Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_f9e22c9b1b8c7c849ea7eb531a81acc8_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_f9e22c9b1b8c7c849ea7eb531a81acc8_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_f9e22c9b1b8c7c849ea7eb531a81acc8_elex_mafia.exe
- Size 524KB
- Sample260801-ssvcaa11dv
- SHA256 7dc26b9f46564e52a7e8f943a4dec24d07fb5b82b99ef231e084411c08889ca2
- MD5 f9e22c9b1b8c7c849ea7eb531a81acc8
- SHA1 8d4b5f207de6d26b6b502c1ed9f60aba3e19f715
- SHA512 7d2c8b1430127e1ae67ae6e726dca2a9955e699f2eeb43b10ca104ca72f0ce557bf5849e145369d872e329a67c9d7d0eec8a465a1dfd2a3dce2ece8bb98a7bcf
- SSDEEP 12288:TRyZzqyL66TMRiuOhAxJXxykPhtJgwOIycnNZ:TRyQylTV25x1PZRByMN
- TLSH T1F3B4F1267648C032F6C201758A6AE762493B7D79AB2694CB3BD42A7D2FB13D1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5152 3FE.tmp 2688 49A.tmp 6120 565.tmp 2712 5E2.tmp 5824 65F.tmp 4948 70B.tmp 3236 7A7.tmp 1476 872.tmp 5076 90E.tmp 5032 9CA.tmp 4136 A57.tmp 2600 BBE.tmp 4128 CA8.tmp 2720 D25.tmp 3096 DD1.tmp 4016 E6D.tmp 5700 F0A.tmp 3640 F77.tmp 1828 1042.tmp 1996 10BF.tmp 5628 118A.tmp 1780 1207.tmp 2456 12A4.tmp 908 1330.tmp 5604 13AD.tmp 4712 1488.tmp 2528 1572.tmp 2732 160F.tmp 5832 1709.tmp 4784 17F3.tmp 5756 1880.tmp 4780 194B.tmp 852 19D7.tmp 1060 1A64.tmp 4216 1B10.tmp 824 1B8D.tmp 1408 1C0A.tmp 3976 1CA6.tmp 4452 1D81.tmp 4404 1E0D.tmp 2568 1E8A.tmp 2400 1F27.tmp 4936 1FC3.tmp 5128 206F.tmp 3652 211B.tmp 1552 21D6.tmp 1556 22A1.tmp 1436 235D.tmp 2632 23E9.tmp 5028 2486.tmp 5488 2522.tmp 4724 259F.tmp 1956 263B.tmp 5888 26E7.tmp 3176 2783.tmp 5576 27F1.tmp 4380 287D.tmp 1692 291A.tmp 4348 2997.tmp 4924 2A14.tmp 4512 2AA0.tmp 1092 2B2D.tmp 2880 2B9A.tmp 1304 2C17.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1709.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 923F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 257B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 494F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D44E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 961C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5668 wrote to memory of 5152 5668 2026-08-01_f9e22c9b1b8c7c849ea7eb531a81acc8_elex_mafia.exe 89 PID 5152 wrote to memory of 2688 5152 3FE.tmp 90 PID 2688 wrote to memory of 6120 2688 49A.tmp 91 PID 6120 wrote to memory of 2712 6120 565.tmp 92 PID 2712 wrote to memory of 5824 2712 5E2.tmp 93 PID 5824 wrote to memory of 4948 5824 65F.tmp 94 PID 4948 wrote to memory of 3236 4948 70B.tmp 95 PID 3236 wrote to memory of 1476 3236 7A7.tmp 96 PID 1476 wrote to memory of 5076 1476 872.tmp 97 PID 5076 wrote to memory of 5032 5076 90E.tmp 98 PID 5032 wrote to memory of 4136 5032 9CA.tmp 99 PID 4136 wrote to memory of 2600 4136 A57.tmp 100 PID 2600 wrote to memory of 4128 2600 BBE.tmp 101 PID 4128 wrote to memory of 2720 4128 CA8.tmp 102 PID 2720 wrote to memory of 3096 2720 D25.tmp 103 PID 3096 wrote to memory of 4016 3096 DD1.tmp 104 PID 4016 wrote to memory of 5700 4016 E6D.tmp 105 PID 5700 wrote to memory of 3640 5700 F0A.tmp 106 PID 3640 wrote to memory of 1828 3640 F77.tmp 107 PID 1828 wrote to memory of 1996 1828 1042.tmp 108 PID 1996 wrote to memory of 5628 1996 10BF.tmp 109 PID 5628 wrote to memory of 1780 5628 118A.tmp 110 PID 1780 wrote to memory of 2456 1780 1207.tmp 111 PID 2456 wrote to memory of 908 2456 12A4.tmp 112 PID 908 wrote to memory of 5604 908 1330.tmp 113 PID 5604 wrote to memory of 4712 5604 13AD.tmp 114 PID 4712 wrote to memory of 2528 4712 1488.tmp 115 PID 2528 wrote to memory of 2732 2528 1572.tmp 116 PID 2732 wrote to memory of 5832 2732 160F.tmp 117 PID 5832 wrote to memory of 4784 5832 1709.tmp 118 PID 4784 wrote to memory of 5756 4784 17F3.tmp 119 PID 5756 wrote to memory of 4780 5756 1880.tmp 120 PID 4780 wrote to memory of 852 4780 194B.tmp 121 PID 852 wrote to memory of 1060 852 19D7.tmp 122 PID 1060 wrote to memory of 4216 1060 1A64.tmp 123 PID 4216 wrote to memory of 824 4216 1B10.tmp 124 PID 824 wrote to memory of 1408 824 1B8D.tmp 125 PID 1408 wrote to memory of 3976 1408 1C0A.tmp 126 PID 3976 wrote to memory of 4452 3976 1CA6.tmp 127 PID 4452 wrote to memory of 4404 4452 1D81.tmp 128 PID 4404 wrote to memory of 2568 4404 1E0D.tmp 129 PID 2568 wrote to memory of 2400 2568 1E8A.tmp 130 PID 2400 wrote to memory of 4936 2400 1F27.tmp 131 PID 4936 wrote to memory of 5128 4936 1FC3.tmp 132 PID 5128 wrote to memory of 3652 5128 206F.tmp 133 PID 3652 wrote to memory of 1552 3652 211B.tmp 134 PID 1552 wrote to memory of 1556 1552 21D6.tmp 135 PID 1556 wrote to memory of 1436 1556 22A1.tmp 136 PID 1436 wrote to memory of 2632 1436 235D.tmp 137 PID 2632 wrote to memory of 5028 2632 23E9.tmp 138 PID 5028 wrote to memory of 5488 5028 2486.tmp 139 PID 5488 wrote to memory of 4724 5488 2522.tmp 140 PID 4724 wrote to memory of 1956 4724 259F.tmp 141 PID 1956 wrote to memory of 5888 1956 263B.tmp 142 PID 5888 wrote to memory of 3176 5888 26E7.tmp 143 PID 3176 wrote to memory of 5576 3176 2783.tmp 144 PID 5576 wrote to memory of 4380 5576 27F1.tmp 145 PID 4380 wrote to memory of 1692 4380 287D.tmp 146 PID 1692 wrote to memory of 4348 1692 291A.tmp 147 PID 4348 wrote to memory of 4924 4348 2997.tmp 148 PID 4924 wrote to memory of 4512 4924 2A14.tmp 149 PID 4512 wrote to memory of 1092 4512 2AA0.tmp 150 PID 1092 wrote to memory of 2880 1092 2B2D.tmp 151 PID 2880 wrote to memory of 1304 2880 2B9A.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_f9e22c9b1b8c7c849ea7eb531a81acc8_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f9e22c9b1b8c7c849ea7eb531a81acc8_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\3FE.tmp"C:\Users\Admin\AppData\Local\Temp\3FE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\49A.tmp"C:\Users\Admin\AppData\Local\Temp\49A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\70B.tmp"C:\Users\Admin\AppData\Local\Temp\70B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\872.tmp"C:\Users\Admin\AppData\Local\Temp\872.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\A57.tmp"C:\Users\Admin\AppData\Local\Temp\A57.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\BBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\DD1.tmp"C:\Users\Admin\AppData\Local\Temp\DD1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\E6D.tmp"C:\Users\Admin\AppData\Local\Temp\E6D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\1042.tmp"C:\Users\Admin\AppData\Local\Temp\1042.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\10BF.tmp"C:\Users\Admin\AppData\Local\Temp\10BF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\118A.tmp"C:\Users\Admin\AppData\Local\Temp\118A.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\1207.tmp"C:\Users\Admin\AppData\Local\Temp\1207.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\12A4.tmp"C:\Users\Admin\AppData\Local\Temp\12A4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1B10.tmp"C:\Users\Admin\AppData\Local\Temp\1B10.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\1D81.tmp"C:\Users\Admin\AppData\Local\Temp\1D81.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1F27.tmp"C:\Users\Admin\AppData\Local\Temp\1F27.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\206F.tmp"C:\Users\Admin\AppData\Local\Temp\206F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\21D6.tmp"C:\Users\Admin\AppData\Local\Temp\21D6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2486.tmp"C:\Users\Admin\AppData\Local\Temp\2486.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\2522.tmp"C:\Users\Admin\AppData\Local\Temp\2522.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\263B.tmp"C:\Users\Admin\AppData\Local\Temp\263B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\287D.tmp"C:\Users\Admin\AppData\Local\Temp\287D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\291A.tmp"C:\Users\Admin\AppData\Local\Temp\291A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\2A14.tmp"C:\Users\Admin\AppData\Local\Temp\2A14.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"C:\Users\Admin\AppData\Local\Temp\2B2D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"65⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"66⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"67⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"68⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\2E59.tmp"C:\Users\Admin\AppData\Local\Temp\2E59.tmp"69⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"70⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"71⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\301E.tmp"C:\Users\Admin\AppData\Local\Temp\301E.tmp"72⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"73⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"74⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"75⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3280.tmp"C:\Users\Admin\AppData\Local\Temp\3280.tmp"76⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\330C.tmp"C:\Users\Admin\AppData\Local\Temp\330C.tmp"77⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"80⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"81⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\35EB.tmp"C:\Users\Admin\AppData\Local\Temp\35EB.tmp"82⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"83⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"84⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\3771.tmp"C:\Users\Admin\AppData\Local\Temp\3771.tmp"85⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\37EE.tmp"C:\Users\Admin\AppData\Local\Temp\37EE.tmp"86⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\386B.tmp"C:\Users\Admin\AppData\Local\Temp\386B.tmp"87⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"88⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\3975.tmp"C:\Users\Admin\AppData\Local\Temp\3975.tmp"89⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\3A02.tmp"C:\Users\Admin\AppData\Local\Temp\3A02.tmp"90⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"91⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"92⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\3B79.tmp"C:\Users\Admin\AppData\Local\Temp\3B79.tmp"93⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"94⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"95⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"96⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"97⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"98⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"99⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"100⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"101⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4126.tmp"C:\Users\Admin\AppData\Local\Temp\4126.tmp"103⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"104⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"105⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"106⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"107⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"108⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"109⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"110⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"111⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"112⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"113⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"114⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"115⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\485A.tmp"C:\Users\Admin\AppData\Local\Temp\485A.tmp"116⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"117⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"118⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"119⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"120⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"121⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"122⤵PID:1524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-