Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_d7d914dfb56f82263faf18563a55f97b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_d7d914dfb56f82263faf18563a55f97b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_d7d914dfb56f82263faf18563a55f97b_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-c1mpeaca46
- SHA256 b01964e1ffde93bb058a59d3335bc6e36aefcf05eab8b41ac58c7bbfcc976a0d
- MD5 d7d914dfb56f82263faf18563a55f97b
- SHA1 6db32cbd65ae67a0c312d10dce598904dac6a57d
- SHA512 ba0c718463bbea6682d7ab1bf4d3c4fa6379f63f06a7856cdb9711817389ba19dc632e305273c05b39df6c893f00dc8b74961d1b5a68e63bc860dba719db94b6
- SSDEEP 12288:wU5rCOTeiDFm6fozmhYg34cInE90/lP58PENZ+3/v+I9hUG2VA:wUQOJDRobnQ0p57NGEA
- TLSH T189E4D12173D8C532EAFB077855B5F661497EBD22A722D6CF2F8012AE0971BC09671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1800 D046.tmp 3452 D160.tmp 2408 D289.tmp 4532 D40F.tmp 360 D4CB.tmp 2968 D548.tmp 1484 D690.tmp 4632 D73C.tmp 3132 D7E8.tmp 5704 D910.tmp 744 DA1A.tmp 2724 DB43.tmp 2628 DC4D.tmp 5144 DD56.tmp 2328 DE60.tmp 2672 DF3B.tmp 1324 DFF6.tmp 3888 E0F0.tmp 1544 E219.tmp 3324 E323.tmp 5016 E3FD.tmp 3872 E517.tmp 1564 E574.tmp 4556 E71A.tmp 4476 E833.tmp 4444 E94D.tmp 1272 EA76.tmp 5516 EB7F.tmp 5620 EC89.tmp 5788 ED83.tmp 2568 EEAC.tmp 2088 EF58.tmp 5292 F0A0.tmp 1696 F19A.tmp 1568 F226.tmp 3180 F2E2.tmp 4980 F39D.tmp 1960 F468.tmp 5612 F543.tmp 3724 F61E.tmp 5044 F708.tmp 1140 F812.tmp 4836 F8BE.tmp 2264 F999.tmp 4136 FA44.tmp 2680 FB1F.tmp 3968 FBEA.tmp 4048 FCE4.tmp 2892 FD61.tmp 2344 FDDE.tmp 5216 FE6B.tmp 4608 FEE8.tmp 5332 FF65.tmp 3748 FFE2.tmp 672 5F.tmp 4324 EC.tmp 2200 178.tmp 2784 205.tmp 5212 291.tmp 2308 2FF.tmp 2856 37C.tmp 2476 408.tmp 5520 485.tmp 1424 522.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D41A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A370.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 801E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 800A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 436E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A53A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D65C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1800 2924 2026-08-02_d7d914dfb56f82263faf18563a55f97b_elex_mafia_stealc_tofsee.exe 88 PID 1800 wrote to memory of 3452 1800 D046.tmp 89 PID 3452 wrote to memory of 2408 3452 D160.tmp 90 PID 2408 wrote to memory of 4532 2408 D289.tmp 91 PID 4532 wrote to memory of 360 4532 D40F.tmp 92 PID 360 wrote to memory of 2968 360 D4CB.tmp 93 PID 2968 wrote to memory of 1484 2968 D548.tmp 94 PID 1484 wrote to memory of 4632 1484 D690.tmp 95 PID 4632 wrote to memory of 3132 4632 D73C.tmp 96 PID 3132 wrote to memory of 5704 3132 D7E8.tmp 97 PID 5704 wrote to memory of 744 5704 D910.tmp 98 PID 744 wrote to memory of 2724 744 DA1A.tmp 99 PID 2724 wrote to memory of 2628 2724 DB43.tmp 100 PID 2628 wrote to memory of 5144 2628 DC4D.tmp 101 PID 5144 wrote to memory of 2328 5144 DD56.tmp 102 PID 2328 wrote to memory of 2672 2328 DE60.tmp 103 PID 2672 wrote to memory of 1324 2672 DF3B.tmp 104 PID 1324 wrote to memory of 3888 1324 DFF6.tmp 105 PID 3888 wrote to memory of 1544 3888 E0F0.tmp 106 PID 1544 wrote to memory of 3324 1544 E219.tmp 107 PID 3324 wrote to memory of 5016 3324 E323.tmp 108 PID 5016 wrote to memory of 3872 5016 E3FD.tmp 109 PID 3872 wrote to memory of 1564 3872 E517.tmp 110 PID 1564 wrote to memory of 4556 1564 E574.tmp 111 PID 4556 wrote to memory of 4476 4556 E71A.tmp 112 PID 4476 wrote to memory of 4444 4476 E833.tmp 113 PID 4444 wrote to memory of 1272 4444 E94D.tmp 114 PID 1272 wrote to memory of 5516 1272 EA76.tmp 115 PID 5516 wrote to memory of 5620 5516 EB7F.tmp 116 PID 5620 wrote to memory of 5788 5620 EC89.tmp 117 PID 5788 wrote to memory of 2568 5788 ED83.tmp 118 PID 2568 wrote to memory of 2088 2568 EEAC.tmp 119 PID 2088 wrote to memory of 5292 2088 EF58.tmp 120 PID 5292 wrote to memory of 1696 5292 F0A0.tmp 121 PID 1696 wrote to memory of 1568 1696 F19A.tmp 122 PID 1568 wrote to memory of 3180 1568 F226.tmp 123 PID 3180 wrote to memory of 4980 3180 F2E2.tmp 124 PID 4980 wrote to memory of 1960 4980 F39D.tmp 125 PID 1960 wrote to memory of 5612 1960 F468.tmp 126 PID 5612 wrote to memory of 3724 5612 F543.tmp 127 PID 3724 wrote to memory of 5044 3724 F61E.tmp 128 PID 5044 wrote to memory of 1140 5044 F708.tmp 129 PID 1140 wrote to memory of 4836 1140 F812.tmp 130 PID 4836 wrote to memory of 2264 4836 F8BE.tmp 131 PID 2264 wrote to memory of 4136 2264 F999.tmp 132 PID 4136 wrote to memory of 2680 4136 FA44.tmp 133 PID 2680 wrote to memory of 3968 2680 FB1F.tmp 134 PID 3968 wrote to memory of 4048 3968 FBEA.tmp 135 PID 4048 wrote to memory of 2892 4048 FCE4.tmp 136 PID 2892 wrote to memory of 2344 2892 FD61.tmp 137 PID 2344 wrote to memory of 5216 2344 FDDE.tmp 138 PID 5216 wrote to memory of 4608 5216 FE6B.tmp 139 PID 4608 wrote to memory of 5332 4608 FEE8.tmp 140 PID 5332 wrote to memory of 3748 5332 FF65.tmp 141 PID 3748 wrote to memory of 672 3748 FFE2.tmp 142 PID 672 wrote to memory of 4324 672 5F.tmp 143 PID 4324 wrote to memory of 2200 4324 EC.tmp 144 PID 2200 wrote to memory of 2784 2200 178.tmp 145 PID 2784 wrote to memory of 5212 2784 205.tmp 146 PID 5212 wrote to memory of 2308 5212 291.tmp 147 PID 2308 wrote to memory of 2856 2308 2FF.tmp 148 PID 2856 wrote to memory of 2476 2856 37C.tmp 149 PID 2476 wrote to memory of 5520 2476 408.tmp 150 PID 5520 wrote to memory of 1424 5520 485.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d7d914dfb56f82263faf18563a55f97b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d7d914dfb56f82263faf18563a55f97b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D160.tmp"C:\Users\Admin\AppData\Local\Temp\D160.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\D40F.tmp"C:\Users\Admin\AppData\Local\Temp\D40F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\DD56.tmp"C:\Users\Admin\AppData\Local\Temp\DD56.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\DE60.tmp"C:\Users\Admin\AppData\Local\Temp\DE60.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"C:\Users\Admin\AppData\Local\Temp\E0F0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\E517.tmp"C:\Users\Admin\AppData\Local\Temp\E517.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\E574.tmp"C:\Users\Admin\AppData\Local\Temp\E574.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\F226.tmp"C:\Users\Admin\AppData\Local\Temp\F226.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\F468.tmp"C:\Users\Admin\AppData\Local\Temp\F468.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\F61E.tmp"C:\Users\Admin\AppData\Local\Temp\F61E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\F812.tmp"C:\Users\Admin\AppData\Local\Temp\F812.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\205.tmp"C:\Users\Admin\AppData\Local\Temp\205.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\37C.tmp"C:\Users\Admin\AppData\Local\Temp\37C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"65⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"66⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"67⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"68⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\735.tmp"C:\Users\Admin\AppData\Local\Temp\735.tmp"69⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\7B2.tmp"C:\Users\Admin\AppData\Local\Temp\7B2.tmp"70⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"71⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\8BC.tmp"C:\Users\Admin\AppData\Local\Temp\8BC.tmp"72⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\9B6.tmp"C:\Users\Admin\AppData\Local\Temp\9B6.tmp"74⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"75⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\AFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFE.tmp"76⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\B7B.tmp"C:\Users\Admin\AppData\Local\Temp\B7B.tmp"77⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"78⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\C94.tmp"C:\Users\Admin\AppData\Local\Temp\C94.tmp"79⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\D30.tmp"C:\Users\Admin\AppData\Local\Temp\D30.tmp"80⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"81⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\E3A.tmp"C:\Users\Admin\AppData\Local\Temp\E3A.tmp"82⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"83⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"84⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\FC0.tmp"C:\Users\Admin\AppData\Local\Temp\FC0.tmp"85⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\103D.tmp"C:\Users\Admin\AppData\Local\Temp\103D.tmp"86⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"87⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"88⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"89⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"90⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\134B.tmp"C:\Users\Admin\AppData\Local\Temp\134B.tmp"91⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"92⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"93⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\1500.tmp"C:\Users\Admin\AppData\Local\Temp\1500.tmp"94⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\158D.tmp"C:\Users\Admin\AppData\Local\Temp\158D.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"96⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"97⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"98⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\1781.tmp"C:\Users\Admin\AppData\Local\Temp\1781.tmp"99⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"100⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\187B.tmp"C:\Users\Admin\AppData\Local\Temp\187B.tmp"101⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\18F8.tmp"C:\Users\Admin\AppData\Local\Temp\18F8.tmp"102⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"104⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"105⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"106⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"107⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\1C34.tmp"C:\Users\Admin\AppData\Local\Temp\1C34.tmp"108⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"109⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"110⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"111⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"112⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"113⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"114⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"115⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"116⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"117⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\2154.tmp"C:\Users\Admin\AppData\Local\Temp\2154.tmp"118⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\21D1.tmp"C:\Users\Admin\AppData\Local\Temp\21D1.tmp"119⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"120⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"122⤵PID:5812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-