692 51BB.tmp 147 PID 4804 wrote to memory of 956 4804 5228.tmp 148 PID 956 wrote to memory of 5504 956 52A5.tmp 149 PID 5504 wrote to memory of 3280 5504 5313.tmp 150 PID 3280 wrote to memory of 5396 3280 5380.tmp 151 PID 5396 wrote to memory of 4068 5396 53FD.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_deccf603f402d4dbe0a62f5b086e2824_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_deccf603f402d4dbe0a62f5b086e2824_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\31A0.tmp"C:\Users\Admin\AppData\Local\Temp\31A0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\326B.tmp"C:\Users\Admin\AppData\Local\Temp\326B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3317.tmp"C:\Users\Admin\AppData\Local\Temp\3317.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\33C3.tmp"C:\Users\Admin\AppData\Local\Temp\33C3.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\34FC.tmp"C:\Users\Admin\AppData\Local\Temp\34FC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3625.tmp"C:\Users\Admin\AppData\Local\Temp\3625.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\375D.tmp"C:\Users\Admin\AppData\Local\Temp\375D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\37DA.tmp"C:\Users\Admin\AppData\Local\Temp\37DA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3857.tmp"C:\Users\Admin\AppData\Local\Temp\3857.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\38C4.tmp"C:\Users\Admin\AppData\Local\Temp\38C4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\39AF.tmp"C:\Users\Admin\AppData\Local\Temp\39AF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3A3B.tmp"C:\Users\Admin\AppData\Local\Temp\3A3B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\3B64.tmp"C:\Users\Admin\AppData\Local\Temp\3B64.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\3D68.tmp"C:\Users\Admin\AppData\Local\Temp\3D68.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3E33.tmp"C:\Users\Admin\AppData\Local\Temp\3E33.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\3EB0.tmp"C:\Users\Admin\AppData\Local\Temp\3EB0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\4085.tmp"C:\Users\Admin\AppData\Local\Temp\4085.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\4140.tmp"C:\Users\Admin\AppData\Local\Temp\4140.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\41BD.tmp"C:\Users\Admin\AppData\Local\Temp\41BD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4279.tmp"C:\Users\Admin\AppData\Local\Temp\4279.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4305.tmp"C:\Users\Admin\AppData\Local\Temp\4305.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\43A2.tmp"C:\Users\Admin\AppData\Local\Temp\43A2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\442E.tmp"C:\Users\Admin\AppData\Local\Temp\442E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\44CB.tmp"C:\Users\Admin\AppData\Local\Temp\44CB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4557.tmp"C:\Users\Admin\AppData\Local\Temp\4557.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4690.tmp"C:\Users\Admin\AppData\Local\Temp\4690.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\46FD.tmp"C:\Users\Admin\AppData\Local\Temp\46FD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\476A.tmp"C:\Users\Admin\AppData\Local\Temp\476A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\47F7.tmp"C:\Users\Admin\AppData\Local\Temp\47F7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\4874.tmp"C:\Users\Admin\AppData\Local\Temp\4874.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\48E1.tmp"C:\Users\Admin\AppData\Local\Temp\48E1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\495E.tmp"C:\Users\Admin\AppData\Local\Temp\495E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\49BC.tmp"C:\Users\Admin\AppData\Local\Temp\49BC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4BEF.tmp"C:\Users\Admin\AppData\Local\Temp\4BEF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\4D56.tmp"C:\Users\Admin\AppData\Local\Temp\4D56.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\4E50.tmp"C:\Users\Admin\AppData\Local\Temp\4E50.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"C:\Users\Admin\AppData\Local\Temp\4EDD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"C:\Users\Admin\AppData\Local\Temp\4FB7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\5034.tmp"C:\Users\Admin\AppData\Local\Temp\5034.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\50B1.tmp"C:\Users\Admin\AppData\Local\Temp\50B1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\511F.tmp"C:\Users\Admin\AppData\Local\Temp\511F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\51BB.tmp"C:\Users\Admin\AppData\Local\Temp\51BB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5228.tmp"C:\Users\Admin\AppData\Local\Temp\5228.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\52A5.tmp"C:\Users\Admin\AppData\Local\Temp\52A5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\5313.tmp"C:\Users\Admin\AppData\Local\Temp\5313.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\5380.tmp"C:\Users\Admin\AppData\Local\Temp\5380.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\53FD.tmp"C:\Users\Admin\AppData\Local\Temp\53FD.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\547A.tmp"C:\Users\Admin\AppData\Local\Temp\547A.tmp"65⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\54D8.tmp"C:\Users\Admin\AppData\Local\Temp\54D8.tmp"66⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\5545.tmp"C:\Users\Admin\AppData\Local\Temp\5545.tmp"67⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"68⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\5630.tmp"C:\Users\Admin\AppData\Local\Temp\5630.tmp"69⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\569D.tmp"C:\Users\Admin\AppData\Local\Temp\569D.tmp"70⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\570A.tmp"C:\Users\Admin\AppData\Local\Temp\570A.tmp"71⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\5768.tmp"C:\Users\Admin\AppData\Local\Temp\5768.tmp"72⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5804.tmp"C:\Users\Admin\AppData\Local\Temp\5804.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\5881.tmp"C:\Users\Admin\AppData\Local\Temp\5881.tmp"74⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\58FE.tmp"C:\Users\Admin\AppData\Local\Temp\58FE.tmp"75⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\597B.tmp"C:\Users\Admin\AppData\Local\Temp\597B.tmp"76⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\59E9.tmp"C:\Users\Admin\AppData\Local\Temp\59E9.tmp"77⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\5A56.tmp"C:\Users\Admin\AppData\Local\Temp\5A56.tmp"78⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\Users\Admin\AppData\Local\Temp\5B21.tmp"C:\Users\Admin\AppData\Local\Temp\5B21.tmp"80⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\5BAE.tmp"C:\Users\Admin\AppData\Local\Temp\5BAE.tmp"81⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"82⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\5C89.tmp"C:\Users\Admin\AppData\Local\Temp\5C89.tmp"83⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"C:\Users\Admin\AppData\Local\Temp\5CE6.tmp"84⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\5D54.tmp"C:\Users\Admin\AppData\Local\Temp\5D54.tmp"85⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\5DD1.tmp"C:\Users\Admin\AppData\Local\Temp\5DD1.tmp"86⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5E4E.tmp"C:\Users\Admin\AppData\Local\Temp\5E4E.tmp"87⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\5ECB.tmp"C:\Users\Admin\AppData\Local\Temp\5ECB.tmp"88⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5F38.tmp"C:\Users\Admin\AppData\Local\Temp\5F38.tmp"89⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"90⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\6032.tmp"C:\Users\Admin\AppData\Local\Temp\6032.tmp"91⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\60A0.tmp"C:\Users\Admin\AppData\Local\Temp\60A0.tmp"92⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\610D.tmp"C:\Users\Admin\AppData\Local\Temp\610D.tmp"93⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\618A.tmp"C:\Users\Admin\AppData\Local\Temp\618A.tmp"94⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\61E8.tmp"C:\Users\Admin\AppData\Local\Temp\61E8.tmp"95⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\6255.tmp"C:\Users\Admin\AppData\Local\Temp\6255.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\62D2.tmp"C:\Users\Admin\AppData\Local\Temp\62D2.tmp"97⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\633F.tmp"C:\Users\Admin\AppData\Local\Temp\633F.tmp"98⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\63AD.tmp"C:\Users\Admin\AppData\Local\Temp\63AD.tmp"99⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6449.tmp"C:\Users\Admin\AppData\Local\Temp\6449.tmp"100⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\64C6.tmp"C:\Users\Admin\AppData\Local\Temp\64C6.tmp"101⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\6533.tmp"C:\Users\Admin\AppData\Local\Temp\6533.tmp"102⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\65A1.tmp"C:\Users\Admin\AppData\Local\Temp\65A1.tmp"103⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\660E.tmp"C:\Users\Admin\AppData\Local\Temp\660E.tmp"104⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\668B.tmp"C:\Users\Admin\AppData\Local\Temp\668B.tmp"105⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\6708.tmp"C:\Users\Admin\AppData\Local\Temp\6708.tmp"106⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6776.tmp"C:\Users\Admin\AppData\Local\Temp\6776.tmp"107⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\67D3.tmp"C:\Users\Admin\AppData\Local\Temp\67D3.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\6C58.tmp"C:\Users\Admin\AppData\Local\Temp\6C58.tmp"109⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\6D42.tmp"C:\Users\Admin\AppData\Local\Temp\6D42.tmp"111⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"112⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"113⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"114⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\6F26.tmp"C:\Users\Admin\AppData\Local\Temp\6F26.tmp"115⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"116⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7020.tmp"C:\Users\Admin\AppData\Local\Temp\7020.tmp"117⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\707E.tmp"C:\Users\Admin\AppData\Local\Temp\707E.tmp"118⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\70EB.tmp"C:\Users\Admin\AppData\Local\Temp\70EB.tmp"119⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"120⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"121⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"122⤵PID:3504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-