Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_f0e928c4778470d0749b7c26fb4c74ec_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_f0e928c4778470d0749b7c26fb4c74ec_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-26_f0e928c4778470d0749b7c26fb4c74ec_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample261027-c6mxcsaz2l
- SHA256 c2676f8ca51bf478ce604a4fd5d7e086caef296b4f20b9f693a59a8bd60bf36d
- MD5 f0e928c4778470d0749b7c26fb4c74ec
- SHA1 8ca076a9a57c2ba5bdf16410bdb4187db59de6a0
- SHA512 6a46de4c8efc93c48a92446d14fab669f6f8c07f793b6df17127ba3bda7f79ccb422e50db62c6dca4bbeb060614fd229653ef5f355289767105294094a3552ee
- SSDEEP 12288:NU5rCOTeijtUlYug4AaVl2IKa9/63YTZwlH:NUQOJjtqgRaDYs63YTSlH
- TLSH T127B4F125B585C032E69312314AD6EBA12A3E7C765725A4C337C0A37E2FB12E2D775347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4428 C6C6.tmp 4148 C772.tmp 3904 C83D.tmp 3096 C8D9.tmp 4496 C975.tmp 1672 CA21.tmp 4844 CABD.tmp 1544 CB2B.tmp 3816 CBA8.tmp 3784 CC34.tmp 4740 CCE0.tmp 2152 CD6D.tmp 1724 CE09.tmp 1116 CEB5.tmp 4032 CF51.tmp 4656 CFFD.tmp 4488 D099.tmp 1904 D116.tmp 1156 D1A3.tmp 4132 D230.tmp 4124 D2FB.tmp 2800 D397.tmp 220 D424.tmp 2660 D4B0.tmp 1012 D51E.tmp 820 D57B.tmp 1324 D618.tmp 560 D685.tmp 2312 D6F2.tmp 3240 D76F.tmp 3336 D7DD.tmp 1424 D889.tmp 1684 D925.tmp 4316 D983.tmp 5080 D9E0.tmp 4432 DA3E.tmp 2976 DA9C.tmp 1584 DB09.tmp 2020 DB67.tmp 2084 DBD4.tmp 4120 DC22.tmp 2880 DC71.tmp 4260 DCBF.tmp 2140 DD1C.tmp 4948 DD6B.tmp 2380 DDB9.tmp 4176 DE07.tmp 1484 DE55.tmp 4188 DEA3.tmp 4444 DEF1.tmp 1824 DF4F.tmp 4280 DF9D.tmp 2116 DFEB.tmp 660 E039.tmp 1168 E097.tmp 1768 E0E5.tmp 2784 E143.tmp 3896 E1A1.tmp 4396 E1EF.tmp 4332 E23D.tmp 2440 E28B.tmp 2628 E2D9.tmp 4608 E337.tmp 808 E385.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 769D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B50E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4428 4652 2026-10-26_f0e928c4778470d0749b7c26fb4c74ec_elex_mafia_stealc_tofsee.exe 84 PID 4428 wrote to memory of 4148 4428 C6C6.tmp 85 PID 4148 wrote to memory of 3904 4148 C772.tmp 86 PID 3904 wrote to memory of 3096 3904 C83D.tmp 87 PID 3096 wrote to memory of 4496 3096 C8D9.tmp 88 PID 4496 wrote to memory of 1672 4496 C975.tmp 89 PID 1672 wrote to memory of 4844 1672 CA21.tmp 90 PID 4844 wrote to memory of 1544 4844 CABD.tmp 91 PID 1544 wrote to memory of 3816 1544 CB2B.tmp 92 PID 3816 wrote to memory of 3784 3816 CBA8.tmp 93 PID 3784 wrote to memory of 4740 3784 CC34.tmp 94 PID 4740 wrote to memory of 2152 4740 CCE0.tmp 95 PID 2152 wrote to memory of 1724 2152 CD6D.tmp 96 PID 1724 wrote to memory of 1116 1724 CE09.tmp 97 PID 1116 wrote to memory of 4032 1116 CEB5.tmp 98 PID 4032 wrote to memory of 4656 4032 CF51.tmp 99 PID 4656 wrote to memory of 4488 4656 CFFD.tmp 100 PID 4488 wrote to memory of 1904 4488 D099.tmp 101 PID 1904 wrote to memory of 1156 1904 D116.tmp 104 PID 1156 wrote to memory of 4132 1156 D1A3.tmp 105 PID 4132 wrote to memory of 4124 4132 D230.tmp 106 PID 4124 wrote to memory of 2800 4124 D2FB.tmp 107 PID 2800 wrote to memory of 220 2800 D397.tmp 108 PID 220 wrote to memory of 2660 220 D424.tmp 109 PID 2660 wrote to memory of 1012 2660 D4B0.tmp 110 PID 1012 wrote to memory of 820 1012 D51E.tmp 111 PID 820 wrote to memory of 1324 820 D57B.tmp 113 PID 1324 wrote to memory of 560 1324 D618.tmp 115 PID 560 wrote to memory of 2312 560 D685.tmp 116 PID 2312 wrote to memory of 3240 2312 D6F2.tmp 117 PID 3240 wrote to memory of 3336 3240 D76F.tmp 118 PID 3336 wrote to memory of 1424 3336 D7DD.tmp 119 PID 1424 wrote to memory of 1684 1424 D889.tmp 120 PID 1684 wrote to memory of 4316 1684 D925.tmp 121 PID 4316 wrote to memory of 5080 4316 D983.tmp 122 PID 5080 wrote to memory of 4432 5080 D9E0.tmp 123 PID 4432 wrote to memory of 2976 4432 DA3E.tmp 124 PID 2976 wrote to memory of 1584 2976 DA9C.tmp 125 PID 1584 wrote to memory of 2020 1584 DB09.tmp 126 PID 2020 wrote to memory of 2084 2020 DB67.tmp 127 PID 2084 wrote to memory of 4120 2084 DBD4.tmp 128 PID 4120 wrote to memory of 2880 4120 DC22.tmp 129 PID 2880 wrote to memory of 4260 2880 DC71.tmp 130 PID 4260 wrote to memory of 2140 4260 DCBF.tmp 131 PID 2140 wrote to memory of 4948 2140 DD1C.tmp 132 PID 4948 wrote to memory of 2380 4948 DD6B.tmp 133 PID 2380 wrote to memory of 4176 2380 DDB9.tmp 134 PID 4176 wrote to memory of 1484 4176 DE07.tmp 135 PID 1484 wrote to memory of 4188 1484 DE55.tmp 136 PID 4188 wrote to memory of 4444 4188 DEA3.tmp 137 PID 4444 wrote to memory of 1824 4444 DEF1.tmp 138 PID 1824 wrote to memory of 4280 1824 DF4F.tmp 139 PID 4280 wrote to memory of 2116 4280 DF9D.tmp 140 PID 2116 wrote to memory of 660 2116 DFEB.tmp 141 PID 660 wrote to memory of 1168 660 E039.tmp 142 PID 1168 wrote to memory of 1768 1168 E097.tmp 143 PID 1768 wrote to memory of 2784 1768 E0E5.tmp 144 PID 2784 wrote to memory of 3896 2784 E143.tmp 146 PID 3896 wrote to memory of 4396 3896 E1A1.tmp 147 PID 4396 wrote to memory of 4332 4396 E1EF.tmp 148 PID 4332 wrote to memory of 2440 4332 E23D.tmp 149 PID 2440 wrote to memory of 2628 2440 E28B.tmp 150 PID 2628 wrote to memory of 4608 2628 E2D9.tmp 151 PID 4608 wrote to memory of 808 4608 E337.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_f0e928c4778470d0749b7c26fb4c74ec_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_f0e928c4778470d0749b7c26fb4c74ec_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\C772.tmp"C:\Users\Admin\AppData\Local\Temp\C772.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\CC34.tmp"C:\Users\Admin\AppData\Local\Temp\CC34.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\D57B.tmp"C:\Users\Admin\AppData\Local\Temp\D57B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\D925.tmp"C:\Users\Admin\AppData\Local\Temp\D925.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\DB09.tmp"C:\Users\Admin\AppData\Local\Temp\DB09.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\E097.tmp"C:\Users\Admin\AppData\Local\Temp\E097.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\E143.tmp"C:\Users\Admin\AppData\Local\Temp\E143.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\E385.tmp"C:\Users\Admin\AppData\Local\Temp\E385.tmp"65⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"66⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"67⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\E48F.tmp"C:\Users\Admin\AppData\Local\Temp\E48F.tmp"68⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\E4DD.tmp"C:\Users\Admin\AppData\Local\Temp\E4DD.tmp"69⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"70⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\E598.tmp"C:\Users\Admin\AppData\Local\Temp\E598.tmp"71⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"72⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"73⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"74⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"75⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"76⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"77⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"78⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\E867.tmp"C:\Users\Admin\AppData\Local\Temp\E867.tmp"79⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"80⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"81⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"82⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"83⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"84⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"85⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"86⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\EB17.tmp"C:\Users\Admin\AppData\Local\Temp\EB17.tmp"87⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"88⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"89⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\EC30.tmp"C:\Users\Admin\AppData\Local\Temp\EC30.tmp"90⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"91⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"92⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\ED49.tmp"C:\Users\Admin\AppData\Local\Temp\ED49.tmp"93⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\ED97.tmp"C:\Users\Admin\AppData\Local\Temp\ED97.tmp"94⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"95⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\EE33.tmp"C:\Users\Admin\AppData\Local\Temp\EE33.tmp"96⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"97⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"98⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"99⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"100⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"101⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\F027.tmp"C:\Users\Admin\AppData\Local\Temp\F027.tmp"102⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"103⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"104⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"105⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\F160.tmp"C:\Users\Admin\AppData\Local\Temp\F160.tmp"106⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"107⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"109⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"110⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"111⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"112⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"113⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"114⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"115⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"116⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"117⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"118⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\F558.tmp"C:\Users\Admin\AppData\Local\Temp\F558.tmp"119⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"120⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"121⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"122⤵PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-