Analysis
- max time kernel
113s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_acfdc9e00d59b747b523aa7abd3e695c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_acfdc9e00d59b747b523aa7abd3e695c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_acfdc9e00d59b747b523aa7abd3e695c_elex_mafia.exe
- Size 520KB
- Sample260804-xf75tsfd32
- SHA256 bf52387d6244fa10b8345bed587b7fc62f8cd212ff365a82f6a5d337109aa1e1
- MD5 acfdc9e00d59b747b523aa7abd3e695c
- SHA1 882be019e7e710f70f6a495f60ab4b0e9cf5de46
- SHA512 0aca2da78e91ede53cafe5fa9ec437e63a78ed0650c3dfbd7d8deb0f9349abd0f78b61a09205c2efd8db5fc6840c1ab4beed14cc1adaf26f3b9fb3623ac4000e
- SSDEEP 12288:gj8fuxR21t5i8frAQglc7tKQNX2U5e/lXRaNZ6:gj8fuK1GY87lcLGU5uRaNI
- TLSH T18CB4F1127944C032EAD215314B66DBA14BBEBD745B3695C33BC036AE6FB52C2D63831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6004 DB24.tmp 3508 DC6C.tmp 3512 DD85.tmp 2932 DE50.tmp 2816 DF3B.tmp 4608 E015.tmp 5060 E12F.tmp 4680 E1DA.tmp 3084 E2B5.tmp 2004 E380.tmp 2720 E41D.tmp 4984 E4C8.tmp 5532 E565.tmp 2244 E601.tmp 2772 E6FB.tmp 4952 E7B6.tmp 2980 E891.tmp 4268 E94D.tmp 2144 EA18.tmp 5280 EAB4.tmp 5776 EB7F.tmp 4032 EC79.tmp 4060 ED83.tmp 3532 EE4E.tmp 3312 EF09.tmp 1276 F003.tmp 5084 F0BF.tmp 3016 F17A.tmp 1972 F207.tmp 3668 F2D2.tmp 4472 F3BD.tmp 5632 F497.tmp 2132 F553.tmp 2020 F61E.tmp 2540 F6F9.tmp 3756 F7F3.tmp 3564 F860.tmp 3396 F91C.tmp 1992 F9A8.tmp 5156 FA54.tmp 6060 FAF0.tmp 1052 FB8D.tmp 5648 FC19.tmp 6128 FC96.tmp 2468 FD23.tmp 704 FDAF.tmp 1228 FE4C.tmp 3284 FEF8.tmp 5656 FFC3.tmp 2668 4F.tmp 3676 EC.tmp 1928 178.tmp 4488 224.tmp 6056 2C0.tmp 1960 35D.tmp 6136 3F9.tmp 5944 485.tmp 5868 502.tmp 1236 58F.tmp 5520 61C.tmp 756 6A8.tmp 6116 725.tmp 5292 7A2.tmp 5304 81F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F85B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ACE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 722F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8578.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 299D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 666C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8355.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 944D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA54.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3516 wrote to memory of 6004 3516 2026-08-04_acfdc9e00d59b747b523aa7abd3e695c_elex_mafia.exe 88 PID 6004 wrote to memory of 3508 6004 DB24.tmp 89 PID 3508 wrote to memory of 3512 3508 DC6C.tmp 90 PID 3512 wrote to memory of 2932 3512 DD85.tmp 91 PID 2932 wrote to memory of 2816 2932 DE50.tmp 92 PID 2816 wrote to memory of 4608 2816 DF3B.tmp 93 PID 4608 wrote to memory of 5060 4608 E015.tmp 94 PID 5060 wrote to memory of 4680 5060 E12F.tmp 95 PID 4680 wrote to memory of 3084 4680 E1DA.tmp 96 PID 3084 wrote to memory of 2004 3084 E2B5.tmp 97 PID 2004 wrote to memory of 2720 2004 E380.tmp 98 PID 2720 wrote to memory of 4984 2720 E41D.tmp 99 PID 4984 wrote to memory of 5532 4984 E4C8.tmp 100 PID 5532 wrote to memory of 2244 5532 E565.tmp 101 PID 2244 wrote to memory of 2772 2244 E601.tmp 102 PID 2772 wrote to memory of 4952 2772 E6FB.tmp 103 PID 4952 wrote to memory of 2980 4952 E7B6.tmp 104 PID 2980 wrote to memory of 4268 2980 E891.tmp 105 PID 4268 wrote to memory of 2144 4268 E94D.tmp 106 PID 2144 wrote to memory of 5280 2144 EA18.tmp 107 PID 5280 wrote to memory of 5776 5280 EAB4.tmp 108 PID 5776 wrote to memory of 4032 5776 EB7F.tmp 109 PID 4032 wrote to memory of 4060 4032 EC79.tmp 110 PID 4060 wrote to memory of 3532 4060 ED83.tmp 111 PID 3532 wrote to memory of 3312 3532 EE4E.tmp 112 PID 3312 wrote to memory of 1276 3312 EF09.tmp 113 PID 1276 wrote to memory of 5084 1276 F003.tmp 114 PID 5084 wrote to memory of 3016 5084 F0BF.tmp 115 PID 3016 wrote to memory of 1972 3016 F17A.tmp 116 PID 1972 wrote to memory of 3668 1972 F207.tmp 117 PID 3668 wrote to memory of 4472 3668 F2D2.tmp 118 PID 4472 wrote to memory of 5632 4472 F3BD.tmp 119 PID 5632 wrote to memory of 2132 5632 F497.tmp 120 PID 2132 wrote to memory of 2020 2132 F553.tmp 121 PID 2020 wrote to memory of 2540 2020 F61E.tmp 122 PID 2540 wrote to memory of 3756 2540 F6F9.tmp 123 PID 3756 wrote to memory of 3564 3756 F7F3.tmp 124 PID 3564 wrote to memory of 3396 3564 F860.tmp 125 PID 3396 wrote to memory of 1992 3396 F91C.tmp 126 PID 1992 wrote to memory of 5156 1992 F9A8.tmp 127 PID 5156 wrote to memory of 6060 5156 FA54.tmp 128 PID 6060 wrote to memory of 1052 6060 FAF0.tmp 129 PID 1052 wrote to memory of 5648 1052 FB8D.tmp 130 PID 5648 wrote to memory of 6128 5648 FC19.tmp 131 PID 6128 wrote to memory of 2468 6128 FC96.tmp 132 PID 2468 wrote to memory of 704 2468 FD23.tmp 133 PID 704 wrote to memory of 1228 704 FDAF.tmp 134 PID 1228 wrote to memory of 3284 1228 FE4C.tmp 135 PID 3284 wrote to memory of 5656 3284 FEF8.tmp 136 PID 5656 wrote to memory of 2668 5656 FFC3.tmp 137 PID 2668 wrote to memory of 3676 2668 4F.tmp 138 PID 3676 wrote to memory of 1928 3676 EC.tmp 139 PID 1928 wrote to memory of 4488 1928 178.tmp 140 PID 4488 wrote to memory of 6056 4488 224.tmp 141 PID 6056 wrote to memory of 1960 6056 2C0.tmp 142 PID 1960 wrote to memory of 6136 1960 35D.tmp 143 PID 6136 wrote to memory of 5944 6136 3F9.tmp 144 PID 5944 wrote to memory of 5868 5944 485.tmp 145 PID 5868 wrote to memory of 1236 5868 502.tmp 146 PID 1236 wrote to memory of 5520 1236 58F.tmp 147 PID 5520 wrote to memory of 756 5520 61C.tmp 148 PID 756 wrote to memory of 6116 756 6A8.tmp 149 PID 6116 wrote to memory of 5292 6116 725.tmp 150 PID 5292 wrote to memory of 5304 5292 7A2.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_acfdc9e00d59b747b523aa7abd3e695c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_acfdc9e00d59b747b523aa7abd3e695c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\DB24.tmp"C:\Users\Admin\AppData\Local\Temp\DB24.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\DE50.tmp"C:\Users\Admin\AppData\Local\Temp\DE50.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E015.tmp"C:\Users\Admin\AppData\Local\Temp\E015.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\E12F.tmp"C:\Users\Admin\AppData\Local\Temp\E12F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\E41D.tmp"C:\Users\Admin\AppData\Local\Temp\E41D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\EA18.tmp"C:\Users\Admin\AppData\Local\Temp\EA18.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\EF09.tmp"C:\Users\Admin\AppData\Local\Temp\EF09.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\F17A.tmp"C:\Users\Admin\AppData\Local\Temp\F17A.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\F61E.tmp"C:\Users\Admin\AppData\Local\Temp\F61E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\F860.tmp"C:\Users\Admin\AppData\Local\Temp\F860.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\FC19.tmp"C:\Users\Admin\AppData\Local\Temp\FC19.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\FC96.tmp"C:\Users\Admin\AppData\Local\Temp\FC96.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\FD23.tmp"C:\Users\Admin\AppData\Local\Temp\FD23.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2C0.tmp"C:\Users\Admin\AppData\Local\Temp\2C0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\35D.tmp"C:\Users\Admin\AppData\Local\Temp\35D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3F9.tmp"C:\Users\Admin\AppData\Local\Temp\3F9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\58F.tmp"C:\Users\Admin\AppData\Local\Temp\58F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"65⤵
- Executes dropped EXE
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\8BC.tmp"C:\Users\Admin\AppData\Local\Temp\8BC.tmp"66⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\939.tmp"C:\Users\Admin\AppData\Local\Temp\939.tmp"67⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\9D5.tmp"C:\Users\Admin\AppData\Local\Temp\9D5.tmp"68⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\A71.tmp"C:\Users\Admin\AppData\Local\Temp\A71.tmp"69⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\AFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFE.tmp"70⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\BC9.tmp"C:\Users\Admin\AppData\Local\Temp\BC9.tmp"71⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"72⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"73⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"74⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"75⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"76⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\F53.tmp"C:\Users\Admin\AppData\Local\Temp\F53.tmp"77⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"78⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"79⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\1118.tmp"C:\Users\Admin\AppData\Local\Temp\1118.tmp"80⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\1195.tmp"C:\Users\Admin\AppData\Local\Temp\1195.tmp"81⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"82⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"83⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\132B.tmp"C:\Users\Admin\AppData\Local\Temp\132B.tmp"84⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"85⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"86⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"87⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"88⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"89⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"90⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"91⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"92⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"93⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"94⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1956.tmp"C:\Users\Admin\AppData\Local\Temp\1956.tmp"95⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\19E2.tmp"C:\Users\Admin\AppData\Local\Temp\19E2.tmp"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"97⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"98⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"99⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\1C34.tmp"C:\Users\Admin\AppData\Local\Temp\1C34.tmp"100⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"101⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"102⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"103⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"106⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"107⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"108⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"109⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2164.tmp"C:\Users\Admin\AppData\Local\Temp\2164.tmp"110⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\21E1.tmp"C:\Users\Admin\AppData\Local\Temp\21E1.tmp"111⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"112⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"113⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"114⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"115⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"116⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"117⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"118⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\2750.tmp"C:\Users\Admin\AppData\Local\Temp\2750.tmp"120⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\27CD.tmp"C:\Users\Admin\AppData\Local\Temp\27CD.tmp"121⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-