Analysis
- max time kernel
121s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_9b84a680c5f3bcf9171190122fea38cb_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9b84a680c5f3bcf9171190122fea38cb_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_9b84a680c5f3bcf9171190122fea38cb_elex_mafia.exe
- Size 524KB
- Sample260802-ractvaba48
- SHA256 2dcdee82f35343e32de8880311c1e06eeade7568551489705566c80cc843c3d1
- MD5 9b84a680c5f3bcf9171190122fea38cb
- SHA1 9911c7807bb9ceabf510dc98681904499ea505f5
- SHA512 c9bfce630b783efa1df72d4779a9809ea7c62e19d3f55df5b23b494f44aa7881a8c64d756cab3d16ddc71f5798ddd6aeabda068e3d4199fc0edfbe4e934873aa
- SSDEEP 12288:TRyZzqyL66T6X9UGbzG1i4F4OzHZhhFNZ:TRyQylTckzrDZhhFN
- TLSH T156B4F116B685C032E29215768F66DBA6587A7C71572BA4CB3B84367D6FB03C1D3B8303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5112 CB26.tmp 5968 CBE1.tmp 4672 CD39.tmp 3612 CE14.tmp 2148 CF8B.tmp 1100 D0B4.tmp 4724 D1EC.tmp 5380 D2E6.tmp 1604 D3F0.tmp 3236 D4CB.tmp 2768 D5C5.tmp 4540 D690.tmp 1164 D75B.tmp 2852 D8A3.tmp 1432 D9DC.tmp 4728 DAD6.tmp 1780 DBB0.tmp 4356 DCBA.tmp 5960 DDB4.tmp 6036 DEEC.tmp 1948 DFF6.tmp 4244 E16D.tmp 2604 E296.tmp 4872 E3EE.tmp 5796 E4D8.tmp 4180 E5D2.tmp 2316 E6BC.tmp 6044 E805.tmp 2836 E91E.tmp 1504 EA27.tmp 5768 EB31.tmp 6100 EC1B.tmp 1448 ED25.tmp 4112 EE00.tmp 2336 EEBB.tmp 3144 EF86.tmp 696 F071.tmp 4508 F14C.tmp 3580 F207.tmp 1040 F2F1.tmp 4368 F38E.tmp 5952 F40B.tmp 2776 F4A7.tmp 3692 F553.tmp 5764 F5FF.tmp 4768 F68B.tmp 5896 F776.tmp 1392 F860.tmp 5340 F8DD.tmp 5452 F95A.tmp 2688 F9D7.tmp 5336 FA44.tmp 1352 FAC1.tmp 2056 FB5E.tmp 2608 FBEA.tmp 2116 FC96.tmp 3340 FD23.tmp 1624 FDBF.tmp 3872 FE2C.tmp 5600 FEC9.tmp 4192 FF65.tmp 4188 30.tmp 1792 CC.tmp 6012 169.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C13E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5475.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 940F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 595C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D15B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B43E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B2C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 5112 4300 2026-08-02_9b84a680c5f3bcf9171190122fea38cb_elex_mafia.exe 88 PID 5112 wrote to memory of 5968 5112 CB26.tmp 89 PID 5968 wrote to memory of 4672 5968 CBE1.tmp 90 PID 4672 wrote to memory of 3612 4672 CD39.tmp 91 PID 3612 wrote to memory of 2148 3612 CE14.tmp 92 PID 2148 wrote to memory of 1100 2148 CF8B.tmp 93 PID 1100 wrote to memory of 4724 1100 D0B4.tmp 94 PID 4724 wrote to memory of 5380 4724 D1EC.tmp 95 PID 5380 wrote to memory of 1604 5380 D2E6.tmp 96 PID 1604 wrote to memory of 3236 1604 D3F0.tmp 97 PID 3236 wrote to memory of 2768 3236 D4CB.tmp 98 PID 2768 wrote to memory of 4540 2768 D5C5.tmp 99 PID 4540 wrote to memory of 1164 4540 D690.tmp 100 PID 1164 wrote to memory of 2852 1164 D75B.tmp 101 PID 2852 wrote to memory of 1432 2852 D8A3.tmp 102 PID 1432 wrote to memory of 4728 1432 D9DC.tmp 103 PID 4728 wrote to memory of 1780 4728 DAD6.tmp 104 PID 1780 wrote to memory of 4356 1780 DBB0.tmp 105 PID 4356 wrote to memory of 5960 4356 DCBA.tmp 106 PID 5960 wrote to memory of 6036 5960 DDB4.tmp 107 PID 6036 wrote to memory of 1948 6036 DEEC.tmp 108 PID 1948 wrote to memory of 4244 1948 DFF6.tmp 109 PID 4244 wrote to memory of 2604 4244 E16D.tmp 110 PID 2604 wrote to memory of 4872 2604 E296.tmp 111 PID 4872 wrote to memory of 5796 4872 E3EE.tmp 112 PID 5796 wrote to memory of 4180 5796 E4D8.tmp 113 PID 4180 wrote to memory of 2316 4180 E5D2.tmp 114 PID 2316 wrote to memory of 6044 2316 E6BC.tmp 115 PID 6044 wrote to memory of 2836 6044 E805.tmp 116 PID 2836 wrote to memory of 1504 2836 E91E.tmp 117 PID 1504 wrote to memory of 5768 1504 EA27.tmp 118 PID 5768 wrote to memory of 6100 5768 EB31.tmp 119 PID 6100 wrote to memory of 1448 6100 EC1B.tmp 120 PID 1448 wrote to memory of 4112 1448 ED25.tmp 121 PID 4112 wrote to memory of 2336 4112 EE00.tmp 122 PID 2336 wrote to memory of 3144 2336 EEBB.tmp 123 PID 3144 wrote to memory of 696 3144 EF86.tmp 124 PID 696 wrote to memory of 4508 696 F071.tmp 125 PID 4508 wrote to memory of 3580 4508 F14C.tmp 126 PID 3580 wrote to memory of 1040 3580 F207.tmp 127 PID 1040 wrote to memory of 4368 1040 F2F1.tmp 128 PID 4368 wrote to memory of 5952 4368 F38E.tmp 129 PID 5952 wrote to memory of 2776 5952 F40B.tmp 130 PID 2776 wrote to memory of 3692 2776 F4A7.tmp 131 PID 3692 wrote to memory of 5764 3692 F553.tmp 132 PID 5764 wrote to memory of 4768 5764 F5FF.tmp 133 PID 4768 wrote to memory of 5896 4768 F68B.tmp 134 PID 5896 wrote to memory of 1392 5896 F776.tmp 135 PID 1392 wrote to memory of 5340 1392 F860.tmp 136 PID 5340 wrote to memory of 5452 5340 F8DD.tmp 137 PID 5452 wrote to memory of 2688 5452 F95A.tmp 138 PID 2688 wrote to memory of 5336 2688 F9D7.tmp 139 PID 5336 wrote to memory of 1352 5336 FA44.tmp 140 PID 1352 wrote to memory of 2056 1352 FAC1.tmp 141 PID 2056 wrote to memory of 2608 2056 FB5E.tmp 142 PID 2608 wrote to memory of 2116 2608 FBEA.tmp 143 PID 2116 wrote to memory of 3340 2116 FC96.tmp 144 PID 3340 wrote to memory of 1624 3340 FD23.tmp 145 PID 1624 wrote to memory of 3872 1624 FDBF.tmp 146 PID 3872 wrote to memory of 5600 3872 FE2C.tmp 147 PID 5600 wrote to memory of 4192 5600 FEC9.tmp 148 PID 4192 wrote to memory of 4188 4192 FF65.tmp 149 PID 4188 wrote to memory of 1792 4188 30.tmp 150 PID 1792 wrote to memory of 6012 1792 CC.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9b84a680c5f3bcf9171190122fea38cb_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9b84a680c5f3bcf9171190122fea38cb_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\E16D.tmp"C:\Users\Admin\AppData\Local\Temp\E16D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\EB31.tmp"C:\Users\Admin\AppData\Local\Temp\EB31.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\F071.tmp"C:\Users\Admin\AppData\Local\Temp\F071.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\F68B.tmp"C:\Users\Admin\AppData\Local\Temp\F68B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\F860.tmp"C:\Users\Admin\AppData\Local\Temp\F860.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\FC96.tmp"C:\Users\Admin\AppData\Local\Temp\FC96.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\FD23.tmp"C:\Users\Admin\AppData\Local\Temp\FD23.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\169.tmp"C:\Users\Admin\AppData\Local\Temp\169.tmp"65⤵
- Executes dropped EXE
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"66⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"67⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"68⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"70⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"71⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\541.tmp"C:\Users\Admin\AppData\Local\Temp\541.tmp"72⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\5BE.tmp"C:\Users\Admin\AppData\Local\Temp\5BE.tmp"73⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"74⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\6E7.tmp"C:\Users\Admin\AppData\Local\Temp\6E7.tmp"75⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\773.tmp"C:\Users\Admin\AppData\Local\Temp\773.tmp"76⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"77⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"78⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"79⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"80⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"81⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"82⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\AFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFE.tmp"83⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"84⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"85⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\D5F.tmp"C:\Users\Admin\AppData\Local\Temp\D5F.tmp"87⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\DDC.tmp"C:\Users\Admin\AppData\Local\Temp\DDC.tmp"88⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"89⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"90⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"91⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"92⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"93⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"94⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\1195.tmp"C:\Users\Admin\AppData\Local\Temp\1195.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"96⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"97⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"98⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"99⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"100⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"101⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"102⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\15CB.tmp"C:\Users\Admin\AppData\Local\Temp\15CB.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\1648.tmp"C:\Users\Admin\AppData\Local\Temp\1648.tmp"104⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\16C5.tmp"C:\Users\Admin\AppData\Local\Temp\16C5.tmp"105⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"106⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"107⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\188A.tmp"C:\Users\Admin\AppData\Local\Temp\188A.tmp"108⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"109⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"110⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"111⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"112⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"113⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"115⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"116⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"117⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\1E38.tmp"C:\Users\Admin\AppData\Local\Temp\1E38.tmp"118⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"119⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1F41.tmp"C:\Users\Admin\AppData\Local\Temp\1F41.tmp"120⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"121⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-