Analysis
- max time kernel
120s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 19:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_0b7c9f55573df79bb7a6619109e56da1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_0b7c9f55573df79bb7a6619109e56da1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-24_0b7c9f55573df79bb7a6619109e56da1_elex_mafia_stealc_tofsee.exe
- Size 527KB
- Sample260825-x52dksvthy
- SHA256 3e04107dffb5f94a4c849e418532eee8ec8b5be2cac08afc0553c60d89a2c10f
- MD5 0b7c9f55573df79bb7a6619109e56da1
- SHA1 4f0e5bdcf40ccda302128a5f0f0c54455e4f0a6b
- SHA512 c7304769ead9240b605ad29a5930b4fa06d3c1be6e5b4b16a27252b8937caf69a03132c674b25ba05c60acd76ad4442190f0de02d8a21a26986bbc02282baab6
- SSDEEP 12288:fU5rCOTeidRKZKpIbzFBy8CNBN/5sDZu:fUQOJdgZK6hCNB1SDo
- TLSH T1DAB4CF11B2D88032F1B316385AF59B725A3B7C229B31D8CF2B84636E5EB16D1DA74713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3944 791E.tmp 2392 79CA.tmp 3776 7A95.tmp 5840 7B9F.tmp 4056 7C99.tmp 4092 7D06.tmp 3128 7DB2.tmp 2584 7E3E.tmp 2724 7EDB.tmp 5692 7F87.tmp 4536 8023.tmp 5936 80AF.tmp 1796 816B.tmp 2308 8226.tmp 5920 82D2.tmp 3364 837E.tmp 2716 8469.tmp 3840 8543.tmp 2212 85C0.tmp 696 863D.tmp 4328 86CA.tmp 6012 87B4.tmp 1160 889F.tmp 2596 893B.tmp 2840 89F6.tmp 876 8AB2.tmp 4256 8B4E.tmp 5572 8BFA.tmp 1428 8CA6.tmp 3520 8D61.tmp 900 8E0D.tmp 4088 8EB9.tmp 3148 8F75.tmp 3720 9001.tmp 5008 906F.tmp 5876 90FB.tmp 3868 9178.tmp 944 9205.tmp 2224 9272.tmp 4076 930F.tmp 2108 938C.tmp 4416 9418.tmp 5816 94A5.tmp 2184 9541.tmp 1800 95BE.tmp 2720 964B.tmp 5144 9706.tmp 1736 9793.tmp 5280 9810.tmp 1804 987D.tmp 4408 990A.tmp 4808 99A6.tmp 4428 9A13.tmp 5616 9AA0.tmp 1380 9B5C.tmp 1200 9BF8.tmp 3224 9C65.tmp 5712 9CF2.tmp 1640 9D7E.tmp 1624 9E0B.tmp 1908 9E88.tmp 6124 9F05.tmp 4160 9FB1.tmp 5376 A01E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F444.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 954C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 791E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A88B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 828F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CAC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5500 wrote to memory of 3944 5500 2026-08-24_0b7c9f55573df79bb7a6619109e56da1_elex_mafia_stealc_tofsee.exe 88 PID 3944 wrote to memory of 2392 3944 791E.tmp 90 PID 2392 wrote to memory of 3776 2392 79CA.tmp 91 PID 3776 wrote to memory of 5840 3776 7A95.tmp 92 PID 5840 wrote to memory of 4056 5840 7B9F.tmp 93 PID 4056 wrote to memory of 4092 4056 7C99.tmp 94 PID 4092 wrote to memory of 3128 4092 7D06.tmp 95 PID 3128 wrote to memory of 2584 3128 7DB2.tmp 96 PID 2584 wrote to memory of 2724 2584 7E3E.tmp 97 PID 2724 wrote to memory of 5692 2724 7EDB.tmp 98 PID 5692 wrote to memory of 4536 5692 7F87.tmp 99 PID 4536 wrote to memory of 5936 4536 8023.tmp 100 PID 5936 wrote to memory of 1796 5936 80AF.tmp 101 PID 1796 wrote to memory of 2308 1796 816B.tmp 102 PID 2308 wrote to memory of 5920 2308 8226.tmp 103 PID 5920 wrote to memory of 3364 5920 82D2.tmp 104 PID 3364 wrote to memory of 2716 3364 837E.tmp 105 PID 2716 wrote to memory of 3840 2716 8469.tmp 106 PID 3840 wrote to memory of 2212 3840 8543.tmp 107 PID 2212 wrote to memory of 696 2212 85C0.tmp 108 PID 696 wrote to memory of 4328 696 863D.tmp 109 PID 4328 wrote to memory of 6012 4328 86CA.tmp 110 PID 6012 wrote to memory of 1160 6012 87B4.tmp 111 PID 1160 wrote to memory of 2596 1160 889F.tmp 112 PID 2596 wrote to memory of 2840 2596 893B.tmp 113 PID 2840 wrote to memory of 876 2840 89F6.tmp 114 PID 876 wrote to memory of 4256 876 8AB2.tmp 115 PID 4256 wrote to memory of 5572 4256 8B4E.tmp 116 PID 5572 wrote to memory of 1428 5572 8BFA.tmp 117 PID 1428 wrote to memory of 3520 1428 8CA6.tmp 118 PID 3520 wrote to memory of 900 3520 8D61.tmp 119 PID 900 wrote to memory of 4088 900 8E0D.tmp 120 PID 4088 wrote to memory of 3148 4088 8EB9.tmp 121 PID 3148 wrote to memory of 3720 3148 8F75.tmp 122 PID 3720 wrote to memory of 5008 3720 9001.tmp 123 PID 5008 wrote to memory of 5876 5008 906F.tmp 124 PID 5876 wrote to memory of 3868 5876 90FB.tmp 125 PID 3868 wrote to memory of 944 3868 9178.tmp 126 PID 944 wrote to memory of 2224 944 9205.tmp 127 PID 2224 wrote to memory of 4076 2224 9272.tmp 128 PID 4076 wrote to memory of 2108 4076 930F.tmp 129 PID 2108 wrote to memory of 4416 2108 938C.tmp 130 PID 4416 wrote to memory of 5816 4416 9418.tmp 131 PID 5816 wrote to memory of 2184 5816 94A5.tmp 132 PID 2184 wrote to memory of 1800 2184 9541.tmp 133 PID 1800 wrote to memory of 2720 1800 95BE.tmp 134 PID 2720 wrote to memory of 5144 2720 964B.tmp 135 PID 5144 wrote to memory of 1736 5144 9706.tmp 136 PID 1736 wrote to memory of 5280 1736 9793.tmp 137 PID 5280 wrote to memory of 1804 5280 9810.tmp 138 PID 1804 wrote to memory of 4408 1804 987D.tmp 139 PID 4408 wrote to memory of 4808 4408 990A.tmp 140 PID 4808 wrote to memory of 4428 4808 99A6.tmp 141 PID 4428 wrote to memory of 5616 4428 9A13.tmp 142 PID 5616 wrote to memory of 1380 5616 9AA0.tmp 143 PID 1380 wrote to memory of 1200 1380 9B5C.tmp 144 PID 1200 wrote to memory of 3224 1200 9BF8.tmp 145 PID 3224 wrote to memory of 5712 3224 9C65.tmp 146 PID 5712 wrote to memory of 1640 5712 9CF2.tmp 147 PID 1640 wrote to memory of 1624 1640 9D7E.tmp 148 PID 1624 wrote to memory of 1908 1624 9E0B.tmp 149 PID 1908 wrote to memory of 6124 1908 9E88.tmp 150 PID 6124 wrote to memory of 4160 6124 9F05.tmp 151 PID 4160 wrote to memory of 5376 4160 9FB1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_0b7c9f55573df79bb7a6619109e56da1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_0b7c9f55573df79bb7a6619109e56da1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\791E.tmp"C:\Users\Admin\AppData\Local\Temp\791E.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\79CA.tmp"C:\Users\Admin\AppData\Local\Temp\79CA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7A95.tmp"C:\Users\Admin\AppData\Local\Temp\7A95.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\816B.tmp"C:\Users\Admin\AppData\Local\Temp\816B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\82D2.tmp"C:\Users\Admin\AppData\Local\Temp\82D2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\837E.tmp"C:\Users\Admin\AppData\Local\Temp\837E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\87B4.tmp"C:\Users\Admin\AppData\Local\Temp\87B4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\893B.tmp"C:\Users\Admin\AppData\Local\Temp\893B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\89F6.tmp"C:\Users\Admin\AppData\Local\Temp\89F6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\8F75.tmp"C:\Users\Admin\AppData\Local\Temp\8F75.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\906F.tmp"C:\Users\Admin\AppData\Local\Temp\906F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\9178.tmp"C:\Users\Admin\AppData\Local\Temp\9178.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\938C.tmp"C:\Users\Admin\AppData\Local\Temp\938C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\990A.tmp"C:\Users\Admin\AppData\Local\Temp\990A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\9C65.tmp"C:\Users\Admin\AppData\Local\Temp\9C65.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"65⤵
- Executes dropped EXE
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"66⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"67⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"68⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"69⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"70⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\A30C.tmp"C:\Users\Admin\AppData\Local\Temp\A30C.tmp"71⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"72⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A416.tmp"C:\Users\Admin\AppData\Local\Temp\A416.tmp"73⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A483.tmp"C:\Users\Admin\AppData\Local\Temp\A483.tmp"74⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"75⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"76⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\A639.tmp"C:\Users\Admin\AppData\Local\Temp\A639.tmp"77⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"78⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"79⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"80⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"82⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\A965.tmp"C:\Users\Admin\AppData\Local\Temp\A965.tmp"83⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"84⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\AA40.tmp"C:\Users\Admin\AppData\Local\Temp\AA40.tmp"85⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"86⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"88⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\AC15.tmp"C:\Users\Admin\AppData\Local\Temp\AC15.tmp"89⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"90⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"91⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"92⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"C:\Users\Admin\AppData\Local\Temp\ADEA.tmp"93⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\AE76.tmp"C:\Users\Admin\AppData\Local\Temp\AE76.tmp"94⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"95⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\AF70.tmp"C:\Users\Admin\AppData\Local\Temp\AF70.tmp"96⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"97⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"98⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"99⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\B183.tmp"C:\Users\Admin\AppData\Local\Temp\B183.tmp"100⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\B200.tmp"C:\Users\Admin\AppData\Local\Temp\B200.tmp"101⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"102⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"103⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"104⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"105⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"106⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"107⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"110⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"111⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"113⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"114⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\B84A.tmp"C:\Users\Admin\AppData\Local\Temp\B84A.tmp"115⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"116⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"117⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"118⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"119⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"120⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\BB38.tmp"C:\Users\Admin\AppData\Local\Temp\BB38.tmp"121⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"122⤵PID:4956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-