Analysis
- max time kernel
129s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_f09390ddc3ba4703b4c851292309e49f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_f09390ddc3ba4703b4c851292309e49f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_f09390ddc3ba4703b4c851292309e49f_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260804-qs53nsfp81
- SHA256 c3981263fef5e816a4223c6784614fc442e1ebe36d376f3f05e255d45eafcfe7
- MD5 f09390ddc3ba4703b4c851292309e49f
- SHA1 c6a1aae4db34443e563315fbbbcf8f375b2b9e86
- SHA512 0a84a7f10cffc320d1fac3102a0ab41bd9d173606ac5c3d1cf046cc2a8721aaa1e580fa9c9901aa3c75a4109cef667479add844d154a36987abe2d84d1000c5a
- SSDEEP 12288:wU5rCOTeiDdGPpjw9+Cog1H7FMW3sgANZ+3/v+I9hUG2VA:wUQOJDdGPpju+CoghuW3sgANGEA
- TLSH T103E4D02177D88532E5FB037859B5E6654E7EBD226722D6CF2F8011AE09B1BC0DA31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4940 71FA.tmp 5512 7342.tmp 6112 74D8.tmp 1768 7620.tmp 1540 77A7.tmp 4764 78A1.tmp 1452 7A18.tmp 236 7B22.tmp 4244 7BFC.tmp 412 7CF6.tmp 3096 7DE1.tmp 4320 7F19.tmp 4296 8052.tmp 3712 814C.tmp 4436 8255.tmp 4520 83AD.tmp 1948 8488.tmp 4216 85A1.tmp 3200 869B.tmp 6004 87D4.tmp 2672 891C.tmp 5044 8A54.tmp 3892 8B7D.tmp 3548 8CC5.tmp 2704 8E0D.tmp 3076 8F46.tmp 4572 904F.tmp 5060 9169.tmp 6032 92B1.tmp 5240 93CA.tmp 2656 94D4.tmp 4552 95CE.tmp 1152 96E7.tmp 3004 9793.tmp 4804 987D.tmp 4944 98FA.tmp 4888 9996.tmp 3856 9A23.tmp 5696 9AEE.tmp 5788 9BAA.tmp 3164 9C75.tmp 4960 9D30.tmp 2204 9DFB.tmp 1504 9EE6.tmp 1376 9FA1.tmp 2396 A02E.tmp 4348 A0CA.tmp 4496 A176.tmp 2064 A212.tmp 2804 A28F.tmp 2612 A32C.tmp 5312 A3D7.tmp 4364 A493.tmp 1472 A510.tmp 1148 A5CB.tmp 6124 A648.tmp 4596 A6C5.tmp 444 A742.tmp 3700 A7CF.tmp 3980 A86B.tmp 404 A8E8.tmp 416 A956.tmp 300 A9E2.tmp 2684 AA7F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E909.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 902B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 414B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14CD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 4940 2584 2026-08-04_f09390ddc3ba4703b4c851292309e49f_elex_mafia_stealc_tofsee.exe 89 PID 4940 wrote to memory of 5512 4940 71FA.tmp 90 PID 5512 wrote to memory of 6112 5512 7342.tmp 91 PID 6112 wrote to memory of 1768 6112 74D8.tmp 92 PID 1768 wrote to memory of 1540 1768 7620.tmp 93 PID 1540 wrote to memory of 4764 1540 77A7.tmp 94 PID 4764 wrote to memory of 1452 4764 78A1.tmp 95 PID 1452 wrote to memory of 236 1452 7A18.tmp 96 PID 236 wrote to memory of 4244 236 7B22.tmp 97 PID 4244 wrote to memory of 412 4244 7BFC.tmp 98 PID 412 wrote to memory of 3096 412 7CF6.tmp 99 PID 3096 wrote to memory of 4320 3096 7DE1.tmp 100 PID 4320 wrote to memory of 4296 4320 7F19.tmp 101 PID 4296 wrote to memory of 3712 4296 8052.tmp 102 PID 3712 wrote to memory of 4436 3712 814C.tmp 103 PID 4436 wrote to memory of 4520 4436 8255.tmp 104 PID 4520 wrote to memory of 1948 4520 83AD.tmp 105 PID 1948 wrote to memory of 4216 1948 8488.tmp 106 PID 4216 wrote to memory of 3200 4216 85A1.tmp 107 PID 3200 wrote to memory of 6004 3200 869B.tmp 108 PID 6004 wrote to memory of 2672 6004 87D4.tmp 109 PID 2672 wrote to memory of 5044 2672 891C.tmp 110 PID 5044 wrote to memory of 3892 5044 8A54.tmp 111 PID 3892 wrote to memory of 3548 3892 8B7D.tmp 112 PID 3548 wrote to memory of 2704 3548 8CC5.tmp 113 PID 2704 wrote to memory of 3076 2704 8E0D.tmp 114 PID 3076 wrote to memory of 4572 3076 8F46.tmp 115 PID 4572 wrote to memory of 5060 4572 904F.tmp 116 PID 5060 wrote to memory of 6032 5060 9169.tmp 117 PID 6032 wrote to memory of 5240 6032 92B1.tmp 118 PID 5240 wrote to memory of 2656 5240 93CA.tmp 119 PID 2656 wrote to memory of 4552 2656 94D4.tmp 120 PID 4552 wrote to memory of 1152 4552 95CE.tmp 121 PID 1152 wrote to memory of 3004 1152 96E7.tmp 122 PID 3004 wrote to memory of 4804 3004 9793.tmp 123 PID 4804 wrote to memory of 4944 4804 987D.tmp 124 PID 4944 wrote to memory of 4888 4944 98FA.tmp 125 PID 4888 wrote to memory of 3856 4888 9996.tmp 126 PID 3856 wrote to memory of 5696 3856 9A23.tmp 127 PID 5696 wrote to memory of 5788 5696 9AEE.tmp 128 PID 5788 wrote to memory of 3164 5788 9BAA.tmp 129 PID 3164 wrote to memory of 4960 3164 9C75.tmp 130 PID 4960 wrote to memory of 2204 4960 9D30.tmp 131 PID 2204 wrote to memory of 1504 2204 9DFB.tmp 132 PID 1504 wrote to memory of 1376 1504 9EE6.tmp 133 PID 1376 wrote to memory of 2396 1376 9FA1.tmp 134 PID 2396 wrote to memory of 4348 2396 A02E.tmp 135 PID 4348 wrote to memory of 4496 4348 A0CA.tmp 136 PID 4496 wrote to memory of 2064 4496 A176.tmp 137 PID 2064 wrote to memory of 2804 2064 A212.tmp 138 PID 2804 wrote to memory of 2612 2804 A28F.tmp 139 PID 2612 wrote to memory of 5312 2612 A32C.tmp 140 PID 5312 wrote to memory of 4364 5312 A3D7.tmp 141 PID 4364 wrote to memory of 1472 4364 A493.tmp 142 PID 1472 wrote to memory of 1148 1472 A510.tmp 143 PID 1148 wrote to memory of 6124 1148 A5CB.tmp 144 PID 6124 wrote to memory of 4596 6124 A648.tmp 145 PID 4596 wrote to memory of 444 4596 A6C5.tmp 146 PID 444 wrote to memory of 3700 444 A742.tmp 147 PID 3700 wrote to memory of 3980 3700 A7CF.tmp 148 PID 3980 wrote to memory of 404 3980 A86B.tmp 149 PID 404 wrote to memory of 416 404 A8E8.tmp 150 PID 416 wrote to memory of 300 416 A956.tmp 151 PID 300 wrote to memory of 2684 300 A9E2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_f09390ddc3ba4703b4c851292309e49f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f09390ddc3ba4703b4c851292309e49f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\71FA.tmp"C:\Users\Admin\AppData\Local\Temp\71FA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\7342.tmp"C:\Users\Admin\AppData\Local\Temp\7342.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\78A1.tmp"C:\Users\Admin\AppData\Local\Temp\78A1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7B22.tmp"C:\Users\Admin\AppData\Local\Temp\7B22.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\7F19.tmp"C:\Users\Admin\AppData\Local\Temp\7F19.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8052.tmp"C:\Users\Admin\AppData\Local\Temp\8052.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8255.tmp"C:\Users\Admin\AppData\Local\Temp\8255.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8488.tmp"C:\Users\Admin\AppData\Local\Temp\8488.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\869B.tmp"C:\Users\Admin\AppData\Local\Temp\869B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\93CA.tmp"C:\Users\Admin\AppData\Local\Temp\93CA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9A23.tmp"C:\Users\Admin\AppData\Local\Temp\9A23.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\9D30.tmp"C:\Users\Admin\AppData\Local\Temp\9D30.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A212.tmp"C:\Users\Admin\AppData\Local\Temp\A212.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A648.tmp"C:\Users\Admin\AppData\Local\Temp\A648.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\A742.tmp"C:\Users\Admin\AppData\Local\Temp\A742.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\A86B.tmp"C:\Users\Admin\AppData\Local\Temp\A86B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\A956.tmp"C:\Users\Admin\AppData\Local\Temp\A956.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"65⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"66⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"67⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"68⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"69⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"70⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"71⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"72⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"73⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\AF70.tmp"C:\Users\Admin\AppData\Local\Temp\AF70.tmp"74⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"75⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"76⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"77⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"78⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"79⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"80⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"81⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"82⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B481.tmp"C:\Users\Admin\AppData\Local\Temp\B481.tmp"83⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"84⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"85⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"87⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"88⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"89⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"90⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"92⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\BADA.tmp"C:\Users\Admin\AppData\Local\Temp\BADA.tmp"94⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"95⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"96⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BC80.tmp"C:\Users\Admin\AppData\Local\Temp\BC80.tmp"97⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"98⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"99⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"100⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"101⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"102⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"103⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"104⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"105⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\C162.tmp"C:\Users\Admin\AppData\Local\Temp\C162.tmp"106⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"107⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\C28B.tmp"C:\Users\Admin\AppData\Local\Temp\C28B.tmp"108⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\C337.tmp"C:\Users\Admin\AppData\Local\Temp\C337.tmp"109⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"110⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"111⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\C52B.tmp"C:\Users\Admin\AppData\Local\Temp\C52B.tmp"112⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"113⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"114⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"115⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:240 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"117⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\C886.tmp"C:\Users\Admin\AppData\Local\Temp\C886.tmp"118⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"119⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"121⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\CB55.tmp"C:\Users\Admin\AppData\Local\Temp\CB55.tmp"122⤵PID:5572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-