Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe
- Size 524KB
- Sample260802-xfsedazbpc
- SHA256 d2e26c07e3b3cc1ac2f14e8131d82b723f8aba3792c91ec6e72186e7e6aae2e7
- MD5 459b382b0fc28976e35be90696072d8c
- SHA1 b2d533665dd30dab3092391a2529460c636cdd73
- SHA512 d81f0fdddbfe46a9c51703d34b7a0058ca68db6385b6914be2bcc883b9926fdfdbda81bf57f0b330063511fc77cc0537327a28deba2a379019b12de15988806e
- SSDEEP 12288:TRyZzqyL66T9u7V2Krj7grdqOI/e0Mikko+TNZ:TRyQylT0AkjMpMfMaJN
- TLSH T126B4F1257589C032E28215725E65EBA2193B7D759B27A4CB3BD43A7E2FB12D0D2B4303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3512 5FAA.tmp 5868 6085.tmp 2064 61EC.tmp 6056 6354.tmp 1212 647D.tmp 5800 65A6.tmp 2036 66BF.tmp 3060 67A9.tmp 3600 6920.tmp 6004 69FB.tmp 292 6AD6.tmp 5740 6BEF.tmp 1916 6D76.tmp 4476 6ECD.tmp 1220 6FE7.tmp 4956 711F.tmp 796 7286.tmp 3416 73DE.tmp 5464 74F7.tmp 824 764F.tmp 2092 772A.tmp 3400 7872.tmp 2096 795C.tmp 4472 7A66.tmp 4064 7B41.tmp 3372 7C6A.tmp 1524 7D35.tmp 1064 7E4E.tmp 4260 7F38.tmp 4444 8052.tmp 4664 81A9.tmp 1696 82C3.tmp 3504 83EC.tmp 3036 84A7.tmp 3260 8563.tmp 3496 865D.tmp 4844 86F9.tmp 1776 8802.tmp 5776 88AE.tmp 6096 8989.tmp 5944 8A16.tmp 1600 8AF0.tmp 2004 8B7D.tmp 4976 8C48.tmp 5992 8D42.tmp 3820 8DDE.tmp 5576 8E8A.tmp 4236 8F46.tmp 5472 8FC3.tmp 2512 9040.tmp 3236 90DC.tmp 4216 9159.tmp 4836 91E6.tmp 5352 9272.tmp 2284 930F.tmp 3608 939B.tmp 3184 9418.tmp 4648 94A5.tmp 4576 9551.tmp 1356 95CE.tmp 1160 964B.tmp 3248 96D7.tmp 5892 9764.tmp 3208 9810.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 857D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F37E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 955C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D11C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3610.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 314D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4628 wrote to memory of 3512 4628 2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe 88 PID 3512 wrote to memory of 5868 3512 5FAA.tmp 90 PID 5868 wrote to memory of 2064 5868 6085.tmp 91 PID 2064 wrote to memory of 6056 2064 61EC.tmp 92 PID 6056 wrote to memory of 1212 6056 6354.tmp 93 PID 1212 wrote to memory of 5800 1212 647D.tmp 94 PID 5800 wrote to memory of 2036 5800 65A6.tmp 95 PID 2036 wrote to memory of 3060 2036 66BF.tmp 96 PID 3060 wrote to memory of 3600 3060 67A9.tmp 97 PID 3600 wrote to memory of 6004 3600 6920.tmp 98 PID 6004 wrote to memory of 292 6004 69FB.tmp 99 PID 292 wrote to memory of 5740 292 6AD6.tmp 100 PID 5740 wrote to memory of 1916 5740 6BEF.tmp 101 PID 1916 wrote to memory of 4476 1916 6D76.tmp 102 PID 4476 wrote to memory of 1220 4476 6ECD.tmp 103 PID 1220 wrote to memory of 4956 1220 6FE7.tmp 104 PID 4956 wrote to memory of 796 4956 711F.tmp 105 PID 796 wrote to memory of 3416 796 7286.tmp 106 PID 3416 wrote to memory of 5464 3416 73DE.tmp 107 PID 5464 wrote to memory of 824 5464 74F7.tmp 108 PID 824 wrote to memory of 2092 824 764F.tmp 109 PID 2092 wrote to memory of 3400 2092 772A.tmp 110 PID 3400 wrote to memory of 2096 3400 7872.tmp 111 PID 2096 wrote to memory of 4472 2096 795C.tmp 112 PID 4472 wrote to memory of 4064 4472 7A66.tmp 113 PID 4064 wrote to memory of 3372 4064 7B41.tmp 114 PID 3372 wrote to memory of 1524 3372 7C6A.tmp 115 PID 1524 wrote to memory of 1064 1524 7D35.tmp 116 PID 1064 wrote to memory of 4260 1064 7E4E.tmp 117 PID 4260 wrote to memory of 4444 4260 7F38.tmp 118 PID 4444 wrote to memory of 4664 4444 8052.tmp 119 PID 4664 wrote to memory of 1696 4664 81A9.tmp 120 PID 1696 wrote to memory of 3504 1696 82C3.tmp 121 PID 3504 wrote to memory of 3036 3504 83EC.tmp 122 PID 3036 wrote to memory of 3260 3036 84A7.tmp 123 PID 3260 wrote to memory of 3496 3260 8563.tmp 124 PID 3496 wrote to memory of 4844 3496 865D.tmp 125 PID 4844 wrote to memory of 1776 4844 86F9.tmp 126 PID 1776 wrote to memory of 5776 1776 8802.tmp 127 PID 5776 wrote to memory of 6096 5776 88AE.tmp 128 PID 6096 wrote to memory of 5944 6096 8989.tmp 129 PID 5944 wrote to memory of 1600 5944 8A16.tmp 130 PID 1600 wrote to memory of 2004 1600 8AF0.tmp 131 PID 2004 wrote to memory of 4976 2004 8B7D.tmp 132 PID 4976 wrote to memory of 5992 4976 8C48.tmp 133 PID 5992 wrote to memory of 3820 5992 8D42.tmp 134 PID 3820 wrote to memory of 5576 3820 8DDE.tmp 135 PID 5576 wrote to memory of 4236 5576 8E8A.tmp 136 PID 4236 wrote to memory of 5472 4236 8F46.tmp 137 PID 5472 wrote to memory of 2512 5472 8FC3.tmp 138 PID 2512 wrote to memory of 3236 2512 9040.tmp 139 PID 3236 wrote to memory of 4216 3236 90DC.tmp 140 PID 4216 wrote to memory of 4836 4216 9159.tmp 141 PID 4836 wrote to memory of 5352 4836 91E6.tmp 142 PID 5352 wrote to memory of 2284 5352 9272.tmp 143 PID 2284 wrote to memory of 3608 2284 930F.tmp 144 PID 3608 wrote to memory of 3184 3608 939B.tmp 145 PID 3184 wrote to memory of 4648 3184 9418.tmp 146 PID 4648 wrote to memory of 4576 4648 94A5.tmp 147 PID 4576 wrote to memory of 1356 4576 9551.tmp 148 PID 1356 wrote to memory of 1160 1356 95CE.tmp 149 PID 1160 wrote to memory of 3248 1160 964B.tmp 150 PID 3248 wrote to memory of 5892 3248 96D7.tmp 151 PID 5892 wrote to memory of 3208 5892 9764.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\61EC.tmp"C:\Users\Admin\AppData\Local\Temp\61EC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\6354.tmp"C:\Users\Admin\AppData\Local\Temp\6354.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6920.tmp"C:\Users\Admin\AppData\Local\Temp\6920.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\711F.tmp"C:\Users\Admin\AppData\Local\Temp\711F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\764F.tmp"C:\Users\Admin\AppData\Local\Temp\764F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\772A.tmp"C:\Users\Admin\AppData\Local\Temp\772A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\795C.tmp"C:\Users\Admin\AppData\Local\Temp\795C.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\7A66.tmp"C:\Users\Admin\AppData\Local\Temp\7A66.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\7B41.tmp"C:\Users\Admin\AppData\Local\Temp\7B41.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7F38.tmp"C:\Users\Admin\AppData\Local\Temp\7F38.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8052.tmp"C:\Users\Admin\AppData\Local\Temp\8052.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\8563.tmp"C:\Users\Admin\AppData\Local\Temp\8563.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"65⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"66⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"67⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"68⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\9A23.tmp"C:\Users\Admin\AppData\Local\Temp\9A23.tmp"69⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"70⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"71⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"73⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\9D01.tmp"C:\Users\Admin\AppData\Local\Temp\9D01.tmp"74⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"75⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"76⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"77⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\9F44.tmp"C:\Users\Admin\AppData\Local\Temp\9F44.tmp"78⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"79⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A07C.tmp"C:\Users\Admin\AppData\Local\Temp\A07C.tmp"80⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"81⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"82⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"83⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"84⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"85⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"86⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\A464.tmp"C:\Users\Admin\AppData\Local\Temp\A464.tmp"87⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"89⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\A639.tmp"C:\Users\Admin\AppData\Local\Temp\A639.tmp"90⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"91⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"92⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"93⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\A86B.tmp"C:\Users\Admin\AppData\Local\Temp\A86B.tmp"94⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\AA11.tmp"C:\Users\Admin\AppData\Local\Temp\AA11.tmp"97⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"98⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"99⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"100⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"102⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"103⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"104⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"105⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"107⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"108⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"109⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"110⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"111⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"112⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"113⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"114⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"115⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B443.tmp"C:\Users\Admin\AppData\Local\Temp\B443.tmp"116⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"C:\Users\Admin\AppData\Local\Temp\B4CF.tmp"117⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"118⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"119⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"120⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\B721.tmp"C:\Users\Admin\AppData\Local\Temp\B721.tmp"121⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\B79E.tmp"C:\Users\Admin\AppData\Local\Temp\B79E.tmp"122⤵PID:936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-