Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_b16b4a4ce5fd6c7a4ad286ab08d05488_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_b16b4a4ce5fd6c7a4ad286ab08d05488_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-02_b16b4a4ce5fd6c7a4ad286ab08d05488_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260702-2hxt4afy7t
- SHA256 11768a2d73b18ee4e8ec36352dbe6ac8e66f02ed3744861ebebfac01264c3214
- MD5 b16b4a4ce5fd6c7a4ad286ab08d05488
- SHA1 0cad93cd1c6d8f3c245fe271f8a7febf0aecd2be
- SHA512 29093f0a9dc1364beb73bf6f83f1a3424fc6a0904dbc22a3cac374e46f22cbfc3846cf1a01b5706e266c3526b25da7f8574f1abf7d8bacd1c1b696a9b28d8508
- SSDEEP 12288:wU5rCOTeiDBFHDvk3RK49JAiNZ+3/v+I9hUG2VA:wUQOJDBFHLkI49JRNGEA
- TLSH T1A5E4D02177D88532E5FB037859B5E7554E7EBD229722D6CF2F8011AE0AB1BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5908 75F6.tmp 6000 76F0.tmp 6860 77BB.tmp 5916 78B5.tmp 6664 7952.tmp 4968 7A4C.tmp 6724 7B07.tmp 1340 7BB3.tmp 5524 7C5F.tmp 552 7D0B.tmp 4232 7DC6.tmp 7164 7E72.tmp 1520 7F0E.tmp 5844 7FAB.tmp 3988 8076.tmp 2072 80F3.tmp 5292 818F.tmp 3992 821C.tmp 1512 82C7.tmp 2396 8335.tmp 2352 83B2.tmp 3972 841F.tmp 4828 848D.tmp 7096 8596.tmp 6876 8632.tmp 6440 86A0.tmp 5900 86FE.tmp 6748 87C9.tmp 6444 8884.tmp 5036 8911.tmp 4140 898E.tmp 6644 8A1A.tmp 4360 8AA7.tmp 1408 8B14.tmp 4224 8B82.tmp 6648 8BEF.tmp 2544 8C6C.tmp 1360 8CDA.tmp 6732 8D47.tmp 4936 8DC4.tmp 5840 8E31.tmp 6856 8E9F.tmp 2856 8EFC.tmp 5164 8F79.tmp 5644 8FD7.tmp 5720 9045.tmp 1288 90A2.tmp 1156 9100.tmp 796 916D.tmp 1164 91DB.tmp 2508 9239.tmp 3928 9296.tmp 4668 92F4.tmp 4468 9352.tmp 1004 93BF.tmp 5368 941D.tmp 1756 947B.tmp 6820 94E8.tmp 5008 9546.tmp 3308 95C3.tmp 6844 9630.tmp 708 969E.tmp 2920 970B.tmp 1872 9769.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 768E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A04D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A32C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7952.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A791.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4666.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5800 wrote to memory of 5908 5800 2026-07-02_b16b4a4ce5fd6c7a4ad286ab08d05488_elex_mafia_stealc_tofsee.exe 90 PID 5908 wrote to memory of 6000 5908 75F6.tmp 91 PID 6000 wrote to memory of 6860 6000 76F0.tmp 92 PID 6860 wrote to memory of 5916 6860 77BB.tmp 93 PID 5916 wrote to memory of 6664 5916 78B5.tmp 94 PID 6664 wrote to memory of 4968 6664 7952.tmp 95 PID 4968 wrote to memory of 6724 4968 7A4C.tmp 96 PID 6724 wrote to memory of 1340 6724 7B07.tmp 97 PID 1340 wrote to memory of 5524 1340 7BB3.tmp 98 PID 5524 wrote to memory of 552 5524 7C5F.tmp 99 PID 552 wrote to memory of 4232 552 7D0B.tmp 100 PID 4232 wrote to memory of 7164 4232 7DC6.tmp 101 PID 7164 wrote to memory of 1520 7164 7E72.tmp 102 PID 1520 wrote to memory of 5844 1520 7F0E.tmp 103 PID 5844 wrote to memory of 3988 5844 7FAB.tmp 104 PID 3988 wrote to memory of 2072 3988 8076.tmp 105 PID 2072 wrote to memory of 5292 2072 80F3.tmp 106 PID 5292 wrote to memory of 3992 5292 818F.tmp 107 PID 3992 wrote to memory of 1512 3992 821C.tmp 108 PID 1512 wrote to memory of 2396 1512 82C7.tmp 109 PID 2396 wrote to memory of 2352 2396 8335.tmp 110 PID 2352 wrote to memory of 3972 2352 83B2.tmp 111 PID 3972 wrote to memory of 4828 3972 841F.tmp 112 PID 4828 wrote to memory of 7096 4828 848D.tmp 113 PID 7096 wrote to memory of 6876 7096 8596.tmp 114 PID 6876 wrote to memory of 6440 6876 8632.tmp 115 PID 6440 wrote to memory of 5900 6440 86A0.tmp 116 PID 5900 wrote to memory of 6748 5900 86FE.tmp 117 PID 6748 wrote to memory of 6444 6748 87C9.tmp 118 PID 6444 wrote to memory of 5036 6444 8884.tmp 119 PID 5036 wrote to memory of 4140 5036 8911.tmp 120 PID 4140 wrote to memory of 6644 4140 898E.tmp 121 PID 6644 wrote to memory of 4360 6644 8A1A.tmp 122 PID 4360 wrote to memory of 1408 4360 8AA7.tmp 123 PID 1408 wrote to memory of 4224 1408 8B14.tmp 124 PID 4224 wrote to memory of 6648 4224 8B82.tmp 125 PID 6648 wrote to memory of 2544 6648 8BEF.tmp 126 PID 2544 wrote to memory of 1360 2544 8C6C.tmp 127 PID 1360 wrote to memory of 6732 1360 8CDA.tmp 128 PID 6732 wrote to memory of 4936 6732 8D47.tmp 129 PID 4936 wrote to memory of 5840 4936 8DC4.tmp 130 PID 5840 wrote to memory of 6856 5840 8E31.tmp 131 PID 6856 wrote to memory of 2856 6856 8E9F.tmp 132 PID 2856 wrote to memory of 5164 2856 8EFC.tmp 133 PID 5164 wrote to memory of 5644 5164 8F79.tmp 134 PID 5644 wrote to memory of 5720 5644 8FD7.tmp 135 PID 5720 wrote to memory of 1288 5720 9045.tmp 136 PID 1288 wrote to memory of 1156 1288 90A2.tmp 137 PID 1156 wrote to memory of 796 1156 9100.tmp 138 PID 796 wrote to memory of 1164 796 916D.tmp 139 PID 1164 wrote to memory of 2508 1164 91DB.tmp 140 PID 2508 wrote to memory of 3928 2508 9239.tmp 141 PID 3928 wrote to memory of 4668 3928 9296.tmp 142 PID 4668 wrote to memory of 4468 4668 92F4.tmp 143 PID 4468 wrote to memory of 1004 4468 9352.tmp 144 PID 1004 wrote to memory of 5368 1004 93BF.tmp 145 PID 5368 wrote to memory of 1756 5368 941D.tmp 146 PID 1756 wrote to memory of 6820 1756 947B.tmp 147 PID 6820 wrote to memory of 5008 6820 94E8.tmp 148 PID 5008 wrote to memory of 3308 5008 9546.tmp 149 PID 3308 wrote to memory of 6844 3308 95C3.tmp 150 PID 6844 wrote to memory of 708 6844 9630.tmp 151 PID 708 wrote to memory of 2920 708 969E.tmp 152 PID 2920 wrote to memory of 1872 2920 970B.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_b16b4a4ce5fd6c7a4ad286ab08d05488_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_b16b4a4ce5fd6c7a4ad286ab08d05488_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6860 -
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6664 -
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6724 -
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\7E72.tmp"C:\Users\Admin\AppData\Local\Temp\7E72.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7164 -
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\83B2.tmp"C:\Users\Admin\AppData\Local\Temp\83B2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\841F.tmp"C:\Users\Admin\AppData\Local\Temp\841F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\848D.tmp"C:\Users\Admin\AppData\Local\Temp\848D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7096 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6876 -
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6440 -
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6748 -
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6444 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\898E.tmp"C:\Users\Admin\AppData\Local\Temp\898E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6644 -
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8B14.tmp"C:\Users\Admin\AppData\Local\Temp\8B14.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6648 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8D47.tmp"C:\Users\Admin\AppData\Local\Temp\8D47.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6732 -
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6856 -
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\9045.tmp"C:\Users\Admin\AppData\Local\Temp\9045.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\91DB.tmp"C:\Users\Admin\AppData\Local\Temp\91DB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\92F4.tmp"C:\Users\Admin\AppData\Local\Temp\92F4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\93BF.tmp"C:\Users\Admin\AppData\Local\Temp\93BF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\941D.tmp"C:\Users\Admin\AppData\Local\Temp\941D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6820 -
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\9630.tmp"C:\Users\Admin\AppData\Local\Temp\9630.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6844 -
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\9769.tmp"C:\Users\Admin\AppData\Local\Temp\9769.tmp"65⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"66⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\9824.tmp"C:\Users\Admin\AppData\Local\Temp\9824.tmp"67⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\9882.tmp"C:\Users\Admin\AppData\Local\Temp\9882.tmp"68⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\98E0.tmp"C:\Users\Admin\AppData\Local\Temp\98E0.tmp"69⤵PID:6612
-
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"70⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\999B.tmp"C:\Users\Admin\AppData\Local\Temp\999B.tmp"71⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\99F9.tmp"C:\Users\Admin\AppData\Local\Temp\99F9.tmp"72⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\9A47.tmp"C:\Users\Admin\AppData\Local\Temp\9A47.tmp"73⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"74⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"75⤵PID:6984
-
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"76⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"77⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"78⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"79⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"80⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\9D45.tmp"C:\Users\Admin\AppData\Local\Temp\9D45.tmp"81⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"82⤵PID:6316
-
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:6720 -
C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"84⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"85⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\9F19.tmp"C:\Users\Admin\AppData\Local\Temp\9F19.tmp"86⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"87⤵PID:6980
-
C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"88⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\A042.tmp"C:\Users\Admin\AppData\Local\Temp\A042.tmp"89⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"90⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"91⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"92⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"93⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\A217.tmp"C:\Users\Admin\AppData\Local\Temp\A217.tmp"94⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"95⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"96⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"97⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"98⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"99⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\A44A.tmp"C:\Users\Admin\AppData\Local\Temp\A44A.tmp"100⤵PID:6616
-
C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"101⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"102⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"103⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"104⤵PID:6168
-
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"105⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"106⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"107⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"108⤵PID:6512
-
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"109⤵PID:7108
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"110⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\A851.tmp"C:\Users\Admin\AppData\Local\Temp\A851.tmp"111⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"112⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"113⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"114⤵PID:6684
-
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"115⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\AA26.tmp"C:\Users\Admin\AppData\Local\Temp\AA26.tmp"116⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"117⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"118⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"119⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"120⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"121⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"122⤵PID:1924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-