Analysis
- max time kernel
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_eace24c9381217630446cdc21653a0ac_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_eace24c9381217630446cdc21653a0ac_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_eace24c9381217630446cdc21653a0ac_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260817-mf4sasyvb1
- SHA256 279046a42142387c3170fb901ff99e9bd9dc3f6189315f73fdf8c037c5236286
- MD5 eace24c9381217630446cdc21653a0ac
- SHA1 9ee086e9d76913005b52f7ce4f9d77972e7eee6b
- SHA512 7eedc18dc3b5dfa7d62405542b9ff595a1e3dac9070b080d1bbdcc953a614672a9e1b1e163bc7a42d66f4e1a1f75d03a7129bd4976e3ddf7490a9dbd44226bb2
- SSDEEP 12288:wU5rCOTeiD5AiAHjTKOQA8zignEd5ObvINZ+3/v+I9hUG2VA:wUQOJDa3DTK3ziTLOkNGEA
- TLSH T115E4D02177D88532E9FB037859B5E6604D7EBD32A722D6CF2F9055AE0AB1BC08631713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4184 5D97.tmp 2820 5E62.tmp 248 6008.tmp 5212 61DD.tmp 2572 6383.tmp 5596 648C.tmp 4240 6651.tmp 4872 67B9.tmp 1564 6911.tmp 5916 6A59.tmp 356 6BDF.tmp 5240 6D27.tmp 5384 6E8F.tmp 3796 6FC7.tmp 5168 7100.tmp 3380 72A6.tmp 3568 746B.tmp 3248 75D2.tmp 1188 7768.tmp 4772 78DF.tmp 2868 7A56.tmp 3892 7BAE.tmp 1008 7CF6.tmp 3392 7E3E.tmp 4796 7FB5.tmp 2528 80DE.tmp 4148 81F8.tmp 4660 8311.tmp 6136 8459.tmp 424 8572.tmp 1680 86CA.tmp 5428 8802.tmp 3544 893B.tmp 3372 8A06.tmp 3876 8B00.tmp 1404 8BFA.tmp 5816 8CB6.tmp 2448 8D90.tmp 4572 8E6B.tmp 5648 8F65.tmp 1724 904F.tmp 5180 9159.tmp 5992 9253.tmp 4416 935D.tmp 4328 9437.tmp 2708 94E3.tmp 3812 9570.tmp 5300 963B.tmp 5524 96D7.tmp 1640 9754.tmp 1236 97D1.tmp 252 986E.tmp 4560 98FA.tmp 4972 9987.tmp 4892 9A04.tmp 2400 9A81.tmp 4904 9B0D.tmp 2028 9BB9.tmp 3564 9C56.tmp 3352 9CE2.tmp 4704 9D9E.tmp 4964 9E2A.tmp 2232 9EC7.tmp 3896 9F63.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E32D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 171E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4840.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F88F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 784E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 254C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1171.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3396 wrote to memory of 4184 3396 2026-08-17_eace24c9381217630446cdc21653a0ac_elex_mafia_stealc_tofsee.exe 89 PID 4184 wrote to memory of 2820 4184 5D97.tmp 90 PID 2820 wrote to memory of 248 2820 5E62.tmp 91 PID 248 wrote to memory of 5212 248 6008.tmp 92 PID 5212 wrote to memory of 2572 5212 61DD.tmp 93 PID 2572 wrote to memory of 5596 2572 6383.tmp 94 PID 5596 wrote to memory of 4240 5596 648C.tmp 95 PID 4240 wrote to memory of 4872 4240 6651.tmp 96 PID 4872 wrote to memory of 1564 4872 67B9.tmp 97 PID 1564 wrote to memory of 5916 1564 6911.tmp 98 PID 5916 wrote to memory of 356 5916 6A59.tmp 99 PID 356 wrote to memory of 5240 356 6BDF.tmp 100 PID 5240 wrote to memory of 5384 5240 6D27.tmp 101 PID 5384 wrote to memory of 3796 5384 6E8F.tmp 102 PID 3796 wrote to memory of 5168 3796 6FC7.tmp 103 PID 5168 wrote to memory of 3380 5168 7100.tmp 104 PID 3380 wrote to memory of 3568 3380 72A6.tmp 105 PID 3568 wrote to memory of 3248 3568 746B.tmp 106 PID 3248 wrote to memory of 1188 3248 75D2.tmp 107 PID 1188 wrote to memory of 4772 1188 7768.tmp 108 PID 4772 wrote to memory of 2868 4772 78DF.tmp 109 PID 2868 wrote to memory of 3892 2868 7A56.tmp 110 PID 3892 wrote to memory of 1008 3892 7BAE.tmp 111 PID 1008 wrote to memory of 3392 1008 7CF6.tmp 112 PID 3392 wrote to memory of 4796 3392 7E3E.tmp 113 PID 4796 wrote to memory of 2528 4796 7FB5.tmp 114 PID 2528 wrote to memory of 4148 2528 80DE.tmp 115 PID 4148 wrote to memory of 4660 4148 81F8.tmp 116 PID 4660 wrote to memory of 6136 4660 8311.tmp 117 PID 6136 wrote to memory of 424 6136 8459.tmp 118 PID 424 wrote to memory of 1680 424 8572.tmp 119 PID 1680 wrote to memory of 5428 1680 86CA.tmp 120 PID 5428 wrote to memory of 3544 5428 8802.tmp 121 PID 3544 wrote to memory of 3372 3544 893B.tmp 122 PID 3372 wrote to memory of 3876 3372 8A06.tmp 123 PID 3876 wrote to memory of 1404 3876 8B00.tmp 124 PID 1404 wrote to memory of 5816 1404 8BFA.tmp 125 PID 5816 wrote to memory of 2448 5816 8CB6.tmp 126 PID 2448 wrote to memory of 4572 2448 8D90.tmp 127 PID 4572 wrote to memory of 5648 4572 8E6B.tmp 128 PID 5648 wrote to memory of 1724 5648 8F65.tmp 129 PID 1724 wrote to memory of 5180 1724 904F.tmp 130 PID 5180 wrote to memory of 5992 5180 9159.tmp 131 PID 5992 wrote to memory of 4416 5992 9253.tmp 132 PID 4416 wrote to memory of 4328 4416 935D.tmp 133 PID 4328 wrote to memory of 2708 4328 9437.tmp 134 PID 2708 wrote to memory of 3812 2708 94E3.tmp 135 PID 3812 wrote to memory of 5300 3812 9570.tmp 136 PID 5300 wrote to memory of 5524 5300 963B.tmp 137 PID 5524 wrote to memory of 1640 5524 96D7.tmp 138 PID 1640 wrote to memory of 1236 1640 9754.tmp 139 PID 1236 wrote to memory of 252 1236 97D1.tmp 140 PID 252 wrote to memory of 4560 252 986E.tmp 141 PID 4560 wrote to memory of 4972 4560 98FA.tmp 142 PID 4972 wrote to memory of 4892 4972 9987.tmp 143 PID 4892 wrote to memory of 2400 4892 9A04.tmp 144 PID 2400 wrote to memory of 4904 2400 9A81.tmp 145 PID 4904 wrote to memory of 2028 4904 9B0D.tmp 146 PID 2028 wrote to memory of 3564 2028 9BB9.tmp 147 PID 3564 wrote to memory of 3352 3564 9C56.tmp 148 PID 3352 wrote to memory of 4704 3352 9CE2.tmp 149 PID 4704 wrote to memory of 4964 4704 9D9E.tmp 150 PID 4964 wrote to memory of 2232 4964 9E2A.tmp 151 PID 2232 wrote to memory of 3896 2232 9EC7.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_eace24c9381217630446cdc21653a0ac_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_eace24c9381217630446cdc21653a0ac_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\5E62.tmp"C:\Users\Admin\AppData\Local\Temp\5E62.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\61DD.tmp"C:\Users\Admin\AppData\Local\Temp\61DD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6911.tmp"C:\Users\Admin\AppData\Local\Temp\6911.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\6A59.tmp"C:\Users\Admin\AppData\Local\Temp\6A59.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\7768.tmp"C:\Users\Admin\AppData\Local\Temp\7768.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\80DE.tmp"C:\Users\Admin\AppData\Local\Temp\80DE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\8572.tmp"C:\Users\Admin\AppData\Local\Temp\8572.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\893B.tmp"C:\Users\Admin\AppData\Local\Temp\893B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8A06.tmp"C:\Users\Admin\AppData\Local\Temp\8A06.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8F65.tmp"C:\Users\Admin\AppData\Local\Temp\8F65.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\9253.tmp"C:\Users\Admin\AppData\Local\Temp\9253.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9570.tmp"C:\Users\Admin\AppData\Local\Temp\9570.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\9754.tmp"C:\Users\Admin\AppData\Local\Temp\9754.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\97D1.tmp"C:\Users\Admin\AppData\Local\Temp\97D1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\9C56.tmp"C:\Users\Admin\AppData\Local\Temp\9C56.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\9F63.tmp"C:\Users\Admin\AppData\Local\Temp\9F63.tmp"65⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"66⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\A07C.tmp"C:\Users\Admin\AppData\Local\Temp\A07C.tmp"67⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"68⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"69⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\A212.tmp"C:\Users\Admin\AppData\Local\Temp\A212.tmp"70⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"72⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"73⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\A435.tmp"C:\Users\Admin\AppData\Local\Temp\A435.tmp"74⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"75⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"76⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"77⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\A687.tmp"C:\Users\Admin\AppData\Local\Temp\A687.tmp"78⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"79⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"80⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"81⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"82⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\A946.tmp"C:\Users\Admin\AppData\Local\Temp\A946.tmp"83⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"84⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\AA50.tmp"C:\Users\Admin\AppData\Local\Temp\AA50.tmp"85⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"86⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"87⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"88⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"89⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"90⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"91⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\AE57.tmp"C:\Users\Admin\AppData\Local\Temp\AE57.tmp"92⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"93⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"94⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"95⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"96⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"97⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"98⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"99⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"100⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"101⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"102⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"103⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"104⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\B58B.tmp"C:\Users\Admin\AppData\Local\Temp\B58B.tmp"105⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"106⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"107⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\B740.tmp"C:\Users\Admin\AppData\Local\Temp\B740.tmp"108⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"109⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"110⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"111⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B973.tmp"C:\Users\Admin\AppData\Local\Temp\B973.tmp"112⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"113⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"116⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"117⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\BC80.tmp"C:\Users\Admin\AppData\Local\Temp\BC80.tmp"118⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"119⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\BE16.tmp"C:\Users\Admin\AppData\Local\Temp\BE16.tmp"121⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"122⤵PID:972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-