Analysis
- max time kernel
122s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_e6c33a76a2f055b03934f06445dc79d5_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_e6c33a76a2f055b03934f06445dc79d5_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-21_e6c33a76a2f055b03934f06445dc79d5_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260721-qa5zystygw
- SHA256 31b8d52ed8952ded22f66758a8892f8d0e293d2b5ebe1223c2ab050c681033af
- MD5 e6c33a76a2f055b03934f06445dc79d5
- SHA1 95ca1fe324910403918a52d074e3e86ed501ffd3
- SHA512 91db6e5d51f1dcbeee759c5a5c678646c164abd56640a9d08677285824f35cfdb381d35b8a1b486dd684957f26032bf937ed74ff4f1fadbfb09f09908d7fc30a
- SSDEEP 12288:wU5rCOTeiD1OKs+8cK29oyuVBzI5jlaYRwiTy6mNZ+3/v+I9hUG2VA:wUQOJD1vs+8P29SB4laIyNGEA
- TLSH T17CE4D02177D88532E9F7037859B5F6604D7DBD36A722D6CF2B8016AE09B1BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4656 ABE6.tmp 1144 AD1E.tmp 2336 ADAB.tmp 5964 AF12.tmp 2968 B02C.tmp 4120 B1E1.tmp 4760 B25E.tmp 1872 B3B6.tmp 2536 B4C0.tmp 6096 B5BA.tmp 5868 B6B4.tmp 5112 B84A.tmp 6064 B944.tmp 4316 BA5D.tmp 4352 BB76.tmp 1048 BC61.tmp 628 BD7A.tmp 2920 BE93.tmp 2744 BF8D.tmp 1020 C0D5.tmp 5472 C20E.tmp 3296 C317.tmp 1296 C411.tmp 4584 C4FC.tmp 8 C634.tmp 2616 C71F.tmp 6000 C848.tmp 4820 C970.tmp 3120 CA99.tmp 4152 CBA3.tmp 6116 CCAD.tmp 2412 CDA7.tmp 5844 CEA1.tmp 420 CF3D.tmp 5052 CFE9.tmp 5960 D0B4.tmp 4404 D140.tmp 1700 D21B.tmp 3468 D306.tmp 5996 D3C1.tmp 1496 D44E.tmp 4392 D519.tmp 3408 D603.tmp 4952 D6AF.tmp 4964 D78A.tmp 968 D865.tmp 5360 D910.tmp 3536 D9DC.tmp 2368 DA87.tmp 4828 DB04.tmp 4284 DB91.tmp 4976 DC1E.tmp 396 DCBA.tmp 3940 DD47.tmp 240 DDB4.tmp 3932 DE50.tmp 5048 DECD.tmp 3872 DF5A.tmp 4104 DFD7.tmp 5908 E073.tmp 2312 E0E0.tmp 5840 E14E.tmp 4940 E1CB.tmp 3360 E248.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6221.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 530E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 155E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 121D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 784E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F36A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2641.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E68E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 804D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F89F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 340D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D78A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 437E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 4656 3804 2026-07-21_e6c33a76a2f055b03934f06445dc79d5_elex_mafia_stealc_tofsee.exe 89 PID 4656 wrote to memory of 1144 4656 ABE6.tmp 90 PID 1144 wrote to memory of 2336 1144 AD1E.tmp 91 PID 2336 wrote to memory of 5964 2336 ADAB.tmp 92 PID 5964 wrote to memory of 2968 5964 AF12.tmp 93 PID 2968 wrote to memory of 4120 2968 B02C.tmp 94 PID 4120 wrote to memory of 4760 4120 B1E1.tmp 95 PID 4760 wrote to memory of 1872 4760 B25E.tmp 96 PID 1872 wrote to memory of 2536 1872 B3B6.tmp 97 PID 2536 wrote to memory of 6096 2536 B4C0.tmp 98 PID 6096 wrote to memory of 5868 6096 B5BA.tmp 99 PID 5868 wrote to memory of 5112 5868 B6B4.tmp 100 PID 5112 wrote to memory of 6064 5112 B84A.tmp 101 PID 6064 wrote to memory of 4316 6064 B944.tmp 102 PID 4316 wrote to memory of 4352 4316 BA5D.tmp 103 PID 4352 wrote to memory of 1048 4352 BB76.tmp 104 PID 1048 wrote to memory of 628 1048 BC61.tmp 105 PID 628 wrote to memory of 2920 628 BD7A.tmp 106 PID 2920 wrote to memory of 2744 2920 BE93.tmp 107 PID 2744 wrote to memory of 1020 2744 BF8D.tmp 108 PID 1020 wrote to memory of 5472 1020 C0D5.tmp 109 PID 5472 wrote to memory of 3296 5472 C20E.tmp 110 PID 3296 wrote to memory of 1296 3296 C317.tmp 111 PID 1296 wrote to memory of 4584 1296 C411.tmp 112 PID 4584 wrote to memory of 8 4584 C4FC.tmp 113 PID 8 wrote to memory of 2616 8 C634.tmp 114 PID 2616 wrote to memory of 6000 2616 C71F.tmp 115 PID 6000 wrote to memory of 4820 6000 C848.tmp 116 PID 4820 wrote to memory of 3120 4820 C970.tmp 117 PID 3120 wrote to memory of 4152 3120 CA99.tmp 118 PID 4152 wrote to memory of 6116 4152 CBA3.tmp 119 PID 6116 wrote to memory of 2412 6116 CCAD.tmp 120 PID 2412 wrote to memory of 5844 2412 CDA7.tmp 121 PID 5844 wrote to memory of 420 5844 CEA1.tmp 122 PID 420 wrote to memory of 5052 420 CF3D.tmp 123 PID 5052 wrote to memory of 5960 5052 CFE9.tmp 124 PID 5960 wrote to memory of 4404 5960 D0B4.tmp 125 PID 4404 wrote to memory of 1700 4404 D140.tmp 126 PID 1700 wrote to memory of 3468 1700 D21B.tmp 127 PID 3468 wrote to memory of 5996 3468 D306.tmp 128 PID 5996 wrote to memory of 1496 5996 D3C1.tmp 129 PID 1496 wrote to memory of 4392 1496 D44E.tmp 130 PID 4392 wrote to memory of 3408 4392 D519.tmp 131 PID 3408 wrote to memory of 4952 3408 D603.tmp 132 PID 4952 wrote to memory of 4964 4952 D6AF.tmp 133 PID 4964 wrote to memory of 968 4964 D78A.tmp 134 PID 968 wrote to memory of 5360 968 D865.tmp 135 PID 5360 wrote to memory of 3536 5360 D910.tmp 136 PID 3536 wrote to memory of 2368 3536 D9DC.tmp 137 PID 2368 wrote to memory of 4828 2368 DA87.tmp 138 PID 4828 wrote to memory of 4284 4828 DB04.tmp 139 PID 4284 wrote to memory of 4976 4284 DB91.tmp 140 PID 4976 wrote to memory of 396 4976 DC1E.tmp 141 PID 396 wrote to memory of 3940 396 DCBA.tmp 142 PID 3940 wrote to memory of 240 3940 DD47.tmp 143 PID 240 wrote to memory of 3932 240 DDB4.tmp 144 PID 3932 wrote to memory of 5048 3932 DE50.tmp 145 PID 5048 wrote to memory of 3872 5048 DECD.tmp 146 PID 3872 wrote to memory of 4104 3872 DF5A.tmp 147 PID 4104 wrote to memory of 5908 4104 DFD7.tmp 148 PID 5908 wrote to memory of 2312 5908 E073.tmp 149 PID 2312 wrote to memory of 5840 2312 E0E0.tmp 150 PID 5840 wrote to memory of 4940 5840 E14E.tmp 151 PID 4940 wrote to memory of 3360 4940 E1CB.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_e6c33a76a2f055b03934f06445dc79d5_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_e6c33a76a2f055b03934f06445dc79d5_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\AD1E.tmp"C:\Users\Admin\AppData\Local\Temp\AD1E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\C411.tmp"C:\Users\Admin\AppData\Local\Temp\C411.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\C634.tmp"C:\Users\Admin\AppData\Local\Temp\C634.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\C71F.tmp"C:\Users\Admin\AppData\Local\Temp\C71F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\C848.tmp"C:\Users\Admin\AppData\Local\Temp\C848.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\C970.tmp"C:\Users\Admin\AppData\Local\Temp\C970.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\CA99.tmp"C:\Users\Admin\AppData\Local\Temp\CA99.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"C:\Users\Admin\AppData\Local\Temp\CCAD.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\CFE9.tmp"C:\Users\Admin\AppData\Local\Temp\CFE9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\D519.tmp"C:\Users\Admin\AppData\Local\Temp\D519.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\D603.tmp"C:\Users\Admin\AppData\Local\Temp\D603.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\DB04.tmp"C:\Users\Admin\AppData\Local\Temp\DB04.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\DB91.tmp"C:\Users\Admin\AppData\Local\Temp\DB91.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\DE50.tmp"C:\Users\Admin\AppData\Local\Temp\DE50.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\E073.tmp"C:\Users\Admin\AppData\Local\Temp\E073.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"65⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"66⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\E361.tmp"C:\Users\Admin\AppData\Local\Temp\E361.tmp"67⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"68⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"69⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"70⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\E574.tmp"C:\Users\Admin\AppData\Local\Temp\E574.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"72⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"74⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"75⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\E824.tmp"C:\Users\Admin\AppData\Local\Temp\E824.tmp"76⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"77⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"78⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"79⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"80⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"81⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\EB41.tmp"C:\Users\Admin\AppData\Local\Temp\EB41.tmp"82⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"83⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"84⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"85⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"86⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"87⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"88⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"89⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"90⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\F071.tmp"C:\Users\Admin\AppData\Local\Temp\F071.tmp"91⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\F10D.tmp"C:\Users\Admin\AppData\Local\Temp\F10D.tmp"92⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\F18A.tmp"C:\Users\Admin\AppData\Local\Temp\F18A.tmp"93⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"94⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"95⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"96⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"97⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\F41A.tmp"C:\Users\Admin\AppData\Local\Temp\F41A.tmp"98⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"99⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"100⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"101⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\F68B.tmp"C:\Users\Admin\AppData\Local\Temp\F68B.tmp"102⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"104⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"105⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\F89F.tmp"C:\Users\Admin\AppData\Local\Temp\F89F.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"107⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"109⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"110⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"111⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"112⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\FC87.tmp"C:\Users\Admin\AppData\Local\Temp\FC87.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"114⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"115⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"116⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"117⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"118⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"119⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"120⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\BD.tmp"C:\Users\Admin\AppData\Local\Temp\BD.tmp"121⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"122⤵PID:5388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-