Analysis
- max time kernel
119s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_b94d2ffe69160d1374a3562a77ea8f04_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_b94d2ffe69160d1374a3562a77ea8f04_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-25_b94d2ffe69160d1374a3562a77ea8f04_elex_mafia.exe
- Size 520KB
- Sample260826-pal2eaydjf
- SHA256 33ab2f19b2e75565c649faf02450d0388363020a07cbf646ee11e71c4eff3962
- MD5 b94d2ffe69160d1374a3562a77ea8f04
- SHA1 4dae122d5072ef594919ebbdbffe0506f2ed0223
- SHA512 14adcd21cec4c2204611e8a3de6532a768405b1ca06b68fdb7de172c036e73516864f1f86ff7632f206ba527095e73c19683a9d79a2deac6af91f88dc9ecb2e2
- SSDEEP 12288:gj8fuxR21t5i8fsMKG3Y3fDX88C6wvi5SyXNZ:gj8fuK1GY/KGoP4FvABXN
- TLSH T18EB4F112B888C032EA9611354B56DFA11BBE7D744B3285C73B9536BD6FB42C1E67830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3180 D9EB.tmp 1052 DA87.tmp 4436 DB33.tmp 3384 DBDF.tmp 4928 DD18.tmp 2892 DD85.tmp 2092 DE41.tmp 4552 DEDD.tmp 4024 DF89.tmp 4132 E015.tmp 5952 E083.tmp 444 E11F.tmp 1508 E1AC.tmp 1624 E257.tmp 1560 E303.tmp 4484 E380.tmp 3696 E44B.tmp 3980 E517.tmp 2972 E5C2.tmp 724 E69D.tmp 5232 E72A.tmp 4612 E7C6.tmp 3988 E853.tmp 6136 E90E.tmp 5160 E99B.tmp 4364 EA47.tmp 2440 EAD3.tmp 2540 EB70.tmp 880 EC4A.tmp 5036 ECD7.tmp 4072 ED64.tmp 4220 EE00.tmp 5548 EE8C.tmp 3268 EEFA.tmp 3212 EF67.tmp 3064 EFE4.tmp 4528 F052.tmp 5308 F0BF.tmp 3408 F13C.tmp 6072 F1A9.tmp 5664 F217.tmp 3700 F284.tmp 5060 F320.tmp 2684 F38E.tmp 416 F41A.tmp 448 F497.tmp 2060 F524.tmp 2268 F591.tmp 3184 F5FF.tmp 4632 F68B.tmp 2488 F6F9.tmp 4144 F776.tmp 392 F7F3.tmp 5912 F87F.tmp 5316 F8ED.tmp 4224 F979.tmp 4272 F9E7.tmp 6016 FA54.tmp 5092 FAE1.tmp 4300 FB4E.tmp 1388 FBDB.tmp 3176 FC67.tmp 4636 FD04.tmp 3020 FD61.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C10F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 177C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F59C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 365E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 808B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5010.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 391D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9036.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E09D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 506E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6084 wrote to memory of 3180 6084 2026-08-25_b94d2ffe69160d1374a3562a77ea8f04_elex_mafia.exe 87 PID 3180 wrote to memory of 1052 3180 D9EB.tmp 89 PID 1052 wrote to memory of 4436 1052 DA87.tmp 90 PID 4436 wrote to memory of 3384 4436 DB33.tmp 91 PID 3384 wrote to memory of 4928 3384 DBDF.tmp 92 PID 4928 wrote to memory of 2892 4928 DD18.tmp 93 PID 2892 wrote to memory of 2092 2892 DD85.tmp 94 PID 2092 wrote to memory of 4552 2092 DE41.tmp 95 PID 4552 wrote to memory of 4024 4552 DEDD.tmp 96 PID 4024 wrote to memory of 4132 4024 DF89.tmp 97 PID 4132 wrote to memory of 5952 4132 E015.tmp 98 PID 5952 wrote to memory of 444 5952 E083.tmp 99 PID 444 wrote to memory of 1508 444 E11F.tmp 100 PID 1508 wrote to memory of 1624 1508 E1AC.tmp 101 PID 1624 wrote to memory of 1560 1624 E257.tmp 102 PID 1560 wrote to memory of 4484 1560 E303.tmp 103 PID 4484 wrote to memory of 3696 4484 E380.tmp 104 PID 3696 wrote to memory of 3980 3696 E44B.tmp 105 PID 3980 wrote to memory of 2972 3980 E517.tmp 106 PID 2972 wrote to memory of 724 2972 E5C2.tmp 107 PID 724 wrote to memory of 5232 724 E69D.tmp 108 PID 5232 wrote to memory of 4612 5232 E72A.tmp 109 PID 4612 wrote to memory of 3988 4612 E7C6.tmp 110 PID 3988 wrote to memory of 6136 3988 E853.tmp 111 PID 6136 wrote to memory of 5160 6136 E90E.tmp 112 PID 5160 wrote to memory of 4364 5160 E99B.tmp 113 PID 4364 wrote to memory of 2440 4364 EA47.tmp 114 PID 2440 wrote to memory of 2540 2440 EAD3.tmp 115 PID 2540 wrote to memory of 880 2540 EB70.tmp 116 PID 880 wrote to memory of 5036 880 EC4A.tmp 117 PID 5036 wrote to memory of 4072 5036 ECD7.tmp 118 PID 4072 wrote to memory of 4220 4072 ED64.tmp 119 PID 4220 wrote to memory of 5548 4220 EE00.tmp 120 PID 5548 wrote to memory of 3268 5548 EE8C.tmp 121 PID 3268 wrote to memory of 3212 3268 EEFA.tmp 122 PID 3212 wrote to memory of 3064 3212 EF67.tmp 123 PID 3064 wrote to memory of 4528 3064 EFE4.tmp 124 PID 4528 wrote to memory of 5308 4528 F052.tmp 125 PID 5308 wrote to memory of 3408 5308 F0BF.tmp 126 PID 3408 wrote to memory of 6072 3408 F13C.tmp 127 PID 6072 wrote to memory of 5664 6072 F1A9.tmp 128 PID 5664 wrote to memory of 3700 5664 F217.tmp 129 PID 3700 wrote to memory of 5060 3700 F284.tmp 130 PID 5060 wrote to memory of 2684 5060 F320.tmp 131 PID 2684 wrote to memory of 416 2684 F38E.tmp 132 PID 416 wrote to memory of 448 416 F41A.tmp 133 PID 448 wrote to memory of 2060 448 F497.tmp 134 PID 2060 wrote to memory of 2268 2060 F524.tmp 135 PID 2268 wrote to memory of 3184 2268 F591.tmp 136 PID 3184 wrote to memory of 4632 3184 F5FF.tmp 137 PID 4632 wrote to memory of 2488 4632 F68B.tmp 138 PID 2488 wrote to memory of 4144 2488 F6F9.tmp 139 PID 4144 wrote to memory of 392 4144 F776.tmp 140 PID 392 wrote to memory of 5912 392 F7F3.tmp 141 PID 5912 wrote to memory of 5316 5912 F87F.tmp 142 PID 5316 wrote to memory of 4224 5316 F8ED.tmp 143 PID 4224 wrote to memory of 4272 4224 F979.tmp 144 PID 4272 wrote to memory of 6016 4272 F9E7.tmp 145 PID 6016 wrote to memory of 5092 6016 FA54.tmp 146 PID 5092 wrote to memory of 4300 5092 FAE1.tmp 147 PID 4300 wrote to memory of 1388 4300 FB4E.tmp 148 PID 1388 wrote to memory of 3176 1388 FBDB.tmp 149 PID 3176 wrote to memory of 4636 3176 FC67.tmp 150 PID 4636 wrote to memory of 3020 4636 FD04.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_b94d2ffe69160d1374a3562a77ea8f04_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b94d2ffe69160d1374a3562a77ea8f04_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\DB33.tmp"C:\Users\Admin\AppData\Local\Temp\DB33.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\DD18.tmp"C:\Users\Admin\AppData\Local\Temp\DD18.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\E015.tmp"C:\Users\Admin\AppData\Local\Temp\E015.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\E517.tmp"C:\Users\Admin\AppData\Local\Temp\E517.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\E853.tmp"C:\Users\Admin\AppData\Local\Temp\E853.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\E90E.tmp"C:\Users\Admin\AppData\Local\Temp\E90E.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\E99B.tmp"C:\Users\Admin\AppData\Local\Temp\E99B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\EF67.tmp"C:\Users\Admin\AppData\Local\Temp\EF67.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\F052.tmp"C:\Users\Admin\AppData\Local\Temp\F052.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\F41A.tmp"C:\Users\Admin\AppData\Local\Temp\F41A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\F591.tmp"C:\Users\Admin\AppData\Local\Temp\F591.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\F68B.tmp"C:\Users\Admin\AppData\Local\Temp\F68B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\F979.tmp"C:\Users\Admin\AppData\Local\Temp\F979.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"65⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"66⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"67⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"68⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"70⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"71⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F.tmp"72⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"73⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\188.tmp"C:\Users\Admin\AppData\Local\Temp\188.tmp"74⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"75⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\253.tmp"C:\Users\Admin\AppData\Local\Temp\253.tmp"76⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"77⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\34D.tmp"C:\Users\Admin\AppData\Local\Temp\34D.tmp"78⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\3CA.tmp"C:\Users\Admin\AppData\Local\Temp\3CA.tmp"79⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\457.tmp"C:\Users\Admin\AppData\Local\Temp\457.tmp"80⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"81⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\541.tmp"C:\Users\Admin\AppData\Local\Temp\541.tmp"82⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\5BE.tmp"C:\Users\Admin\AppData\Local\Temp\5BE.tmp"83⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\63B.tmp"C:\Users\Admin\AppData\Local\Temp\63B.tmp"84⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6B8.tmp"C:\Users\Admin\AppData\Local\Temp\6B8.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\745.tmp"C:\Users\Admin\AppData\Local\Temp\745.tmp"86⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\7D1.tmp"C:\Users\Admin\AppData\Local\Temp\7D1.tmp"87⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\8CB.tmp"C:\Users\Admin\AppData\Local\Temp\8CB.tmp"89⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\939.tmp"C:\Users\Admin\AppData\Local\Temp\939.tmp"90⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\9C5.tmp"C:\Users\Admin\AppData\Local\Temp\9C5.tmp"91⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"92⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"93⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"94⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"95⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"96⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"97⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"98⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"99⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"100⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"101⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"102⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\F24.tmp"C:\Users\Admin\AppData\Local\Temp\F24.tmp"103⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"104⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"105⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"106⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"107⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"108⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\1251.tmp"C:\Users\Admin\AppData\Local\Temp\1251.tmp"109⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"110⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"111⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\13D7.tmp"C:\Users\Admin\AppData\Local\Temp\13D7.tmp"112⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\1454.tmp"C:\Users\Admin\AppData\Local\Temp\1454.tmp"113⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"114⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"115⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\15CB.tmp"C:\Users\Admin\AppData\Local\Temp\15CB.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1639.tmp"C:\Users\Admin\AppData\Local\Temp\1639.tmp"117⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"118⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"119⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\17BF.tmp"C:\Users\Admin\AppData\Local\Temp\17BF.tmp"120⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\186B.tmp"C:\Users\Admin\AppData\Local\Temp\186B.tmp"121⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-