Analysis
- max time kernel
104s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_bd8209c3f3f99e562b3f840c36fb44ec_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_bd8209c3f3f99e562b3f840c36fb44ec_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_bd8209c3f3f99e562b3f840c36fb44ec_elex_mafia.exe
- Size 520KB
- Sample260804-w49g5axdpd
- SHA256 859afe1e3dd2abb5927dd6179f6fdae1624c490582cfae92faa7f93302bc7f55
- MD5 bd8209c3f3f99e562b3f840c36fb44ec
- SHA1 24c1ad8e015f6b7407e0754b41935839250fb816
- SHA512 05e06abbb894ede24085a38d4a2d4f2714382742d66591b1d88fb6d22aed7c30eb271b460b333ce22886adf0ebe97698d171aac3e85d2f4c38a3deb26ef5fb2f
- SSDEEP 12288:gj8fuxR21t5i8fPG/TJScBzd5S54y8xMdyRZNZ:gj8fuK1GYPawcBzdQ6pMdyRZN
- TLSH T1B7B4F0117948C032E9E311308A62DB620BBE7D759B76D5C73B84367DAEB52C1D67830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1368 8013.tmp 1428 81B9.tmp 3132 8301.tmp 5416 83CC.tmp 1836 8469.tmp 2888 8572.tmp 3548 862E.tmp 1448 8708.tmp 4156 8795.tmp 1864 8870.tmp 5344 894B.tmp 5236 89E7.tmp 3404 8AA2.tmp 5932 8B9C.tmp 1236 8C77.tmp 2808 8D61.tmp 3252 8E2D.tmp 1004 8F27.tmp 1300 8FC3.tmp 2184 90EC.tmp 860 91B7.tmp 3032 9263.tmp 1392 931E.tmp 6140 93F9.tmp 4636 94E3.tmp 3488 95CE.tmp 3196 967A.tmp 4852 9754.tmp 6040 984E.tmp 4596 990A.tmp 3704 99D5.tmp 2064 9AA0.tmp 5464 9B6B.tmp 4100 9C27.tmp 3924 9CE2.tmp 5152 9D6F.tmp 1916 9E1B.tmp 6092 9EA7.tmp 5896 9F44.tmp 3852 9FE0.tmp 1788 A08C.tmp 4176 A109.tmp 1536 A195.tmp 2132 A241.tmp 2916 A2BE.tmp 2472 A35A.tmp 948 A3D7.tmp 4660 A464.tmp 3456 A500.tmp 2012 A5AC.tmp 5148 A648.tmp 1900 A6F4.tmp 2428 A781.tmp 4748 A80E.tmp 3416 A89A.tmp 5172 A946.tmp 4384 A9E2.tmp 480 AA50.tmp 1884 AAFC.tmp 3384 AB98.tmp 592 AC34.tmp 4608 ACD0.tmp 3748 AD4D.tmp 2696 ADDA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 688F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F89A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A08C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1401.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F64D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4252 wrote to memory of 1368 4252 2026-08-04_bd8209c3f3f99e562b3f840c36fb44ec_elex_mafia.exe 89 PID 1368 wrote to memory of 1428 1368 8013.tmp 90 PID 1428 wrote to memory of 3132 1428 81B9.tmp 91 PID 3132 wrote to memory of 5416 3132 8301.tmp 92 PID 5416 wrote to memory of 1836 5416 83CC.tmp 93 PID 1836 wrote to memory of 2888 1836 8469.tmp 94 PID 2888 wrote to memory of 3548 2888 8572.tmp 95 PID 3548 wrote to memory of 1448 3548 862E.tmp 96 PID 1448 wrote to memory of 4156 1448 8708.tmp 97 PID 4156 wrote to memory of 1864 4156 8795.tmp 98 PID 1864 wrote to memory of 5344 1864 8870.tmp 99 PID 5344 wrote to memory of 5236 5344 894B.tmp 100 PID 5236 wrote to memory of 3404 5236 89E7.tmp 101 PID 3404 wrote to memory of 5932 3404 8AA2.tmp 102 PID 5932 wrote to memory of 1236 5932 8B9C.tmp 103 PID 1236 wrote to memory of 2808 1236 8C77.tmp 104 PID 2808 wrote to memory of 3252 2808 8D61.tmp 105 PID 3252 wrote to memory of 1004 3252 8E2D.tmp 106 PID 1004 wrote to memory of 1300 1004 8F27.tmp 107 PID 1300 wrote to memory of 2184 1300 8FC3.tmp 108 PID 2184 wrote to memory of 860 2184 90EC.tmp 109 PID 860 wrote to memory of 3032 860 91B7.tmp 110 PID 3032 wrote to memory of 1392 3032 9263.tmp 111 PID 1392 wrote to memory of 6140 1392 931E.tmp 112 PID 6140 wrote to memory of 4636 6140 93F9.tmp 113 PID 4636 wrote to memory of 3488 4636 94E3.tmp 114 PID 3488 wrote to memory of 3196 3488 95CE.tmp 115 PID 3196 wrote to memory of 4852 3196 967A.tmp 116 PID 4852 wrote to memory of 6040 4852 9754.tmp 117 PID 6040 wrote to memory of 4596 6040 984E.tmp 118 PID 4596 wrote to memory of 3704 4596 990A.tmp 119 PID 3704 wrote to memory of 2064 3704 99D5.tmp 120 PID 2064 wrote to memory of 5464 2064 9AA0.tmp 121 PID 5464 wrote to memory of 4100 5464 9B6B.tmp 122 PID 4100 wrote to memory of 3924 4100 9C27.tmp 123 PID 3924 wrote to memory of 5152 3924 9CE2.tmp 124 PID 5152 wrote to memory of 1916 5152 9D6F.tmp 125 PID 1916 wrote to memory of 6092 1916 9E1B.tmp 126 PID 6092 wrote to memory of 5896 6092 9EA7.tmp 127 PID 5896 wrote to memory of 3852 5896 9F44.tmp 128 PID 3852 wrote to memory of 1788 3852 9FE0.tmp 129 PID 1788 wrote to memory of 4176 1788 A08C.tmp 130 PID 4176 wrote to memory of 1536 4176 A109.tmp 131 PID 1536 wrote to memory of 2132 1536 A195.tmp 132 PID 2132 wrote to memory of 2916 2132 A241.tmp 133 PID 2916 wrote to memory of 2472 2916 A2BE.tmp 134 PID 2472 wrote to memory of 948 2472 A35A.tmp 135 PID 948 wrote to memory of 4660 948 A3D7.tmp 136 PID 4660 wrote to memory of 3456 4660 A464.tmp 137 PID 3456 wrote to memory of 2012 3456 A500.tmp 138 PID 2012 wrote to memory of 5148 2012 A5AC.tmp 139 PID 5148 wrote to memory of 1900 5148 A648.tmp 140 PID 1900 wrote to memory of 2428 1900 A6F4.tmp 141 PID 2428 wrote to memory of 4748 2428 A781.tmp 142 PID 4748 wrote to memory of 3416 4748 A80E.tmp 143 PID 3416 wrote to memory of 5172 3416 A89A.tmp 144 PID 5172 wrote to memory of 4384 5172 A946.tmp 145 PID 4384 wrote to memory of 480 4384 A9E2.tmp 146 PID 480 wrote to memory of 1884 480 AA50.tmp 147 PID 1884 wrote to memory of 3384 1884 AAFC.tmp 148 PID 3384 wrote to memory of 592 3384 AB98.tmp 149 PID 592 wrote to memory of 4608 592 AC34.tmp 150 PID 4608 wrote to memory of 3748 4608 ACD0.tmp 151 PID 3748 wrote to memory of 2696 3748 AD4D.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_bd8209c3f3f99e562b3f840c36fb44ec_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_bd8209c3f3f99e562b3f840c36fb44ec_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8013.tmp"C:\Users\Admin\AppData\Local\Temp\8013.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\81B9.tmp"C:\Users\Admin\AppData\Local\Temp\81B9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\8572.tmp"C:\Users\Admin\AppData\Local\Temp\8572.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\862E.tmp"C:\Users\Admin\AppData\Local\Temp\862E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\8708.tmp"C:\Users\Admin\AppData\Local\Temp\8708.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\8795.tmp"C:\Users\Admin\AppData\Local\Temp\8795.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\8870.tmp"C:\Users\Admin\AppData\Local\Temp\8870.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\90EC.tmp"C:\Users\Admin\AppData\Local\Temp\90EC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\9754.tmp"C:\Users\Admin\AppData\Local\Temp\9754.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\990A.tmp"C:\Users\Admin\AppData\Local\Temp\990A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\99D5.tmp"C:\Users\Admin\AppData\Local\Temp\99D5.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"C:\Users\Admin\AppData\Local\Temp\9AA0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\9F44.tmp"C:\Users\Admin\AppData\Local\Temp\9F44.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\A35A.tmp"C:\Users\Admin\AppData\Local\Temp\A35A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A464.tmp"C:\Users\Admin\AppData\Local\Temp\A464.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\A648.tmp"C:\Users\Admin\AppData\Local\Temp\A648.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\A781.tmp"C:\Users\Admin\AppData\Local\Temp\A781.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A80E.tmp"C:\Users\Admin\AppData\Local\Temp\A80E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\A89A.tmp"C:\Users\Admin\AppData\Local\Temp\A89A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A946.tmp"C:\Users\Admin\AppData\Local\Temp\A946.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\AA50.tmp"C:\Users\Admin\AppData\Local\Temp\AA50.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\AB98.tmp"C:\Users\Admin\AppData\Local\Temp\AB98.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"66⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"67⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"68⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"69⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"70⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"71⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"72⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"73⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"74⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"75⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"76⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"77⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"78⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\B675.tmp"C:\Users\Admin\AppData\Local\Temp\B675.tmp"80⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"82⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"83⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"84⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"85⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"86⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"87⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"88⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"89⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"90⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"91⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"92⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"93⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"94⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"95⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"96⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"97⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"98⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"99⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"100⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"101⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"103⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"106⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"107⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\C634.tmp"C:\Users\Admin\AppData\Local\Temp\C634.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"109⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\C75D.tmp"C:\Users\Admin\AppData\Local\Temp\C75D.tmp"110⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"111⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"112⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"C:\Users\Admin\AppData\Local\Temp\C8F3.tmp"113⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C970.tmp"C:\Users\Admin\AppData\Local\Temp\C970.tmp"114⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"115⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"117⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"118⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"C:\Users\Admin\AppData\Local\Temp\CC3F.tmp"119⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"120⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"121⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"122⤵PID:5588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-