Analysis
- max time kernel
118s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe
- Size 520KB
- Sample260806-fsbtqadq21
- SHA256 32c539a7d3ea3f7718736012999cf8bae7f39c5b74129643e7488a93dab133b8
- MD5 cf818d4bcb4d881bc00a1f96d338fc5b
- SHA1 f7024ec5afd033635642feaf844aff62324928da
- SHA512 8a1c97e942c72e4b531ba8fa38912fc165b8cde4afac57322198334334ad56e52afcf0455d205ac0c08b05d467e9aec957ad7b7ae5ab0306b04f5b1ff0ca0376
- SSDEEP 12288:gj8fuxR21t5i8faoywm/sy6xjPMZ2hsI57z6whCmAqcMjDNZ:gj8fuK1GYaoO/syWgkvz6w2MjDN
- TLSH T186B4F111B589C033E59215351A62CBA21BBE7D759B3595C33BC03A7D6FB92C1EA3830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3996 DFB8.tmp 4348 E092.tmp 3976 E100.tmp 3760 E1BB.tmp 3984 E277.tmp 1620 E361.tmp 4636 E507.tmp 4296 E5C2.tmp 5504 E67E.tmp 4980 E768.tmp 6120 E824.tmp 1260 E90E.tmp 4160 E9E9.tmp 2232 EAB4.tmp 5256 EB70.tmp 6064 EC4A.tmp 6004 ECE7.tmp 3164 ED83.tmp 1452 EE0F.tmp 3924 EEDB.tmp 2344 EF67.tmp 5972 EFF4.tmp 1704 F0BF.tmp 2192 F12C.tmp 5844 F1E8.tmp 4696 F2A3.tmp 3824 F35F.tmp 3416 F42A.tmp 5068 F4F5.tmp 5108 F572.tmp 5320 F65C.tmp 5432 F718.tmp 1988 F7F3.tmp 1672 F87F.tmp 3936 F90C.tmp 2600 F989.tmp 4148 FA06.tmp 1292 FA83.tmp 2544 FB00.tmp 2416 FBAC.tmp 6008 FC48.tmp 3460 FCB5.tmp 3060 FD42.tmp 5732 FDBF.tmp 464 FE4C.tmp 4904 FEE8.tmp 3940 FF55.tmp 4076 FFE2.tmp 3960 4F.tmp 2836 CC.tmp 468 159.tmp 2516 1E6.tmp 1488 253.tmp 4128 2FF.tmp 5060 39B.tmp 4100 418.tmp 984 495.tmp 4932 502.tmp 3040 57F.tmp 6080 61C.tmp 4432 699.tmp 6108 716.tmp 700 7A2.tmp 5720 81F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F12C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 121D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 664D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 185C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 633F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80F9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 3996 4584 2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe 88 PID 3996 wrote to memory of 4348 3996 DFB8.tmp 89 PID 4348 wrote to memory of 3976 4348 E092.tmp 90 PID 3976 wrote to memory of 3760 3976 E100.tmp 91 PID 3760 wrote to memory of 3984 3760 E1BB.tmp 92 PID 3984 wrote to memory of 1620 3984 E277.tmp 93 PID 1620 wrote to memory of 4636 1620 E361.tmp 94 PID 4636 wrote to memory of 4296 4636 E507.tmp 95 PID 4296 wrote to memory of 5504 4296 E5C2.tmp 96 PID 5504 wrote to memory of 4980 5504 E67E.tmp 97 PID 4980 wrote to memory of 6120 4980 E768.tmp 98 PID 6120 wrote to memory of 1260 6120 E824.tmp 99 PID 1260 wrote to memory of 4160 1260 E90E.tmp 100 PID 4160 wrote to memory of 2232 4160 E9E9.tmp 101 PID 2232 wrote to memory of 5256 2232 EAB4.tmp 102 PID 5256 wrote to memory of 6064 5256 EB70.tmp 103 PID 6064 wrote to memory of 6004 6064 EC4A.tmp 104 PID 6004 wrote to memory of 3164 6004 ECE7.tmp 105 PID 3164 wrote to memory of 1452 3164 ED83.tmp 106 PID 1452 wrote to memory of 3924 1452 EE0F.tmp 107 PID 3924 wrote to memory of 2344 3924 EEDB.tmp 108 PID 2344 wrote to memory of 5972 2344 EF67.tmp 109 PID 5972 wrote to memory of 1704 5972 EFF4.tmp 110 PID 1704 wrote to memory of 2192 1704 F0BF.tmp 111 PID 2192 wrote to memory of 5844 2192 F12C.tmp 112 PID 5844 wrote to memory of 4696 5844 F1E8.tmp 113 PID 4696 wrote to memory of 3824 4696 F2A3.tmp 114 PID 3824 wrote to memory of 3416 3824 F35F.tmp 115 PID 3416 wrote to memory of 5068 3416 F42A.tmp 116 PID 5068 wrote to memory of 5108 5068 F4F5.tmp 117 PID 5108 wrote to memory of 5320 5108 F572.tmp 118 PID 5320 wrote to memory of 5432 5320 F65C.tmp 119 PID 5432 wrote to memory of 1988 5432 F718.tmp 120 PID 1988 wrote to memory of 1672 1988 F7F3.tmp 121 PID 1672 wrote to memory of 3936 1672 F87F.tmp 122 PID 3936 wrote to memory of 2600 3936 F90C.tmp 123 PID 2600 wrote to memory of 4148 2600 F989.tmp 124 PID 4148 wrote to memory of 1292 4148 FA06.tmp 125 PID 1292 wrote to memory of 2544 1292 FA83.tmp 126 PID 2544 wrote to memory of 2416 2544 FB00.tmp 127 PID 2416 wrote to memory of 6008 2416 FBAC.tmp 128 PID 6008 wrote to memory of 3460 6008 FC48.tmp 129 PID 3460 wrote to memory of 3060 3460 FCB5.tmp 130 PID 3060 wrote to memory of 5732 3060 FD42.tmp 131 PID 5732 wrote to memory of 464 5732 FDBF.tmp 132 PID 464 wrote to memory of 4904 464 FE4C.tmp 133 PID 4904 wrote to memory of 3940 4904 FEE8.tmp 134 PID 3940 wrote to memory of 4076 3940 FF55.tmp 135 PID 4076 wrote to memory of 3960 4076 FFE2.tmp 136 PID 3960 wrote to memory of 2836 3960 4F.tmp 137 PID 2836 wrote to memory of 468 2836 CC.tmp 138 PID 468 wrote to memory of 2516 468 159.tmp 139 PID 2516 wrote to memory of 1488 2516 1E6.tmp 140 PID 1488 wrote to memory of 4128 1488 253.tmp 141 PID 4128 wrote to memory of 5060 4128 2FF.tmp 142 PID 5060 wrote to memory of 4100 5060 39B.tmp 143 PID 4100 wrote to memory of 984 4100 418.tmp 144 PID 984 wrote to memory of 4932 984 495.tmp 145 PID 4932 wrote to memory of 3040 4932 502.tmp 146 PID 3040 wrote to memory of 6080 3040 57F.tmp 147 PID 6080 wrote to memory of 4432 6080 61C.tmp 148 PID 4432 wrote to memory of 6108 4432 699.tmp 149 PID 6108 wrote to memory of 700 6108 716.tmp 150 PID 700 wrote to memory of 5720 700 7A2.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_cf818d4bcb4d881bc00a1f96d338fc5b_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\E361.tmp"C:\Users\Admin\AppData\Local\Temp\E361.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\E768.tmp"C:\Users\Admin\AppData\Local\Temp\E768.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\E824.tmp"C:\Users\Admin\AppData\Local\Temp\E824.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\E90E.tmp"C:\Users\Admin\AppData\Local\Temp\E90E.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\EF67.tmp"C:\Users\Admin\AppData\Local\Temp\EF67.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\F12C.tmp"C:\Users\Admin\AppData\Local\Temp\F12C.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\F42A.tmp"C:\Users\Admin\AppData\Local\Temp\F42A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\F90C.tmp"C:\Users\Admin\AppData\Local\Temp\F90C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F989.tmp"C:\Users\Admin\AppData\Local\Temp\F989.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\FB00.tmp"C:\Users\Admin\AppData\Local\Temp\FB00.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\253.tmp"C:\Users\Admin\AppData\Local\Temp\253.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\39B.tmp"C:\Users\Admin\AppData\Local\Temp\39B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\495.tmp"C:\Users\Admin\AppData\Local\Temp\495.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\716.tmp"C:\Users\Admin\AppData\Local\Temp\716.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"65⤵
- Executes dropped EXE
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\8AC.tmp"C:\Users\Admin\AppData\Local\Temp\8AC.tmp"66⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"67⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"68⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"69⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"70⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"71⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"72⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"73⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"74⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\D4F.tmp"C:\Users\Admin\AppData\Local\Temp\D4F.tmp"75⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"76⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\E88.tmp"C:\Users\Admin\AppData\Local\Temp\E88.tmp"77⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"78⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\F92.tmp"C:\Users\Admin\AppData\Local\Temp\F92.tmp"79⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"80⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1118.tmp"C:\Users\Admin\AppData\Local\Temp\1118.tmp"82⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"83⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"84⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\129F.tmp"C:\Users\Admin\AppData\Local\Temp\129F.tmp"85⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\130C.tmp"C:\Users\Admin\AppData\Local\Temp\130C.tmp"86⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\137A.tmp"C:\Users\Admin\AppData\Local\Temp\137A.tmp"87⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"88⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\1474.tmp"C:\Users\Admin\AppData\Local\Temp\1474.tmp"89⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\1500.tmp"C:\Users\Admin\AppData\Local\Temp\1500.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\158D.tmp"C:\Users\Admin\AppData\Local\Temp\158D.tmp"91⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"92⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\16A6.tmp"C:\Users\Admin\AppData\Local\Temp\16A6.tmp"93⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"94⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"95⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\185C.tmp"C:\Users\Admin\AppData\Local\Temp\185C.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"97⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\1946.tmp"C:\Users\Admin\AppData\Local\Temp\1946.tmp"98⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"99⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"100⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"101⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"102⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"103⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\1C05.tmp"C:\Users\Admin\AppData\Local\Temp\1C05.tmp"104⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\1C92.tmp"C:\Users\Admin\AppData\Local\Temp\1C92.tmp"105⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"106⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"107⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"108⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"109⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"111⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"112⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\207A.tmp"C:\Users\Admin\AppData\Local\Temp\207A.tmp"113⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\2164.tmp"C:\Users\Admin\AppData\Local\Temp\2164.tmp"115⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\21E1.tmp"C:\Users\Admin\AppData\Local\Temp\21E1.tmp"116⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\22DB.tmp"C:\Users\Admin\AppData\Local\Temp\22DB.tmp"118⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\2358.tmp"C:\Users\Admin\AppData\Local\Temp\2358.tmp"119⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\23C5.tmp"C:\Users\Admin\AppData\Local\Temp\23C5.tmp"120⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"121⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"122⤵PID:3716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-