Analysis
- max time kernel
119s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe
- Size 524KB
- Sample260712-vffdpsfx5s
- SHA256 43eadd2088da49a9b3aabaa15ec24c50349dacd6ca867d1143cf7699ecb866fe
- MD5 6c909161e72641e2d03b70fa1c9153fb
- SHA1 0db2ce3503fbd37928397f7bf91f9b201f746316
- SHA512 ea42f14eee14882884d1a38d2aa73e07f80b353969ee95a95532d4091078f694dead477e59bd03e18bbf347f1a28f70f616fdd058bfca01bb64ec0f0aaf78984
- SSDEEP 12288:TRyZzqyL66TizNMNHLArCxhA1d/swTHykOvMqNZ:TRyQylTiBQHUrCxKTSkdqN
- TLSH T1B0B4F126B184C032F69200718B16EBA2593ABD759727A4CB7BD52A7D2FF03D1E274307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1308 819A.tmp 3600 8255.tmp 5716 83FB.tmp 628 84F5.tmp 4836 8591.tmp 5844 8718.tmp 3240 8841.tmp 1432 894B.tmp 1752 8A45.tmp 4212 8B3F.tmp 3620 8C39.tmp 2544 8D23.tmp 5836 8E0D.tmp 1760 8EE8.tmp 2092 8FB3.tmp 992 908E.tmp 4948 91A7.tmp 676 9272.tmp 3280 934D.tmp 3320 9466.tmp 1836 9531.tmp 2840 962B.tmp 4584 9716.tmp 5568 981F.tmp 6012 9929.tmp 1548 9A42.tmp 2384 9B5C.tmp 5052 9C84.tmp 4088 9D7E.tmp 5776 9E69.tmp 2920 9F53.tmp 5812 A01E.tmp 5400 A0E9.tmp 3520 A1B5.tmp 5012 A212.tmp 2724 A2AF.tmp 5680 A37A.tmp 5924 A445.tmp 1288 A520.tmp 3880 A5FA.tmp 4560 A6B6.tmp 4180 A723.tmp 5748 A7EE.tmp 704 A8AA.tmp 4132 A975.tmp 4604 A9E2.tmp 5804 AB3A.tmp 3476 ABC7.tmp 3548 AC73.tmp 4232 ACF0.tmp 4768 AD7C.tmp 2116 ADF9.tmp 4592 AE95.tmp 2976 AF22.tmp 1088 AFBE.tmp 3892 B03B.tmp 2788 B0D8.tmp 3844 B155.tmp 5520 B1D2.tmp 3056 B26E.tmp 1612 B30A.tmp 2896 B397.tmp 3888 B414.tmp 4704 B4C0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 392D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4022.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 688F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 978E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F91C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 130C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 173E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8F8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1308 2112 2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe 87 PID 1308 wrote to memory of 3600 1308 819A.tmp 88 PID 3600 wrote to memory of 5716 3600 8255.tmp 89 PID 5716 wrote to memory of 628 5716 83FB.tmp 90 PID 628 wrote to memory of 4836 628 84F5.tmp 91 PID 4836 wrote to memory of 5844 4836 8591.tmp 92 PID 5844 wrote to memory of 3240 5844 8718.tmp 93 PID 3240 wrote to memory of 1432 3240 8841.tmp 94 PID 1432 wrote to memory of 1752 1432 894B.tmp 95 PID 1752 wrote to memory of 4212 1752 8A45.tmp 96 PID 4212 wrote to memory of 3620 4212 8B3F.tmp 97 PID 3620 wrote to memory of 2544 3620 8C39.tmp 98 PID 2544 wrote to memory of 5836 2544 8D23.tmp 99 PID 5836 wrote to memory of 1760 5836 8E0D.tmp 100 PID 1760 wrote to memory of 2092 1760 8EE8.tmp 101 PID 2092 wrote to memory of 992 2092 8FB3.tmp 102 PID 992 wrote to memory of 4948 992 908E.tmp 103 PID 4948 wrote to memory of 676 4948 91A7.tmp 104 PID 676 wrote to memory of 3280 676 9272.tmp 105 PID 3280 wrote to memory of 3320 3280 934D.tmp 106 PID 3320 wrote to memory of 1836 3320 9466.tmp 107 PID 1836 wrote to memory of 2840 1836 9531.tmp 108 PID 2840 wrote to memory of 4584 2840 962B.tmp 109 PID 4584 wrote to memory of 5568 4584 9716.tmp 110 PID 5568 wrote to memory of 6012 5568 981F.tmp 111 PID 6012 wrote to memory of 1548 6012 9929.tmp 112 PID 1548 wrote to memory of 2384 1548 9A42.tmp 113 PID 2384 wrote to memory of 5052 2384 9B5C.tmp 114 PID 5052 wrote to memory of 4088 5052 9C84.tmp 115 PID 4088 wrote to memory of 5776 4088 9D7E.tmp 116 PID 5776 wrote to memory of 2920 5776 9E69.tmp 117 PID 2920 wrote to memory of 5812 2920 9F53.tmp 118 PID 5812 wrote to memory of 5400 5812 A01E.tmp 119 PID 5400 wrote to memory of 3520 5400 A0E9.tmp 120 PID 3520 wrote to memory of 5012 3520 A1B5.tmp 121 PID 5012 wrote to memory of 2724 5012 A212.tmp 122 PID 2724 wrote to memory of 5680 2724 A2AF.tmp 123 PID 5680 wrote to memory of 5924 5680 A37A.tmp 124 PID 5924 wrote to memory of 1288 5924 A445.tmp 125 PID 1288 wrote to memory of 3880 1288 A520.tmp 126 PID 3880 wrote to memory of 4560 3880 A5FA.tmp 127 PID 4560 wrote to memory of 4180 4560 A6B6.tmp 128 PID 4180 wrote to memory of 5748 4180 A723.tmp 129 PID 5748 wrote to memory of 704 5748 A7EE.tmp 130 PID 704 wrote to memory of 4132 704 A8AA.tmp 131 PID 4132 wrote to memory of 4604 4132 A975.tmp 132 PID 5260 wrote to memory of 5804 5260 AA7F.tmp 134 PID 5804 wrote to memory of 3476 5804 AB3A.tmp 135 PID 3476 wrote to memory of 3548 3476 ABC7.tmp 136 PID 3548 wrote to memory of 4232 3548 AC73.tmp 137 PID 4232 wrote to memory of 4768 4232 ACF0.tmp 138 PID 4768 wrote to memory of 2116 4768 AD7C.tmp 139 PID 2116 wrote to memory of 4592 2116 ADF9.tmp 140 PID 4592 wrote to memory of 2976 4592 AE95.tmp 141 PID 2976 wrote to memory of 1088 2976 AF22.tmp 142 PID 1088 wrote to memory of 3892 1088 AFBE.tmp 143 PID 3892 wrote to memory of 2788 3892 B03B.tmp 144 PID 2788 wrote to memory of 3844 2788 B0D8.tmp 145 PID 3844 wrote to memory of 5520 3844 B155.tmp 146 PID 5520 wrote to memory of 3056 5520 B1D2.tmp 147 PID 3056 wrote to memory of 1612 3056 B26E.tmp 148 PID 1612 wrote to memory of 2896 1612 B30A.tmp 149 PID 2896 wrote to memory of 3888 2896 B397.tmp 150 PID 3888 wrote to memory of 4704 3888 B414.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\8255.tmp"C:\Users\Admin\AppData\Local\Temp\8255.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\83FB.tmp"C:\Users\Admin\AppData\Local\Temp\83FB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\84F5.tmp"C:\Users\Admin\AppData\Local\Temp\84F5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\8591.tmp"C:\Users\Admin\AppData\Local\Temp\8591.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9466.tmp"C:\Users\Admin\AppData\Local\Temp\9466.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\981F.tmp"C:\Users\Admin\AppData\Local\Temp\981F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\9C84.tmp"C:\Users\Admin\AppData\Local\Temp\9C84.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\9E69.tmp"C:\Users\Admin\AppData\Local\Temp\9E69.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\A212.tmp"C:\Users\Admin\AppData\Local\Temp\A212.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A37A.tmp"C:\Users\Admin\AppData\Local\Temp\A37A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\A520.tmp"C:\Users\Admin\AppData\Local\Temp\A520.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"C:\Users\Admin\AppData\Local\Temp\A8AA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"C:\Users\Admin\AppData\Local\Temp\AA7F.tmp"48⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"C:\Users\Admin\AppData\Local\Temp\AD7C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\B397.tmp"C:\Users\Admin\AppData\Local\Temp\B397.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\B414.tmp"C:\Users\Admin\AppData\Local\Temp\B414.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"66⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"67⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"68⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"69⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"70⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\B750.tmp"C:\Users\Admin\AppData\Local\Temp\B750.tmp"71⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"72⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"73⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"74⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"75⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"C:\Users\Admin\AppData\Local\Temp\B9C1.tmp"76⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"78⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"79⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"80⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"81⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"83⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"84⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"85⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"86⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"87⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"88⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"89⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"91⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\C1FE.tmp"C:\Users\Admin\AppData\Local\Temp\C1FE.tmp"92⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\C28B.tmp"C:\Users\Admin\AppData\Local\Temp\C28B.tmp"93⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"94⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"C:\Users\Admin\AppData\Local\Temp\C3D3.tmp"95⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\C450.tmp"C:\Users\Admin\AppData\Local\Temp\C450.tmp"96⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\C598.tmp"C:\Users\Admin\AppData\Local\Temp\C598.tmp"98⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"99⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"100⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"101⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"102⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"103⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"104⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\C951.tmp"C:\Users\Admin\AppData\Local\Temp\C951.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"106⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"108⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\CB36.tmp"C:\Users\Admin\AppData\Local\Temp\CB36.tmp"109⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"110⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"111⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"112⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\CD68.tmp"C:\Users\Admin\AppData\Local\Temp\CD68.tmp"113⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\CDE5.tmp"C:\Users\Admin\AppData\Local\Temp\CDE5.tmp"114⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"115⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"C:\Users\Admin\AppData\Local\Temp\CFD9.tmp"117⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\D056.tmp"C:\Users\Admin\AppData\Local\Temp\D056.tmp"118⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"119⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"120⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\D23A.tmp"C:\Users\Admin\AppData\Local\Temp\D23A.tmp"121⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"122⤵PID:1540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-