Analysis
- max time kernel
124s - max time network
102s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-16_538d218daacdab3d5b4105f7e1e7125e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_538d218daacdab3d5b4105f7e1e7125e_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-16_538d218daacdab3d5b4105f7e1e7125e_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260716-e4nrzsgv5y
- SHA256 271c743f349494672a96d02b1c95c6623f8d07b9d8434c9cfc0d9f828c54e378
- MD5 538d218daacdab3d5b4105f7e1e7125e
- SHA1 2555fb7c3a2d788119428a10c915d77d6f2babb9
- SHA512 afba224779ea5d92f6b00169416117f720dd42da54431347c79e2163b18026a0fc5ec8ee709896f4d65500dea246a5d0c02e78daf7a43737a1715e06daf1d1b9
- SSDEEP 12288:wU5rCOTeiDDiJ+mY3L/yTkpLwNo8vEENZ+3/v+I9hUG2VA:wUQOJDBmq6E0m8tNGEA
- TLSH T1A6E4D02173D88532E5FB037859B5E6654D7EBD326722D6CF6F8025AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2036 EAF3.tmp 1256 EB9E.tmp 1904 ECF6.tmp 3464 EDF0.tmp 4492 EECB.tmp 2924 F042.tmp 2168 F15B.tmp 1528 F236.tmp 2256 F320.tmp 2432 F3EB.tmp 4624 F4A7.tmp 1204 F572.tmp 1600 F63D.tmp 2640 F766.tmp 5920 F88F.tmp 4088 F96A.tmp 2808 FA83.tmp 4952 FBBB.tmp 1180 FCC5.tmp 4448 FDFE.tmp 6100 FEE8.tmp 4848 FFE2.tmp 4600 EC.tmp 2644 214.tmp 3068 30E.tmp 4376 437.tmp 2948 522.tmp 4036 65A.tmp 2636 773.tmp 3920 85E.tmp 4200 9B6.tmp 5160 ACF.tmp 6104 BD8.tmp 3800 C94.tmp 4308 D5F.tmp 2264 DEC.tmp 4536 E88.tmp 3928 F34.tmp 3508 102E.tmp 1772 10DA.tmp 4816 1176.tmp 5376 1203.tmp 2332 128F.tmp 1856 135A.tmp 1840 1416.tmp 1152 14B2.tmp 2780 155E.tmp 1056 1658.tmp 1488 1713.tmp 5952 17A0.tmp 940 182D.tmp 2236 18B9.tmp 4788 1965.tmp 4192 1A21.tmp 4368 1AAD.tmp 5668 1B59.tmp 3036 1BF5.tmp 2108 1C72.tmp 400 1CFF.tmp 1928 1D8C.tmp 4740 1E38.tmp 4356 1ED4.tmp 5984 1F51.tmp 5960 1FCE.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F58D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 654E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6638.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C187.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9084.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 853A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E86D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 777E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 690C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ABB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2036 2712 2026-07-16_538d218daacdab3d5b4105f7e1e7125e_elex_mafia_stealc_tofsee.exe 87 PID 2036 wrote to memory of 1256 2036 EAF3.tmp 88 PID 1256 wrote to memory of 1904 1256 EB9E.tmp 89 PID 1904 wrote to memory of 3464 1904 ECF6.tmp 90 PID 3464 wrote to memory of 4492 3464 EDF0.tmp 91 PID 4492 wrote to memory of 2924 4492 EECB.tmp 92 PID 2924 wrote to memory of 2168 2924 F042.tmp 93 PID 2168 wrote to memory of 1528 2168 F15B.tmp 94 PID 1528 wrote to memory of 2256 1528 F236.tmp 95 PID 2256 wrote to memory of 2432 2256 F320.tmp 96 PID 2432 wrote to memory of 4624 2432 F3EB.tmp 97 PID 4624 wrote to memory of 1204 4624 F4A7.tmp 98 PID 1204 wrote to memory of 1600 1204 F572.tmp 99 PID 1600 wrote to memory of 2640 1600 F63D.tmp 100 PID 2640 wrote to memory of 5920 2640 F766.tmp 101 PID 5920 wrote to memory of 4088 5920 F88F.tmp 102 PID 4088 wrote to memory of 2808 4088 F96A.tmp 103 PID 2808 wrote to memory of 4952 2808 FA83.tmp 104 PID 4952 wrote to memory of 1180 4952 FBBB.tmp 105 PID 1180 wrote to memory of 4448 1180 FCC5.tmp 106 PID 4448 wrote to memory of 6100 4448 FDFE.tmp 107 PID 6100 wrote to memory of 4848 6100 FEE8.tmp 108 PID 4848 wrote to memory of 4600 4848 FFE2.tmp 109 PID 4600 wrote to memory of 2644 4600 EC.tmp 110 PID 2644 wrote to memory of 3068 2644 214.tmp 111 PID 3068 wrote to memory of 4376 3068 30E.tmp 112 PID 4376 wrote to memory of 2948 4376 437.tmp 113 PID 2948 wrote to memory of 4036 2948 522.tmp 114 PID 4036 wrote to memory of 2636 4036 65A.tmp 115 PID 2636 wrote to memory of 3920 2636 773.tmp 116 PID 3920 wrote to memory of 4200 3920 85E.tmp 117 PID 4200 wrote to memory of 5160 4200 9B6.tmp 118 PID 5160 wrote to memory of 6104 5160 ACF.tmp 119 PID 6104 wrote to memory of 3800 6104 BD8.tmp 120 PID 3800 wrote to memory of 4308 3800 C94.tmp 121 PID 4308 wrote to memory of 2264 4308 D5F.tmp 122 PID 2264 wrote to memory of 4536 2264 DEC.tmp 123 PID 4536 wrote to memory of 3928 4536 E88.tmp 124 PID 3928 wrote to memory of 3508 3928 F34.tmp 125 PID 3508 wrote to memory of 1772 3508 102E.tmp 126 PID 1772 wrote to memory of 4816 1772 10DA.tmp 127 PID 4816 wrote to memory of 5376 4816 1176.tmp 128 PID 5376 wrote to memory of 2332 5376 1203.tmp 129 PID 2332 wrote to memory of 1856 2332 128F.tmp 130 PID 1856 wrote to memory of 1840 1856 135A.tmp 131 PID 1840 wrote to memory of 1152 1840 1416.tmp 132 PID 1152 wrote to memory of 2780 1152 14B2.tmp 133 PID 2780 wrote to memory of 1056 2780 155E.tmp 134 PID 1056 wrote to memory of 1488 1056 1658.tmp 135 PID 1488 wrote to memory of 5952 1488 1713.tmp 136 PID 5952 wrote to memory of 940 5952 17A0.tmp 137 PID 940 wrote to memory of 2236 940 182D.tmp 138 PID 2236 wrote to memory of 4788 2236 18B9.tmp 139 PID 4788 wrote to memory of 4192 4788 1965.tmp 140 PID 4192 wrote to memory of 4368 4192 1A21.tmp 141 PID 4368 wrote to memory of 5668 4368 1AAD.tmp 142 PID 5668 wrote to memory of 3036 5668 1B59.tmp 143 PID 3036 wrote to memory of 2108 3036 1BF5.tmp 144 PID 2108 wrote to memory of 400 2108 1C72.tmp 145 PID 400 wrote to memory of 1928 400 1CFF.tmp 146 PID 1928 wrote to memory of 4740 1928 1D8C.tmp 147 PID 4740 wrote to memory of 4356 4740 1E38.tmp 148 PID 4356 wrote to memory of 5984 4356 1ED4.tmp 149 PID 5984 wrote to memory of 5960 5984 1F51.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_538d218daacdab3d5b4105f7e1e7125e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_538d218daacdab3d5b4105f7e1e7125e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\EECB.tmp"C:\Users\Admin\AppData\Local\Temp\EECB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\F96A.tmp"C:\Users\Admin\AppData\Local\Temp\F96A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\214.tmp"C:\Users\Admin\AppData\Local\Temp\214.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\773.tmp"C:\Users\Admin\AppData\Local\Temp\773.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\9B6.tmp"C:\Users\Admin\AppData\Local\Temp\9B6.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\ACF.tmp"C:\Users\Admin\AppData\Local\Temp\ACF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\C94.tmp"C:\Users\Admin\AppData\Local\Temp\C94.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\D5F.tmp"C:\Users\Admin\AppData\Local\Temp\D5F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\DEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\E88.tmp"C:\Users\Admin\AppData\Local\Temp\E88.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\102E.tmp"C:\Users\Admin\AppData\Local\Temp\102E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\10DA.tmp"C:\Users\Admin\AppData\Local\Temp\10DA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1203.tmp"C:\Users\Admin\AppData\Local\Temp\1203.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\17A0.tmp"C:\Users\Admin\AppData\Local\Temp\17A0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\18B9.tmp"C:\Users\Admin\AppData\Local\Temp\18B9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1965.tmp"C:\Users\Admin\AppData\Local\Temp\1965.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1E38.tmp"C:\Users\Admin\AppData\Local\Temp\1E38.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"65⤵
- Executes dropped EXE
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"66⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"67⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\2174.tmp"C:\Users\Admin\AppData\Local\Temp\2174.tmp"68⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"69⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"70⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"71⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"73⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"74⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"75⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"76⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2675.tmp"C:\Users\Admin\AppData\Local\Temp\2675.tmp"77⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"78⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"79⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\2859.tmp"C:\Users\Admin\AppData\Local\Temp\2859.tmp"80⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\28D6.tmp"C:\Users\Admin\AppData\Local\Temp\28D6.tmp"81⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\2963.tmp"C:\Users\Admin\AppData\Local\Temp\2963.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"83⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"84⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"86⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2C03.tmp"C:\Users\Admin\AppData\Local\Temp\2C03.tmp"87⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"88⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\2D1C.tmp"C:\Users\Admin\AppData\Local\Temp\2D1C.tmp"89⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\2D99.tmp"C:\Users\Admin\AppData\Local\Temp\2D99.tmp"90⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"91⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"92⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"93⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\301A.tmp"C:\Users\Admin\AppData\Local\Temp\301A.tmp"94⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"95⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"96⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\31B0.tmp"C:\Users\Admin\AppData\Local\Temp\31B0.tmp"97⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\325C.tmp"C:\Users\Admin\AppData\Local\Temp\325C.tmp"98⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\32D9.tmp"C:\Users\Admin\AppData\Local\Temp\32D9.tmp"99⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\3356.tmp"C:\Users\Admin\AppData\Local\Temp\3356.tmp"100⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\3402.tmp"C:\Users\Admin\AppData\Local\Temp\3402.tmp"101⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\348E.tmp"C:\Users\Admin\AppData\Local\Temp\348E.tmp"102⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\350B.tmp"C:\Users\Admin\AppData\Local\Temp\350B.tmp"103⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"104⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\3615.tmp"C:\Users\Admin\AppData\Local\Temp\3615.tmp"105⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\36A2.tmp"C:\Users\Admin\AppData\Local\Temp\36A2.tmp"106⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\371F.tmp"C:\Users\Admin\AppData\Local\Temp\371F.tmp"107⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\379C.tmp"C:\Users\Admin\AppData\Local\Temp\379C.tmp"108⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\3828.tmp"C:\Users\Admin\AppData\Local\Temp\3828.tmp"109⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\38C4.tmp"C:\Users\Admin\AppData\Local\Temp\38C4.tmp"110⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\3941.tmp"C:\Users\Admin\AppData\Local\Temp\3941.tmp"111⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\39DE.tmp"C:\Users\Admin\AppData\Local\Temp\39DE.tmp"112⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"113⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\3B07.tmp"C:\Users\Admin\AppData\Local\Temp\3B07.tmp"114⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\3BA3.tmp"C:\Users\Admin\AppData\Local\Temp\3BA3.tmp"115⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"C:\Users\Admin\AppData\Local\Temp\3C2F.tmp"116⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"117⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\3D58.tmp"C:\Users\Admin\AppData\Local\Temp\3D58.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3DD5.tmp"C:\Users\Admin\AppData\Local\Temp\3DD5.tmp"119⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\3E62.tmp"C:\Users\Admin\AppData\Local\Temp\3E62.tmp"120⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\3EDF.tmp"C:\Users\Admin\AppData\Local\Temp\3EDF.tmp"121⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"122⤵PID:4128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-