Analysis
- max time kernel
60s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_9cf1a56d658138e03fbd2babf6013746_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_9cf1a56d658138e03fbd2babf6013746_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-12_9cf1a56d658138e03fbd2babf6013746_elex_mafia.exe
- Size 816KB
- Sample260813-avk8aafh53
- SHA256 03e522af7e7325f7f790aa10721f4eb0d9b1d2a302724b592c18e23cbc56229d
- MD5 9cf1a56d658138e03fbd2babf6013746
- SHA1 4e6a6cba7a47f7dc1874a7f8758d8727d786fb51
- SHA512 1984ce9ffc39939305afe6813fac84b5f63f73077a82f58f100616a382565d42137c4ee82685e291515b77d2aa8d9437d48ba98d3a4cdcfabcedf5100fedae95
- SSDEEP 12288:+mF/W8Dsy3/sAsnpK7C8rUe+wG7Qw2e4AWc6LTHqfuPk/13Z:+m0833JWK7C8rn+3QVAWc63Y/13
- TLSH T1BF05F121B684C131E59701344E6AEFA2093A7D355B37A4CB6B9026BE7FB13D2DA35307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2872 DB33.tmp 4436 DCCA.tmp 3464 DDB4.tmp 3524 DECD.tmp 5932 DFA8.tmp 4816 E0D1.tmp 4624 E1BB.tmp 2548 E296.tmp 4344 E371.tmp 4780 E46B.tmp 1332 E526.tmp 1048 E601.tmp 2908 E6DC.tmp 5360 E7A7.tmp 5848 E853.tmp 3892 E93D.tmp 3984 EA37.tmp 3816 EB12.tmp 2100 EC0C.tmp 1584 ECE7.tmp 992 EDA2.tmp 4032 EE8C.tmp 6040 EF48.tmp 2364 F023.tmp 3216 F12C.tmp 900 F1D8.tmp 3580 F2C3.tmp 1924 F3BD.tmp 4160 F4D6.tmp 2484 F5A1.tmp 2344 F6D9.tmp 5756 F7A5.tmp 1008 F8CD.tmp 5656 F999.tmp 3004 FA44.tmp 2700 FAF0.tmp 3284 FB7D.tmp 4308 FC29.tmp 2144 FCF4.tmp 1280 FD71.tmp 4812 FE1D.tmp 3896 FED8.tmp 3900 FFA3.tmp 3204 40.tmp 2808 CC.tmp 1364 149.tmp 1428 1C6.tmp 2384 272.tmp 3240 30E.tmp 2600 3AB.tmp 684 437.tmp 3960 4D4.tmp 1776 560.tmp 996 5DD.tmp 3448 65A.tmp 3744 706.tmp 3564 7A2.tmp 2704 85E.tmp 4500 919.tmp 2524 9B6.tmp 4164 A42.tmp 2936 B0D.tmp 5780 BAA.tmp 3884 C65.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5787.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 590E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 784E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 984A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 185C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 929C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 134B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ADE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 2872 1324 2026-08-12_9cf1a56d658138e03fbd2babf6013746_elex_mafia.exe 88 PID 2872 wrote to memory of 4436 2872 DB33.tmp 89 PID 4436 wrote to memory of 3464 4436 DCCA.tmp 90 PID 3464 wrote to memory of 3524 3464 DDB4.tmp 91 PID 3524 wrote to memory of 5932 3524 DECD.tmp 92 PID 5932 wrote to memory of 4816 5932 DFA8.tmp 93 PID 4816 wrote to memory of 4624 4816 E0D1.tmp 94 PID 4624 wrote to memory of 2548 4624 E1BB.tmp 95 PID 2548 wrote to memory of 4344 2548 E296.tmp 96 PID 4344 wrote to memory of 4780 4344 E371.tmp 97 PID 4780 wrote to memory of 1332 4780 E46B.tmp 98 PID 1332 wrote to memory of 1048 1332 E526.tmp 99 PID 1048 wrote to memory of 2908 1048 E601.tmp 100 PID 2908 wrote to memory of 5360 2908 E6DC.tmp 101 PID 5360 wrote to memory of 5848 5360 E7A7.tmp 102 PID 5848 wrote to memory of 3892 5848 E853.tmp 103 PID 3892 wrote to memory of 3984 3892 E93D.tmp 104 PID 3984 wrote to memory of 3816 3984 EA37.tmp 105 PID 3816 wrote to memory of 2100 3816 EB12.tmp 106 PID 2100 wrote to memory of 1584 2100 EC0C.tmp 107 PID 1584 wrote to memory of 992 1584 ECE7.tmp 108 PID 992 wrote to memory of 4032 992 EDA2.tmp 109 PID 4032 wrote to memory of 6040 4032 EE8C.tmp 110 PID 6040 wrote to memory of 2364 6040 EF48.tmp 111 PID 2364 wrote to memory of 3216 2364 F023.tmp 112 PID 3216 wrote to memory of 900 3216 F12C.tmp 113 PID 900 wrote to memory of 3580 900 F1D8.tmp 114 PID 3580 wrote to memory of 1924 3580 F2C3.tmp 115 PID 1924 wrote to memory of 4160 1924 F3BD.tmp 116 PID 4160 wrote to memory of 2484 4160 F4D6.tmp 117 PID 2484 wrote to memory of 2344 2484 F5A1.tmp 118 PID 2344 wrote to memory of 5756 2344 F6D9.tmp 119 PID 5756 wrote to memory of 1008 5756 F7A5.tmp 120 PID 1008 wrote to memory of 5656 1008 F8CD.tmp 121 PID 5656 wrote to memory of 3004 5656 F999.tmp 122 PID 3004 wrote to memory of 2700 3004 FA44.tmp 123 PID 2700 wrote to memory of 3284 2700 FAF0.tmp 124 PID 3284 wrote to memory of 4308 3284 FB7D.tmp 125 PID 4308 wrote to memory of 2144 4308 FC29.tmp 126 PID 2144 wrote to memory of 1280 2144 FCF4.tmp 127 PID 1280 wrote to memory of 4812 1280 FD71.tmp 128 PID 4812 wrote to memory of 3896 4812 FE1D.tmp 129 PID 3896 wrote to memory of 3900 3896 FED8.tmp 130 PID 3900 wrote to memory of 3204 3900 FFA3.tmp 131 PID 3204 wrote to memory of 2808 3204 40.tmp 132 PID 2808 wrote to memory of 1364 2808 CC.tmp 133 PID 1364 wrote to memory of 1428 1364 149.tmp 134 PID 1428 wrote to memory of 2384 1428 1C6.tmp 135 PID 2384 wrote to memory of 3240 2384 272.tmp 136 PID 3240 wrote to memory of 2600 3240 30E.tmp 137 PID 2600 wrote to memory of 684 2600 3AB.tmp 138 PID 684 wrote to memory of 3960 684 437.tmp 139 PID 3960 wrote to memory of 1776 3960 4D4.tmp 140 PID 1776 wrote to memory of 996 1776 560.tmp 141 PID 996 wrote to memory of 3448 996 5DD.tmp 142 PID 3448 wrote to memory of 3744 3448 65A.tmp 143 PID 3744 wrote to memory of 3564 3744 706.tmp 144 PID 3564 wrote to memory of 2704 3564 7A2.tmp 145 PID 2704 wrote to memory of 4500 2704 85E.tmp 146 PID 4500 wrote to memory of 2524 4500 919.tmp 147 PID 2524 wrote to memory of 4164 2524 9B6.tmp 148 PID 4164 wrote to memory of 2936 4164 A42.tmp 149 PID 2936 wrote to memory of 5780 2936 B0D.tmp 150 PID 5780 wrote to memory of 3884 5780 BAA.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_9cf1a56d658138e03fbd2babf6013746_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_9cf1a56d658138e03fbd2babf6013746_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\DB33.tmp"C:\Users\Admin\AppData\Local\Temp\DB33.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\E853.tmp"C:\Users\Admin\AppData\Local\Temp\E853.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\EA37.tmp"C:\Users\Admin\AppData\Local\Temp\EA37.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\F12C.tmp"C:\Users\Admin\AppData\Local\Temp\F12C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\FC29.tmp"C:\Users\Admin\AppData\Local\Temp\FC29.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1C6.tmp"C:\Users\Admin\AppData\Local\Temp\1C6.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\560.tmp"C:\Users\Admin\AppData\Local\Temp\560.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5DD.tmp"C:\Users\Admin\AppData\Local\Temp\5DD.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\919.tmp"C:\Users\Admin\AppData\Local\Temp\919.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9B6.tmp"C:\Users\Admin\AppData\Local\Temp\9B6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"65⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"67⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"68⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\FB1.tmp"C:\Users\Admin\AppData\Local\Temp\FB1.tmp"70⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"71⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:936 -
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"73⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"74⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\134B.tmp"C:\Users\Admin\AppData\Local\Temp\134B.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"76⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"78⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"79⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"80⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"81⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\17B0.tmp"C:\Users\Admin\AppData\Local\Temp\17B0.tmp"82⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\185C.tmp"C:\Users\Admin\AppData\Local\Temp\185C.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1984.tmp"C:\Users\Admin\AppData\Local\Temp\1984.tmp"85⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"86⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"87⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"88⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"90⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"91⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"92⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"93⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\1F8F.tmp"C:\Users\Admin\AppData\Local\Temp\1F8F.tmp"94⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\204B.tmp"C:\Users\Admin\AppData\Local\Temp\204B.tmp"95⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"96⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"97⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2220.tmp"C:\Users\Admin\AppData\Local\Temp\2220.tmp"98⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"99⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"100⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2442.tmp"C:\Users\Admin\AppData\Local\Temp\2442.tmp"101⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"102⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\26F2.tmp"C:\Users\Admin\AppData\Local\Temp\26F2.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\279E.tmp"C:\Users\Admin\AppData\Local\Temp\279E.tmp"106⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"107⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"108⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\2973.tmp"C:\Users\Admin\AppData\Local\Temp\2973.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"110⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\2B28.tmp"C:\Users\Admin\AppData\Local\Temp\2B28.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"113⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"114⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"115⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"116⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2E83.tmp"C:\Users\Admin\AppData\Local\Temp\2E83.tmp"117⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2F00.tmp"C:\Users\Admin\AppData\Local\Temp\2F00.tmp"118⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2FAC.tmp"C:\Users\Admin\AppData\Local\Temp\2FAC.tmp"119⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\3077.tmp"C:\Users\Admin\AppData\Local\Temp\3077.tmp"120⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"121⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-