Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_6acc9014b96e6ca9853b36a48e216ed0_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_6acc9014b96e6ca9853b36a48e216ed0_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_6acc9014b96e6ca9853b36a48e216ed0_elex_mafia.exe
- Size 561KB
- Sample260804-yleadaw1bs
- SHA256 974d5fd779bc756abaf2b3f9c954255fb9d3d5c4586e2778c252c0b8de7e54a0
- MD5 6acc9014b96e6ca9853b36a48e216ed0
- SHA1 c3c3539a99e8c10fa1b54a5e1194bff0b4040c8a
- SHA512 551fe07db3fef4d69681b83fb3c0fa477efd990ccbdc1fcf8a55bea41a5b2a51456c27bb8b2e6386ea4d63bb4488717cf374689b40818d134f2807a595896d0d
- SSDEEP 12288:VuelPWET0yh/iXHQ3yVztvoi90PLBpOrjboISDZuL:8eEEvh/4HQ3Mei90N6vaDoL
- TLSH T16BC4DF11B2D8C835F1F31A345AF49762097B7D615B35E8CF2788662E6EB12C1EA38713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4156 97C6.tmp 1448 98C0.tmp 3212 994D.tmp 4976 9A57.tmp 4068 9B31.tmp 3820 9BAE.tmp 3964 9C7A.tmp 396 9D25.tmp 5044 9DE1.tmp 3756 9EBC.tmp 3836 9F87.tmp 4260 A052.tmp 4024 A11D.tmp 5000 A1C9.tmp 1336 A256.tmp 2152 A330.tmp 3996 A3BD.tmp 1580 A488.tmp 508 A505.tmp 3196 A592.tmp 744 A62E.tmp 1348 A6E9.tmp 3892 A7A5.tmp 2712 A860.tmp 864 A93B.tmp 3832 A9B8.tmp 3352 AA74.tmp 2792 AB2F.tmp 896 AC0A.tmp 5040 ACA6.tmp 3312 AD52.tmp 3424 AE1D.tmp 532 AEB9.tmp 3116 AF27.tmp 3084 AF85.tmp 3448 AFD3.tmp 2496 B030.tmp 2408 B08E.tmp 688 B0DC.tmp 1480 B14A.tmp 2884 B1A7.tmp 4624 B205.tmp 4972 B253.tmp 3596 B2C1.tmp 5060 B31E.tmp 2000 B36D.tmp 1204 B3CA.tmp 740 B418.tmp 556 B467.tmp 5104 B4C4.tmp 3660 B522.tmp 1740 B580.tmp 4316 B5FD.tmp 1452 B64B.tmp 3360 B6C8.tmp 4924 B716.tmp 2056 B764.tmp 3468 B7B2.tmp 3532 B800.tmp 4176 B84F.tmp 4196 B89D.tmp 1704 B8FA.tmp 2404 B958.tmp 4596 B9B6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 517.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E77D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 454C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD2.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 4156 1680 2026-08-04_6acc9014b96e6ca9853b36a48e216ed0_elex_mafia.exe 86 PID 4156 wrote to memory of 1448 4156 97C6.tmp 87 PID 1448 wrote to memory of 3212 1448 98C0.tmp 88 PID 3212 wrote to memory of 4976 3212 994D.tmp 89 PID 4976 wrote to memory of 4068 4976 9A57.tmp 90 PID 4068 wrote to memory of 3820 4068 9B31.tmp 91 PID 3820 wrote to memory of 3964 3820 9BAE.tmp 92 PID 3964 wrote to memory of 396 3964 9C7A.tmp 93 PID 396 wrote to memory of 5044 396 9D25.tmp 94 PID 5044 wrote to memory of 3756 5044 9DE1.tmp 95 PID 3756 wrote to memory of 3836 3756 9EBC.tmp 96 PID 3836 wrote to memory of 4260 3836 9F87.tmp 97 PID 4260 wrote to memory of 4024 4260 A052.tmp 98 PID 4024 wrote to memory of 5000 4024 A11D.tmp 99 PID 5000 wrote to memory of 1336 5000 A1C9.tmp 100 PID 1336 wrote to memory of 2152 1336 A256.tmp 101 PID 2152 wrote to memory of 3996 2152 A330.tmp 102 PID 3996 wrote to memory of 1580 3996 A3BD.tmp 103 PID 1580 wrote to memory of 508 1580 A488.tmp 104 PID 508 wrote to memory of 3196 508 A505.tmp 105 PID 3196 wrote to memory of 744 3196 A592.tmp 106 PID 744 wrote to memory of 1348 744 A62E.tmp 107 PID 1348 wrote to memory of 3892 1348 A6E9.tmp 108 PID 3892 wrote to memory of 2712 3892 A7A5.tmp 109 PID 2712 wrote to memory of 864 2712 A860.tmp 110 PID 864 wrote to memory of 3832 864 A93B.tmp 111 PID 3832 wrote to memory of 3352 3832 A9B8.tmp 112 PID 3352 wrote to memory of 2792 3352 AA74.tmp 113 PID 2792 wrote to memory of 896 2792 AB2F.tmp 114 PID 896 wrote to memory of 5040 896 AC0A.tmp 115 PID 5040 wrote to memory of 3312 5040 ACA6.tmp 116 PID 3312 wrote to memory of 3424 3312 AD52.tmp 117 PID 3424 wrote to memory of 532 3424 AE1D.tmp 118 PID 532 wrote to memory of 3116 532 AEB9.tmp 119 PID 3116 wrote to memory of 3084 3116 AF27.tmp 120 PID 3084 wrote to memory of 3448 3084 AF85.tmp 121 PID 3448 wrote to memory of 2496 3448 AFD3.tmp 122 PID 2496 wrote to memory of 2408 2496 B030.tmp 123 PID 2408 wrote to memory of 688 2408 B08E.tmp 124 PID 688 wrote to memory of 1480 688 B0DC.tmp 125 PID 1480 wrote to memory of 2884 1480 B14A.tmp 126 PID 2884 wrote to memory of 4624 2884 B1A7.tmp 127 PID 4624 wrote to memory of 4972 4624 B205.tmp 128 PID 4972 wrote to memory of 3596 4972 B253.tmp 129 PID 3596 wrote to memory of 5060 3596 B2C1.tmp 130 PID 5060 wrote to memory of 2000 5060 B31E.tmp 131 PID 2000 wrote to memory of 1204 2000 B36D.tmp 132 PID 1204 wrote to memory of 740 1204 B3CA.tmp 133 PID 740 wrote to memory of 556 740 B418.tmp 134 PID 556 wrote to memory of 5104 556 B467.tmp 135 PID 5104 wrote to memory of 3660 5104 B4C4.tmp 136 PID 3660 wrote to memory of 1740 3660 B522.tmp 137 PID 1740 wrote to memory of 4316 1740 B580.tmp 138 PID 4316 wrote to memory of 1452 4316 B5FD.tmp 139 PID 1452 wrote to memory of 3360 1452 B64B.tmp 140 PID 3360 wrote to memory of 4924 3360 B6C8.tmp 141 PID 4924 wrote to memory of 2056 4924 B716.tmp 142 PID 2056 wrote to memory of 3468 2056 B764.tmp 143 PID 3468 wrote to memory of 3532 3468 B7B2.tmp 144 PID 3532 wrote to memory of 4176 3532 B800.tmp 145 PID 4176 wrote to memory of 4196 4176 B84F.tmp 146 PID 4196 wrote to memory of 1704 4196 B89D.tmp 147 PID 1704 wrote to memory of 2404 1704 B8FA.tmp 148 PID 2404 wrote to memory of 4596 2404 B958.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_6acc9014b96e6ca9853b36a48e216ed0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6acc9014b96e6ca9853b36a48e216ed0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\994D.tmp"C:\Users\Admin\AppData\Local\Temp\994D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9B31.tmp"C:\Users\Admin\AppData\Local\Temp\9B31.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9D25.tmp"C:\Users\Admin\AppData\Local\Temp\9D25.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\9F87.tmp"C:\Users\Admin\AppData\Local\Temp\9F87.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\A11D.tmp"C:\Users\Admin\AppData\Local\Temp\A11D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\A488.tmp"C:\Users\Admin\AppData\Local\Temp\A488.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\AC0A.tmp"C:\Users\Admin\AppData\Local\Temp\AC0A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\AF27.tmp"C:\Users\Admin\AppData\Local\Temp\AF27.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\AF85.tmp"C:\Users\Admin\AppData\Local\Temp\AF85.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\B14A.tmp"C:\Users\Admin\AppData\Local\Temp\B14A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\B253.tmp"C:\Users\Admin\AppData\Local\Temp\B253.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\B3CA.tmp"C:\Users\Admin\AppData\Local\Temp\B3CA.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\B467.tmp"C:\Users\Admin\AppData\Local\Temp\B467.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\B522.tmp"C:\Users\Admin\AppData\Local\Temp\B522.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\B580.tmp"C:\Users\Admin\AppData\Local\Temp\B580.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\B64B.tmp"C:\Users\Admin\AppData\Local\Temp\B64B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\B800.tmp"C:\Users\Admin\AppData\Local\Temp\B800.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\B84F.tmp"C:\Users\Admin\AppData\Local\Temp\B84F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\B958.tmp"C:\Users\Admin\AppData\Local\Temp\B958.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"65⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\BA04.tmp"C:\Users\Admin\AppData\Local\Temp\BA04.tmp"66⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\BA62.tmp"C:\Users\Admin\AppData\Local\Temp\BA62.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"68⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"69⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"70⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"71⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"72⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"73⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"74⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"75⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"76⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\BE59.tmp"C:\Users\Admin\AppData\Local\Temp\BE59.tmp"77⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\BEA8.tmp"C:\Users\Admin\AppData\Local\Temp\BEA8.tmp"78⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\BF15.tmp"C:\Users\Admin\AppData\Local\Temp\BF15.tmp"79⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\BF63.tmp"C:\Users\Admin\AppData\Local\Temp\BF63.tmp"80⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"81⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\C00F.tmp"C:\Users\Admin\AppData\Local\Temp\C00F.tmp"82⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"83⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"84⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"85⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"86⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"87⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"88⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\C251.tmp"C:\Users\Admin\AppData\Local\Temp\C251.tmp"89⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"90⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\C31C.tmp"C:\Users\Admin\AppData\Local\Temp\C31C.tmp"91⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\C36A.tmp"C:\Users\Admin\AppData\Local\Temp\C36A.tmp"92⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\C3B8.tmp"C:\Users\Admin\AppData\Local\Temp\C3B8.tmp"93⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"94⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"95⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"96⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\C501.tmp"C:\Users\Admin\AppData\Local\Temp\C501.tmp"97⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C54F.tmp"C:\Users\Admin\AppData\Local\Temp\C54F.tmp"98⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"99⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"100⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\C658.tmp"C:\Users\Admin\AppData\Local\Temp\C658.tmp"101⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"102⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"103⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\C781.tmp"C:\Users\Admin\AppData\Local\Temp\C781.tmp"104⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"105⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"106⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"107⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"108⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\C917.tmp"C:\Users\Admin\AppData\Local\Temp\C917.tmp"109⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"110⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"111⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"112⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"113⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"114⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"115⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"116⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"117⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"118⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"119⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"120⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"121⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"122⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-