Analysis
- max time kernel
119s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_8cec2546159fefa96bbb0b0ad99de046_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_8cec2546159fefa96bbb0b0ad99de046_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-11_8cec2546159fefa96bbb0b0ad99de046_elex_mafia.exe
- Size 560KB
- Sample260811-dadjgstfrb
- SHA256 7417c3ea6083d32eb1be7f04bba883a3d097ab14022fa2fd737c8fb2d6d48622
- MD5 8cec2546159fefa96bbb0b0ad99de046
- SHA1 f52c1196ac8f2f9986832ec50a6af452a252d9f0
- SHA512 0f592c0588fc9a1aee70009ade9c6a661fd3a03198c83a1e7a4d38ab2cc4b321b4f2144552e6c0bc4b4d7bf83b5fa36110de3103d2105901c1c5d6ccebeb2f47
- SSDEEP 12288:MlFXOQUDmrC8SBfWKbVBFSEuxxkGpf5J0/FHhMWIZxV:MlUQbC8SlxbFex/5J0/FHFIR
- TLSH T11DC4F1137688C073E6C211310A52DBA61B3F7C755B2AA5C73B94266EAEB43D0DB3534B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 964 895A.tmp 5100 8B4E.tmp 2332 8BDB.tmp 5104 8D61.tmp 4572 8E4C.tmp 1616 8F55.tmp 4620 909E.tmp 548 91B7.tmp 4192 930F.tmp 1204 9437.tmp 2124 9522.tmp 2660 962B.tmp 4984 9725.tmp 4792 983F.tmp 2552 9958.tmp 972 9A42.tmp 5432 9B6B.tmp 5756 9C84.tmp 4800 9D8E.tmp 2656 9EA7.tmp 2296 9FC1.tmp 2716 A109.tmp 4796 A212.tmp 1332 A32C.tmp 4968 A426.tmp 3408 A56E.tmp 4840 A668.tmp 2980 A771.tmp 5580 A908.tmp 4648 AA40.tmp 3368 AB3A.tmp 4428 AC24.tmp 3904 AD3E.tmp 1304 AE28.tmp 3160 AEE4.tmp 1804 AF9F.tmp 5744 B099.tmp 2340 B1A3.tmp 5016 B27D.tmp 2336 B349.tmp 2624 B3E5.tmp 5680 B4C0.tmp 5540 B5D9.tmp 5952 B6B4.tmp 4252 B75F.tmp 2416 B80B.tmp 4576 B8F6.tmp 3124 B9C1.tmp 4216 BA7C.tmp 4700 BB09.tmp 3376 BBA5.tmp 5180 BC32.tmp 5908 BCBE.tmp 2368 BD6A.tmp 3832 BDF7.tmp 3488 BE84.tmp 1856 BF20.tmp 4176 BFBC.tmp 3320 C049.tmp 5768 C0E5.tmp 3384 C162.tmp 5956 C1DF.tmp 788 C26C.tmp 2436 C2E9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A32C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D88F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 215F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4552.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 364F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 187B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 470D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C96C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E262.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A74D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 964 2872 2026-08-11_8cec2546159fefa96bbb0b0ad99de046_elex_mafia.exe 89 PID 964 wrote to memory of 5100 964 895A.tmp 90 PID 5100 wrote to memory of 2332 5100 8B4E.tmp 91 PID 2332 wrote to memory of 5104 2332 8BDB.tmp 92 PID 5104 wrote to memory of 4572 5104 8D61.tmp 93 PID 4572 wrote to memory of 1616 4572 8E4C.tmp 94 PID 1616 wrote to memory of 4620 1616 8F55.tmp 95 PID 4620 wrote to memory of 548 4620 909E.tmp 96 PID 548 wrote to memory of 4192 548 91B7.tmp 97 PID 4192 wrote to memory of 1204 4192 930F.tmp 98 PID 1204 wrote to memory of 2124 1204 9437.tmp 99 PID 2124 wrote to memory of 2660 2124 9522.tmp 100 PID 2660 wrote to memory of 4984 2660 962B.tmp 101 PID 4984 wrote to memory of 4792 4984 9725.tmp 102 PID 4792 wrote to memory of 2552 4792 983F.tmp 103 PID 2552 wrote to memory of 972 2552 9958.tmp 104 PID 972 wrote to memory of 5432 972 9A42.tmp 105 PID 5432 wrote to memory of 5756 5432 9B6B.tmp 106 PID 5756 wrote to memory of 4800 5756 9C84.tmp 107 PID 4800 wrote to memory of 2656 4800 9D8E.tmp 108 PID 2656 wrote to memory of 2296 2656 9EA7.tmp 109 PID 2296 wrote to memory of 2716 2296 9FC1.tmp 110 PID 2716 wrote to memory of 4796 2716 A109.tmp 111 PID 4796 wrote to memory of 1332 4796 A212.tmp 112 PID 1332 wrote to memory of 4968 1332 A32C.tmp 113 PID 4968 wrote to memory of 3408 4968 A426.tmp 114 PID 3408 wrote to memory of 4840 3408 A56E.tmp 115 PID 4840 wrote to memory of 2980 4840 A668.tmp 116 PID 2980 wrote to memory of 5580 2980 A771.tmp 117 PID 5580 wrote to memory of 4648 5580 A908.tmp 118 PID 4648 wrote to memory of 3368 4648 AA40.tmp 119 PID 3368 wrote to memory of 4428 3368 AB3A.tmp 120 PID 4428 wrote to memory of 3904 4428 AC24.tmp 121 PID 3904 wrote to memory of 1304 3904 AD3E.tmp 122 PID 1304 wrote to memory of 3160 1304 AE28.tmp 123 PID 3160 wrote to memory of 1804 3160 AEE4.tmp 124 PID 1804 wrote to memory of 5744 1804 AF9F.tmp 125 PID 5744 wrote to memory of 2340 5744 B099.tmp 126 PID 2340 wrote to memory of 5016 2340 B1A3.tmp 127 PID 5016 wrote to memory of 2336 5016 B27D.tmp 128 PID 2336 wrote to memory of 2624 2336 B349.tmp 129 PID 2624 wrote to memory of 5680 2624 B3E5.tmp 130 PID 5680 wrote to memory of 5540 5680 B4C0.tmp 131 PID 5540 wrote to memory of 5952 5540 B5D9.tmp 132 PID 5952 wrote to memory of 4252 5952 B6B4.tmp 133 PID 4252 wrote to memory of 2416 4252 B75F.tmp 134 PID 2416 wrote to memory of 4576 2416 B80B.tmp 135 PID 4576 wrote to memory of 3124 4576 B8F6.tmp 136 PID 3124 wrote to memory of 4216 3124 B9C1.tmp 137 PID 4216 wrote to memory of 4700 4216 BA7C.tmp 138 PID 4700 wrote to memory of 3376 4700 BB09.tmp 139 PID 3376 wrote to memory of 5180 3376 BBA5.tmp 140 PID 5180 wrote to memory of 5908 5180 BC32.tmp 141 PID 5908 wrote to memory of 2368 5908 BCBE.tmp 142 PID 2368 wrote to memory of 3832 2368 BD6A.tmp 143 PID 3832 wrote to memory of 3488 3832 BDF7.tmp 144 PID 3488 wrote to memory of 1856 3488 BE84.tmp 145 PID 1856 wrote to memory of 4176 1856 BF20.tmp 146 PID 4176 wrote to memory of 3320 4176 BFBC.tmp 147 PID 3320 wrote to memory of 5768 3320 C049.tmp 148 PID 5768 wrote to memory of 3384 5768 C0E5.tmp 149 PID 3384 wrote to memory of 5956 3384 C162.tmp 150 PID 5956 wrote to memory of 788 5956 C1DF.tmp 151 PID 788 wrote to memory of 2436 788 C26C.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_8cec2546159fefa96bbb0b0ad99de046_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8cec2546159fefa96bbb0b0ad99de046_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9958.tmp"C:\Users\Admin\AppData\Local\Temp\9958.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\9C84.tmp"C:\Users\Admin\AppData\Local\Temp\9C84.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\A212.tmp"C:\Users\Admin\AppData\Local\Temp\A212.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\A426.tmp"C:\Users\Admin\AppData\Local\Temp\A426.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A771.tmp"C:\Users\Admin\AppData\Local\Temp\A771.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\A908.tmp"C:\Users\Admin\AppData\Local\Temp\A908.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\AA40.tmp"C:\Users\Admin\AppData\Local\Temp\AA40.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B099.tmp"C:\Users\Admin\AppData\Local\Temp\B099.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\BB09.tmp"C:\Users\Admin\AppData\Local\Temp\BB09.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"C:\Users\Admin\AppData\Local\Temp\BCBE.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\BF20.tmp"C:\Users\Admin\AppData\Local\Temp\BF20.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"C:\Users\Admin\AppData\Local\Temp\C0E5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\C162.tmp"C:\Users\Admin\AppData\Local\Temp\C162.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\C26C.tmp"C:\Users\Admin\AppData\Local\Temp\C26C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"65⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"66⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"67⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"C:\Users\Admin\AppData\Local\Temp\C4BD.tmp"68⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"70⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\C644.tmp"C:\Users\Admin\AppData\Local\Temp\C644.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"72⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"73⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"74⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"75⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C942.tmp"C:\Users\Admin\AppData\Local\Temp\C942.tmp"76⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"78⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"79⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"80⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\CC5E.tmp"C:\Users\Admin\AppData\Local\Temp\CC5E.tmp"81⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"82⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"83⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"84⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"85⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"86⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"87⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"88⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"90⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"91⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"92⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"93⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"94⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"95⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"96⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"97⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"98⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"99⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"100⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"101⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"102⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"103⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"104⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"105⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"107⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\DB62.tmp"C:\Users\Admin\AppData\Local\Temp\DB62.tmp"108⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"109⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"110⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\DD18.tmp"C:\Users\Admin\AppData\Local\Temp\DD18.tmp"111⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"112⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"113⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"114⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"115⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"116⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"117⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"118⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"119⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"120⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"121⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"122⤵PID:4604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-