Analysis
- max time kernel
124s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_f88f9d97dbb822a101fb70de29ab8d82_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_f88f9d97dbb822a101fb70de29ab8d82_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_f88f9d97dbb822a101fb70de29ab8d82_elex_mafia.exe
- Size 520KB
- Sample260819-ea4aksxydx
- SHA256 f957306d70af291d4a03bb663733ef9999f24e0c50f658218a068371fe947dbd
- MD5 f88f9d97dbb822a101fb70de29ab8d82
- SHA1 d8a04dabaadc0a19dff97744a2eddb4c627ec372
- SHA512 678bfc06797504d02b2c3fb20331e65383ef2bc3b575a6642772544dd6e1cbd19e371faf73f2453d055f92d9dbee6ad746e5334683905775614a8270db896eae
- SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbLlHgOEPzlKQzSwNSaSkpympVTZbWltJ0h:gj8fuxR21t5i8fAGTKQ7vS6r6lzBNZ6
- TLSH T11EB4F1127645C033E59215314B65DBA14BBEBC744B2695C73BC03ABEAFB52D1E63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4440 C81D.tmp 3148 C8BA.tmp 3512 C966.tmp 1632 CA21.tmp 4288 CAEC.tmp 4656 CB69.tmp 4532 CC25.tmp 4348 CCB1.tmp 1904 CD3E.tmp 1672 CDDA.tmp 3836 CE86.tmp 4520 CF51.tmp 1916 CFED.tmp 2932 D0A9.tmp 5184 D145.tmp 2748 D1E1.tmp 5684 D26E.tmp 248 D2EB.tmp 4216 D3B6.tmp 4640 D491.tmp 1732 D55C.tmp 4064 D5E9.tmp 1460 D6B4.tmp 1372 D750.tmp 5728 D81B.tmp 3380 D8D7.tmp 1260 D9D1.tmp 5204 DA6D.tmp 1048 DB28.tmp 4124 DBE4.tmp 4836 DC90.tmp 5468 DD5B.tmp 4816 DDE8.tmp 3852 DE74.tmp 6120 DEF1.tmp 1752 DF7E.tmp 3260 DFEB.tmp 3020 E068.tmp 1956 E0F5.tmp 1376 E172.tmp 5900 E1DF.tmp 1036 E26C.tmp 4940 E2F8.tmp 2444 E366.tmp 2468 E3E3.tmp 1620 E450.tmp 3376 E4EC.tmp 2788 E569.tmp 3304 E5E6.tmp 3600 E683.tmp 2864 E70F.tmp 4804 E78C.tmp 1880 E809.tmp 5588 E8A6.tmp 2220 E932.tmp 2544 E9BF.tmp 4364 EA6B.tmp 5040 EB26.tmp 2876 EBD2.tmp 2072 EC4F.tmp 1284 ECEB.tmp 3220 ED88.tmp 4428 EE14.tmp 2616 EE91.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4666.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 758F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 231E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 851F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C966.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F529.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 571A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A133.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3316 wrote to memory of 4440 3316 2026-08-19_f88f9d97dbb822a101fb70de29ab8d82_elex_mafia.exe 89 PID 4440 wrote to memory of 3148 4440 C81D.tmp 90 PID 3148 wrote to memory of 3512 3148 C8BA.tmp 91 PID 3512 wrote to memory of 1632 3512 C966.tmp 92 PID 1632 wrote to memory of 4288 1632 CA21.tmp 93 PID 4288 wrote to memory of 4656 4288 CAEC.tmp 94 PID 4656 wrote to memory of 4532 4656 CB69.tmp 95 PID 4532 wrote to memory of 4348 4532 CC25.tmp 96 PID 4348 wrote to memory of 1904 4348 CCB1.tmp 97 PID 1904 wrote to memory of 1672 1904 CD3E.tmp 98 PID 1672 wrote to memory of 3836 1672 CDDA.tmp 99 PID 3836 wrote to memory of 4520 3836 CE86.tmp 100 PID 4520 wrote to memory of 1916 4520 CF51.tmp 101 PID 1916 wrote to memory of 2932 1916 CFED.tmp 102 PID 2932 wrote to memory of 5184 2932 D0A9.tmp 103 PID 5184 wrote to memory of 2748 5184 D145.tmp 104 PID 2748 wrote to memory of 5684 2748 D1E1.tmp 105 PID 5684 wrote to memory of 248 5684 D26E.tmp 106 PID 248 wrote to memory of 4216 248 D2EB.tmp 107 PID 4216 wrote to memory of 4640 4216 D3B6.tmp 108 PID 4640 wrote to memory of 1732 4640 D491.tmp 109 PID 1732 wrote to memory of 4064 1732 D55C.tmp 110 PID 4064 wrote to memory of 1460 4064 D5E9.tmp 111 PID 1460 wrote to memory of 1372 1460 D6B4.tmp 112 PID 1372 wrote to memory of 5728 1372 D750.tmp 113 PID 5728 wrote to memory of 3380 5728 D81B.tmp 114 PID 3380 wrote to memory of 1260 3380 D8D7.tmp 115 PID 1260 wrote to memory of 5204 1260 D9D1.tmp 116 PID 5204 wrote to memory of 1048 5204 DA6D.tmp 117 PID 1048 wrote to memory of 4124 1048 DB28.tmp 118 PID 4124 wrote to memory of 4836 4124 DBE4.tmp 119 PID 4836 wrote to memory of 5468 4836 DC90.tmp 120 PID 5468 wrote to memory of 4816 5468 DD5B.tmp 121 PID 4816 wrote to memory of 3852 4816 DDE8.tmp 122 PID 3852 wrote to memory of 6120 3852 DE74.tmp 123 PID 6120 wrote to memory of 1752 6120 DEF1.tmp 124 PID 1752 wrote to memory of 3260 1752 DF7E.tmp 125 PID 3260 wrote to memory of 3020 3260 DFEB.tmp 126 PID 3020 wrote to memory of 1956 3020 E068.tmp 127 PID 1956 wrote to memory of 1376 1956 E0F5.tmp 128 PID 1376 wrote to memory of 5900 1376 E172.tmp 129 PID 5900 wrote to memory of 1036 5900 E1DF.tmp 130 PID 1036 wrote to memory of 4940 1036 E26C.tmp 131 PID 4940 wrote to memory of 2444 4940 E2F8.tmp 132 PID 2444 wrote to memory of 2468 2444 E366.tmp 133 PID 2468 wrote to memory of 1620 2468 E3E3.tmp 134 PID 1620 wrote to memory of 3376 1620 E450.tmp 135 PID 3376 wrote to memory of 2788 3376 E4EC.tmp 136 PID 2788 wrote to memory of 3304 2788 E569.tmp 137 PID 3304 wrote to memory of 3600 3304 E5E6.tmp 138 PID 3600 wrote to memory of 2864 3600 E683.tmp 139 PID 2864 wrote to memory of 4804 2864 E70F.tmp 140 PID 4804 wrote to memory of 1880 4804 E78C.tmp 141 PID 1880 wrote to memory of 5588 1880 E809.tmp 142 PID 5588 wrote to memory of 2220 5588 E8A6.tmp 143 PID 2220 wrote to memory of 2544 2220 E932.tmp 144 PID 2544 wrote to memory of 4364 2544 E9BF.tmp 145 PID 4364 wrote to memory of 5040 4364 EA6B.tmp 146 PID 5040 wrote to memory of 2876 5040 EB26.tmp 147 PID 2876 wrote to memory of 2072 2876 EBD2.tmp 148 PID 2072 wrote to memory of 1284 2072 EC4F.tmp 149 PID 1284 wrote to memory of 3220 1284 ECEB.tmp 150 PID 3220 wrote to memory of 4428 3220 ED88.tmp 151 PID 4428 wrote to memory of 2616 4428 EE14.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_f88f9d97dbb822a101fb70de29ab8d82_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f88f9d97dbb822a101fb70de29ab8d82_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\D145.tmp"C:\Users\Admin\AppData\Local\Temp\D145.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\D750.tmp"C:\Users\Admin\AppData\Local\Temp\D750.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D81B.tmp"C:\Users\Admin\AppData\Local\Temp\D81B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\DB28.tmp"C:\Users\Admin\AppData\Local\Temp\DB28.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\DC90.tmp"C:\Users\Admin\AppData\Local\Temp\DC90.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\DE74.tmp"C:\Users\Admin\AppData\Local\Temp\DE74.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E172.tmp"C:\Users\Admin\AppData\Local\Temp\E172.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\E70F.tmp"C:\Users\Admin\AppData\Local\Temp\E70F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\E78C.tmp"C:\Users\Admin\AppData\Local\Temp\E78C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\EA6B.tmp"C:\Users\Admin\AppData\Local\Temp\EA6B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\EE14.tmp"C:\Users\Admin\AppData\Local\Temp\EE14.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\EE91.tmp"C:\Users\Admin\AppData\Local\Temp\EE91.tmp"65⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"66⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"67⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\F027.tmp"C:\Users\Admin\AppData\Local\Temp\F027.tmp"68⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"69⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\F131.tmp"C:\Users\Admin\AppData\Local\Temp\F131.tmp"70⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\F19E.tmp"C:\Users\Admin\AppData\Local\Temp\F19E.tmp"71⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\F21B.tmp"C:\Users\Admin\AppData\Local\Temp\F21B.tmp"72⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"73⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"74⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"75⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"76⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"77⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\F529.tmp"C:\Users\Admin\AppData\Local\Temp\F529.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\F613.tmp"C:\Users\Admin\AppData\Local\Temp\F613.tmp"80⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\F690.tmp"C:\Users\Admin\AppData\Local\Temp\F690.tmp"81⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"82⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\F78A.tmp"C:\Users\Admin\AppData\Local\Temp\F78A.tmp"83⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\F817.tmp"C:\Users\Admin\AppData\Local\Temp\F817.tmp"84⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\F8A3.tmp"C:\Users\Admin\AppData\Local\Temp\F8A3.tmp"85⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\F920.tmp"C:\Users\Admin\AppData\Local\Temp\F920.tmp"86⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\F98E.tmp"C:\Users\Admin\AppData\Local\Temp\F98E.tmp"87⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"88⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\FA88.tmp"C:\Users\Admin\AppData\Local\Temp\FA88.tmp"89⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"90⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\FB91.tmp"C:\Users\Admin\AppData\Local\Temp\FB91.tmp"91⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"92⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"93⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"94⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"95⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\FE02.tmp"C:\Users\Admin\AppData\Local\Temp\FE02.tmp"96⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"97⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\FF0C.tmp"C:\Users\Admin\AppData\Local\Temp\FF0C.tmp"98⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\FF79.tmp"C:\Users\Admin\AppData\Local\Temp\FF79.tmp"99⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"100⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\83.tmp"C:\Users\Admin\AppData\Local\Temp\83.tmp"101⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"102⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"103⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\20A.tmp"C:\Users\Admin\AppData\Local\Temp\20A.tmp"104⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\277.tmp"C:\Users\Admin\AppData\Local\Temp\277.tmp"105⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\313.tmp"C:\Users\Admin\AppData\Local\Temp\313.tmp"106⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\390.tmp"C:\Users\Admin\AppData\Local\Temp\390.tmp"107⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"108⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\4A9.tmp"C:\Users\Admin\AppData\Local\Temp\4A9.tmp"109⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"110⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"111⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\64F.tmp"C:\Users\Admin\AppData\Local\Temp\64F.tmp"112⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"113⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"114⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\7D6.tmp"C:\Users\Admin\AppData\Local\Temp\7D6.tmp"115⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"116⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"117⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"118⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\9BA.tmp"C:\Users\Admin\AppData\Local\Temp\9BA.tmp"119⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\A37.tmp"C:\Users\Admin\AppData\Local\Temp\A37.tmp"120⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"121⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"122⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-