Analysis
- max time kernel
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_accab192bbcd55b6da191320afc746b0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_accab192bbcd55b6da191320afc746b0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_accab192bbcd55b6da191320afc746b0_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260817-gnf4batgma
- SHA256 2df879df76bfc2c82cde3e8febfacedac70297ebe2b1f96335356decfb1a9733
- MD5 accab192bbcd55b6da191320afc746b0
- SHA1 3756887f5385b435d0e75924c3b8e19cd776e667
- SHA512 25ab9fd5683d694ea68df19348a62e6cb839b19c1acae7c382f8da690fe390a3b8c28e9accae45309083a1b66092464db8bf5f342b92bea2281fe966f485aa05
- SSDEEP 12288:9U5rCOTei6QdfKnQrsQkXzgU9BTC4vysvjgp3aHZqZoXWjdq:9UQOJ6QpAQrgXTC4qsv8taHZqqGh
- TLSH T1BEC4F121B685C032E59612310EE5EBB16D7ABC355B26A4C77BD0672E6FB12E1E374303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2540 332.tmp 3804 3DE.tmp 4312 46B.tmp 4112 526.tmp 1840 5D2.tmp 5084 7C6.tmp 5008 843.tmp 2260 8E0.tmp 5056 99B.tmp 4220 A47.tmp 1988 AF3.tmp 2544 B9F.tmp 3704 C2B.tmp 2708 CC8.tmp 2580 D64.tmp 1444 E1F.tmp 4360 EAC.tmp 4116 F77.tmp 3664 1042.tmp 2152 10CF.tmp 4344 118A.tmp 292 1227.tmp 3252 12A4.tmp 2644 137E.tmp 680 140B.tmp 2468 14A7.tmp 2608 1572.tmp 1140 15FF.tmp 5480 169B.tmp 5556 1776.tmp 5488 1841.tmp 3212 18FD.tmp 3836 1989.tmp 2988 19F7.tmp 4916 1A64.tmp 4740 1AF1.tmp 4332 1B7D.tmp 2424 1C0A.tmp 1304 1C96.tmp 1136 1D13.tmp 4844 1D81.tmp 3544 1DFE.tmp 2976 1E7B.tmp 4576 1F07.tmp 1756 1F75.tmp 3952 1FF2.tmp 2492 206F.tmp 1076 20DC.tmp 5404 2169.tmp 2600 21E6.tmp 3964 2272.tmp 756 22FF.tmp 2396 237C.tmp 2088 2409.tmp 5432 2476.tmp 2876 2503.tmp 1248 258F.tmp 5804 263B.tmp 1648 26B8.tmp 4416 2754.tmp 4388 27D1.tmp 1848 284E.tmp 5232 28DB.tmp 3048 2977.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7550.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 331C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 924E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5460 wrote to memory of 2540 5460 2026-08-17_accab192bbcd55b6da191320afc746b0_elex_mafia_stealc_tofsee.exe 89 PID 2540 wrote to memory of 3804 2540 332.tmp 90 PID 3804 wrote to memory of 4312 3804 3DE.tmp 91 PID 4312 wrote to memory of 4112 4312 46B.tmp 92 PID 4112 wrote to memory of 1840 4112 526.tmp 93 PID 1840 wrote to memory of 5084 1840 5D2.tmp 94 PID 5084 wrote to memory of 5008 5084 7C6.tmp 95 PID 5008 wrote to memory of 2260 5008 843.tmp 96 PID 2260 wrote to memory of 5056 2260 8E0.tmp 97 PID 5056 wrote to memory of 4220 5056 99B.tmp 98 PID 4220 wrote to memory of 1988 4220 A47.tmp 99 PID 1988 wrote to memory of 2544 1988 AF3.tmp 100 PID 2544 wrote to memory of 3704 2544 B9F.tmp 101 PID 3704 wrote to memory of 2708 3704 C2B.tmp 102 PID 2708 wrote to memory of 2580 2708 CC8.tmp 103 PID 2580 wrote to memory of 1444 2580 D64.tmp 104 PID 1444 wrote to memory of 4360 1444 E1F.tmp 105 PID 4360 wrote to memory of 4116 4360 EAC.tmp 106 PID 4116 wrote to memory of 3664 4116 F77.tmp 107 PID 3664 wrote to memory of 2152 3664 1042.tmp 108 PID 2152 wrote to memory of 4344 2152 10CF.tmp 109 PID 4344 wrote to memory of 292 4344 118A.tmp 110 PID 292 wrote to memory of 3252 292 1227.tmp 111 PID 3252 wrote to memory of 2644 3252 12A4.tmp 112 PID 2644 wrote to memory of 680 2644 137E.tmp 113 PID 680 wrote to memory of 2468 680 140B.tmp 114 PID 2468 wrote to memory of 2608 2468 14A7.tmp 115 PID 2608 wrote to memory of 1140 2608 1572.tmp 116 PID 1140 wrote to memory of 5480 1140 15FF.tmp 117 PID 5480 wrote to memory of 5556 5480 169B.tmp 118 PID 5556 wrote to memory of 5488 5556 1776.tmp 119 PID 5488 wrote to memory of 3212 5488 1841.tmp 120 PID 3212 wrote to memory of 3836 3212 18FD.tmp 121 PID 3836 wrote to memory of 2988 3836 1989.tmp 122 PID 2988 wrote to memory of 4916 2988 19F7.tmp 123 PID 4916 wrote to memory of 4740 4916 1A64.tmp 124 PID 4740 wrote to memory of 4332 4740 1AF1.tmp 125 PID 4332 wrote to memory of 2424 4332 1B7D.tmp 126 PID 2424 wrote to memory of 1304 2424 1C0A.tmp 127 PID 1304 wrote to memory of 1136 1304 1C96.tmp 128 PID 1136 wrote to memory of 4844 1136 1D13.tmp 129 PID 4844 wrote to memory of 3544 4844 1D81.tmp 130 PID 3544 wrote to memory of 2976 3544 1DFE.tmp 131 PID 2976 wrote to memory of 4576 2976 1E7B.tmp 132 PID 4576 wrote to memory of 1756 4576 1F07.tmp 133 PID 1756 wrote to memory of 3952 1756 1F75.tmp 134 PID 3952 wrote to memory of 2492 3952 1FF2.tmp 135 PID 2492 wrote to memory of 1076 2492 206F.tmp 136 PID 1076 wrote to memory of 5404 1076 20DC.tmp 137 PID 5404 wrote to memory of 2600 5404 2169.tmp 138 PID 2600 wrote to memory of 3964 2600 21E6.tmp 139 PID 3964 wrote to memory of 756 3964 2272.tmp 140 PID 756 wrote to memory of 2396 756 22FF.tmp 141 PID 2396 wrote to memory of 2088 2396 237C.tmp 142 PID 2088 wrote to memory of 5432 2088 2409.tmp 143 PID 5432 wrote to memory of 2876 5432 2476.tmp 144 PID 2876 wrote to memory of 1248 2876 2503.tmp 145 PID 1248 wrote to memory of 5804 1248 258F.tmp 146 PID 5804 wrote to memory of 1648 5804 263B.tmp 147 PID 1648 wrote to memory of 4416 1648 26B8.tmp 148 PID 4416 wrote to memory of 4388 4416 2754.tmp 149 PID 4388 wrote to memory of 1848 4388 27D1.tmp 150 PID 1848 wrote to memory of 5232 1848 284E.tmp 151 PID 5232 wrote to memory of 3048 5232 28DB.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_accab192bbcd55b6da191320afc746b0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_accab192bbcd55b6da191320afc746b0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\332.tmp"C:\Users\Admin\AppData\Local\Temp\332.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3DE.tmp"C:\Users\Admin\AppData\Local\Temp\3DE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\46B.tmp"C:\Users\Admin\AppData\Local\Temp\46B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8E0.tmp"C:\Users\Admin\AppData\Local\Temp\8E0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\99B.tmp"C:\Users\Admin\AppData\Local\Temp\99B.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\B9F.tmp"C:\Users\Admin\AppData\Local\Temp\B9F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\D64.tmp"C:\Users\Admin\AppData\Local\Temp\D64.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\1042.tmp"C:\Users\Admin\AppData\Local\Temp\1042.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\10CF.tmp"C:\Users\Admin\AppData\Local\Temp\10CF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\118A.tmp"C:\Users\Admin\AppData\Local\Temp\118A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\12A4.tmp"C:\Users\Admin\AppData\Local\Temp\12A4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\1841.tmp"C:\Users\Admin\AppData\Local\Temp\1841.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\19F7.tmp"C:\Users\Admin\AppData\Local\Temp\19F7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\1D81.tmp"C:\Users\Admin\AppData\Local\Temp\1D81.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\206F.tmp"C:\Users\Admin\AppData\Local\Temp\206F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2169.tmp"C:\Users\Admin\AppData\Local\Temp\2169.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\258F.tmp"C:\Users\Admin\AppData\Local\Temp\258F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\263B.tmp"C:\Users\Admin\AppData\Local\Temp\263B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\28DB.tmp"C:\Users\Admin\AppData\Local\Temp\28DB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\2977.tmp"C:\Users\Admin\AppData\Local\Temp\2977.tmp"65⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"66⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"67⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"68⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"69⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"70⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"71⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"72⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"73⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"74⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\2E79.tmp"C:\Users\Admin\AppData\Local\Temp\2E79.tmp"75⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"76⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"77⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"78⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\305D.tmp"C:\Users\Admin\AppData\Local\Temp\305D.tmp"79⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\30DA.tmp"C:\Users\Admin\AppData\Local\Temp\30DA.tmp"80⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"81⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3203.tmp"C:\Users\Admin\AppData\Local\Temp\3203.tmp"82⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\3280.tmp"C:\Users\Admin\AppData\Local\Temp\3280.tmp"83⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\33C8.tmp"C:\Users\Admin\AppData\Local\Temp\33C8.tmp"85⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\3445.tmp"C:\Users\Admin\AppData\Local\Temp\3445.tmp"86⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"87⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"88⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"89⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3658.tmp"C:\Users\Admin\AppData\Local\Temp\3658.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"92⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"93⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"94⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\38AA.tmp"C:\Users\Admin\AppData\Local\Temp\38AA.tmp"95⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"96⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\3994.tmp"C:\Users\Admin\AppData\Local\Temp\3994.tmp"97⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3A11.tmp"C:\Users\Admin\AppData\Local\Temp\3A11.tmp"98⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"99⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"100⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"101⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"102⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\3C82.tmp"C:\Users\Admin\AppData\Local\Temp\3C82.tmp"103⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"104⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"105⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"106⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"107⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"108⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"109⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"110⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"111⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"113⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"114⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\42BC.tmp"C:\Users\Admin\AppData\Local\Temp\42BC.tmp"115⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"116⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"117⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"119⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"120⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"121⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-