Analysis
- max time kernel
122s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_b29ffbaba82b11802f0b88ae8627530a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_b29ffbaba82b11802f0b88ae8627530a_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-15_b29ffbaba82b11802f0b88ae8627530a_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260415-scelwsaw7n
- SHA256 9389e48d59b3915f13d2d738b546b93ea7ffbe1f0710f2104af7abd504f09a23
- MD5 b29ffbaba82b11802f0b88ae8627530a
- SHA1 5a99c73c6fd4acd2a7ff3abb04a00572540f3f70
- SHA512 1bd1f35e372d77fb0a883a10b3fe0645dcb850655c551e8b18d2a48f2ccb8477d9fc16a9a341f175b2470009a561887a7c2f437c37e4d2e7bed74e22186228f7
- SSDEEP 12288:9U5rCOTei6sGH9hX4hQKuIwLvpDqZoXWjdq:9UQOJ6sGH9hXUwLxDqqGh
- TLSH T1F9C4F1217984C032F6A301314AE6EBB1697A7C355B66A4C73B84B76E6FB02D1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3312 683.tmp 5508 71F.tmp 2796 7FA.tmp 1140 8A6.tmp 5108 904.tmp 2876 981.tmp 3428 A0D.tmp 2648 AA9.tmp 5396 B26.tmp 3932 BA3.tmp 6080 BF2.tmp 1032 C8E.tmp 644 CFB.tmp 4244 D59.tmp 4552 DB7.tmp 4268 E34.tmp 3840 E91.tmp 3832 F0E.tmp 1460 F9B.tmp 5720 FE9.tmp 2156 1076.tmp 3052 1112.tmp 4116 11AE.tmp 1760 121C.tmp 2988 12B8.tmp 2240 1325.tmp 3532 1373.tmp 5316 1400.tmp 6112 147D.tmp 3376 14DB.tmp 2124 1529.tmp 2164 1577.tmp 6060 15C5.tmp 2224 1613.tmp 5452 1661.tmp 4248 16B0.tmp 3704 16FE.tmp 1812 176B.tmp 5996 17D8.tmp 5840 1865.tmp 3196 18E2.tmp 4964 1930.tmp 5392 199E.tmp 612 19FB.tmp 1516 1A59.tmp 1912 1AC6.tmp 1188 1B15.tmp 5552 1B63.tmp 1652 1BC0.tmp 5372 1C0F.tmp 804 1C8C.tmp 1004 1CF9.tmp 2172 1D66.tmp 4436 1DD4.tmp 2072 1E22.tmp 5184 1E8F.tmp 2188 1EED.tmp 2204 1F4B.tmp 1704 1F99.tmp 1280 2006.tmp 4048 2064.tmp 488 20B2.tmp 3012 2100.tmp 2280 215E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 790E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 247B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 491A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 388F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3312 4128 2026-04-15_b29ffbaba82b11802f0b88ae8627530a_elex_mafia_stealc_tofsee.exe 78 PID 3312 wrote to memory of 5508 3312 683.tmp 79 PID 5508 wrote to memory of 2796 5508 71F.tmp 80 PID 2796 wrote to memory of 1140 2796 7FA.tmp 81 PID 1140 wrote to memory of 5108 1140 8A6.tmp 82 PID 5108 wrote to memory of 2876 5108 904.tmp 83 PID 2876 wrote to memory of 3428 2876 981.tmp 84 PID 3428 wrote to memory of 2648 3428 A0D.tmp 85 PID 2648 wrote to memory of 5396 2648 AA9.tmp 86 PID 5396 wrote to memory of 3932 5396 B26.tmp 87 PID 3932 wrote to memory of 6080 3932 BA3.tmp 88 PID 6080 wrote to memory of 1032 6080 BF2.tmp 89 PID 1032 wrote to memory of 644 1032 C8E.tmp 90 PID 644 wrote to memory of 4244 644 CFB.tmp 91 PID 4244 wrote to memory of 4552 4244 D59.tmp 92 PID 4552 wrote to memory of 4268 4552 DB7.tmp 93 PID 4268 wrote to memory of 3840 4268 E34.tmp 94 PID 3840 wrote to memory of 3832 3840 E91.tmp 95 PID 3832 wrote to memory of 1460 3832 F0E.tmp 96 PID 1460 wrote to memory of 5720 1460 F9B.tmp 97 PID 5720 wrote to memory of 2156 5720 FE9.tmp 98 PID 2156 wrote to memory of 3052 2156 1076.tmp 99 PID 3052 wrote to memory of 4116 3052 1112.tmp 100 PID 4116 wrote to memory of 1760 4116 11AE.tmp 101 PID 1760 wrote to memory of 2988 1760 121C.tmp 102 PID 2988 wrote to memory of 2240 2988 12B8.tmp 103 PID 2240 wrote to memory of 3532 2240 1325.tmp 104 PID 3532 wrote to memory of 5316 3532 1373.tmp 105 PID 5316 wrote to memory of 6112 5316 1400.tmp 106 PID 6112 wrote to memory of 3376 6112 147D.tmp 107 PID 3376 wrote to memory of 2124 3376 14DB.tmp 108 PID 2124 wrote to memory of 2164 2124 1529.tmp 109 PID 2164 wrote to memory of 6060 2164 1577.tmp 110 PID 6060 wrote to memory of 2224 6060 15C5.tmp 111 PID 2224 wrote to memory of 5452 2224 1613.tmp 112 PID 5452 wrote to memory of 4248 5452 1661.tmp 113 PID 4248 wrote to memory of 3704 4248 16B0.tmp 114 PID 3704 wrote to memory of 1812 3704 16FE.tmp 115 PID 1812 wrote to memory of 5996 1812 176B.tmp 116 PID 5996 wrote to memory of 5840 5996 17D8.tmp 117 PID 5840 wrote to memory of 3196 5840 1865.tmp 118 PID 3196 wrote to memory of 4964 3196 18E2.tmp 119 PID 4964 wrote to memory of 5392 4964 1930.tmp 120 PID 5392 wrote to memory of 612 5392 199E.tmp 121 PID 612 wrote to memory of 1516 612 19FB.tmp 122 PID 1516 wrote to memory of 1912 1516 1A59.tmp 123 PID 1912 wrote to memory of 1188 1912 1AC6.tmp 124 PID 1188 wrote to memory of 5552 1188 1B15.tmp 125 PID 5552 wrote to memory of 1652 5552 1B63.tmp 126 PID 1652 wrote to memory of 5372 1652 1BC0.tmp 127 PID 5372 wrote to memory of 804 5372 1C0F.tmp 128 PID 804 wrote to memory of 1004 804 1C8C.tmp 129 PID 1004 wrote to memory of 2172 1004 1CF9.tmp 130 PID 2172 wrote to memory of 4436 2172 1D66.tmp 131 PID 4436 wrote to memory of 2072 4436 1DD4.tmp 132 PID 2072 wrote to memory of 5184 2072 1E22.tmp 133 PID 5184 wrote to memory of 2188 5184 1E8F.tmp 134 PID 2188 wrote to memory of 2204 2188 1EED.tmp 135 PID 2204 wrote to memory of 1704 2204 1F4B.tmp 136 PID 1704 wrote to memory of 1280 1704 1F99.tmp 137 PID 1280 wrote to memory of 4048 1280 2006.tmp 138 PID 4048 wrote to memory of 488 4048 2064.tmp 139 PID 488 wrote to memory of 3012 488 20B2.tmp 140 PID 3012 wrote to memory of 2280 3012 2100.tmp 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_b29ffbaba82b11802f0b88ae8627530a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_b29ffbaba82b11802f0b88ae8627530a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"65⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"67⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"68⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"69⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"70⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"71⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"72⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"75⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"76⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"77⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"78⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"79⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"80⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"81⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"82⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"83⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"84⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"85⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"86⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"87⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"88⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"89⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"90⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"91⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"92⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"93⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"94⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"95⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"96⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"97⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"98⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"99⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"100⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"101⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"102⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"103⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"104⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"105⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"106⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"107⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"108⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"109⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"110⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"112⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"113⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"114⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"115⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"116⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"117⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"118⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"119⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"120⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"121⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"122⤵PID:4912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-