Analysis
- max time kernel
112s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_639bf22efd0a80911ecd57393227a6ad_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_639bf22efd0a80911ecd57393227a6ad_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_639bf22efd0a80911ecd57393227a6ad_elex_mafia.exe
- Size 520KB
- Sample260805-w2ymvadd39
- SHA256 39f7efca0fca9edb7666d2dc400c719f4ec141d0393f047f98a05070500762b1
- MD5 639bf22efd0a80911ecd57393227a6ad
- SHA1 55585df044ad7d6a4761ca2c98774b9153dbf516
- SHA512 9c516da9df139dea72a11723f7f40f0995f28d6397c8bd3bb84e007160ae43c6f6e17d29b8a7e2a2bd29102cdd02242ec8fefeca80f79dd8e4578f04e3b72914
- SSDEEP 12288:gj8fuxR21t5i8f1gxPYJ4eDH46h9TdSme0hmSDNZ:gj8fuK1GY1ggr/TdSmbhhDN
- TLSH T1ECB4F1027945C032E9D615324B66DBA21BBE7CB55B3695C337C036AD6FB92C1E27830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4048 7E1F.tmp 456 7EFA.tmp 4676 8052.tmp 3172 8294.tmp 3196 839D.tmp 2932 8497.tmp 2736 85B1.tmp 3648 868B.tmp 1236 8757.tmp 572 8822.tmp 2404 88ED.tmp 3536 89D7.tmp 5260 8A73.tmp 4300 8B3F.tmp 4964 8C48.tmp 1280 8D42.tmp 4720 8E0D.tmp 1660 8F27.tmp 1052 8FF2.tmp 5812 908E.tmp 204 9188.tmp 4408 9292.tmp 2200 93AB.tmp 3496 9457.tmp 3228 9560.tmp 3188 9689.tmp 1408 9764.tmp 1736 983F.tmp 6128 9929.tmp 1356 9A13.tmp 2308 9AEE.tmp 2328 9BE8.tmp 5236 9D01.tmp 2500 9D9E.tmp 2180 9E59.tmp 5792 9F05.tmp 2396 9FE0.tmp 5332 A08C.tmp 2512 A176.tmp 1016 A270.tmp 6100 A30C.tmp 6124 A3C8.tmp 2528 A474.tmp 5876 A500.tmp 4260 A5CB.tmp 3088 A687.tmp 4896 A733.tmp 5500 A7CF.tmp 4816 A87B.tmp 5428 A908.tmp 4756 A994.tmp 1248 AA50.tmp 4228 AADC.tmp 2968 AB79.tmp 1796 AC24.tmp 6032 ACF0.tmp 4984 AD9B.tmp 1196 AE67.tmp 2592 AF12.tmp 1720 AF9F.tmp 864 B02C.tmp 3420 B0C8.tmp 4960 B164.tmp 3348 B1F1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D775.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 908E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8406.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5956 wrote to memory of 4048 5956 2026-08-05_639bf22efd0a80911ecd57393227a6ad_elex_mafia.exe 89 PID 4048 wrote to memory of 456 4048 7E1F.tmp 90 PID 456 wrote to memory of 4676 456 7EFA.tmp 91 PID 4676 wrote to memory of 3172 4676 8052.tmp 92 PID 3172 wrote to memory of 3196 3172 8294.tmp 93 PID 3196 wrote to memory of 2932 3196 839D.tmp 94 PID 2932 wrote to memory of 2736 2932 8497.tmp 95 PID 2736 wrote to memory of 3648 2736 85B1.tmp 96 PID 3648 wrote to memory of 1236 3648 868B.tmp 97 PID 1236 wrote to memory of 572 1236 8757.tmp 98 PID 572 wrote to memory of 2404 572 8822.tmp 99 PID 2404 wrote to memory of 3536 2404 88ED.tmp 100 PID 3536 wrote to memory of 5260 3536 89D7.tmp 101 PID 5260 wrote to memory of 4300 5260 8A73.tmp 102 PID 4300 wrote to memory of 4964 4300 8B3F.tmp 103 PID 4964 wrote to memory of 1280 4964 8C48.tmp 104 PID 1280 wrote to memory of 4720 1280 8D42.tmp 105 PID 4720 wrote to memory of 1660 4720 8E0D.tmp 106 PID 1660 wrote to memory of 1052 1660 8F27.tmp 107 PID 1052 wrote to memory of 5812 1052 8FF2.tmp 108 PID 5812 wrote to memory of 204 5812 908E.tmp 109 PID 204 wrote to memory of 4408 204 9188.tmp 110 PID 4408 wrote to memory of 2200 4408 9292.tmp 111 PID 2200 wrote to memory of 3496 2200 93AB.tmp 112 PID 3496 wrote to memory of 3228 3496 9457.tmp 113 PID 3228 wrote to memory of 3188 3228 9560.tmp 114 PID 3188 wrote to memory of 1408 3188 9689.tmp 115 PID 1408 wrote to memory of 1736 1408 9764.tmp 116 PID 1736 wrote to memory of 6128 1736 983F.tmp 117 PID 6128 wrote to memory of 1356 6128 9929.tmp 118 PID 1356 wrote to memory of 2308 1356 9A13.tmp 119 PID 2308 wrote to memory of 2328 2308 9AEE.tmp 120 PID 2328 wrote to memory of 5236 2328 9BE8.tmp 121 PID 5236 wrote to memory of 2500 5236 9D01.tmp 122 PID 2500 wrote to memory of 2180 2500 9D9E.tmp 123 PID 2180 wrote to memory of 5792 2180 9E59.tmp 124 PID 5792 wrote to memory of 2396 5792 9F05.tmp 125 PID 2396 wrote to memory of 5332 2396 9FE0.tmp 126 PID 5332 wrote to memory of 2512 5332 A08C.tmp 127 PID 2512 wrote to memory of 1016 2512 A176.tmp 128 PID 1016 wrote to memory of 6100 1016 A270.tmp 129 PID 6100 wrote to memory of 6124 6100 A30C.tmp 130 PID 6124 wrote to memory of 2528 6124 A3C8.tmp 131 PID 2528 wrote to memory of 5876 2528 A474.tmp 132 PID 5876 wrote to memory of 4260 5876 A500.tmp 133 PID 4260 wrote to memory of 3088 4260 A5CB.tmp 134 PID 3088 wrote to memory of 4896 3088 A687.tmp 135 PID 4896 wrote to memory of 5500 4896 A733.tmp 136 PID 5500 wrote to memory of 4816 5500 A7CF.tmp 137 PID 4816 wrote to memory of 5428 4816 A87B.tmp 138 PID 5428 wrote to memory of 4756 5428 A908.tmp 139 PID 4756 wrote to memory of 1248 4756 A994.tmp 140 PID 1248 wrote to memory of 4228 1248 AA50.tmp 141 PID 4228 wrote to memory of 2968 4228 AADC.tmp 142 PID 2968 wrote to memory of 1796 2968 AB79.tmp 143 PID 1796 wrote to memory of 6032 1796 AC24.tmp 144 PID 6032 wrote to memory of 4984 6032 ACF0.tmp 145 PID 4984 wrote to memory of 1196 4984 AD9B.tmp 146 PID 1196 wrote to memory of 2592 1196 AE67.tmp 147 PID 2592 wrote to memory of 1720 2592 AF12.tmp 148 PID 1720 wrote to memory of 864 1720 AF9F.tmp 149 PID 864 wrote to memory of 3420 864 B02C.tmp 150 PID 3420 wrote to memory of 4960 3420 B0C8.tmp 151 PID 4960 wrote to memory of 3348 4960 B164.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_639bf22efd0a80911ecd57393227a6ad_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_639bf22efd0a80911ecd57393227a6ad_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8052.tmp"C:\Users\Admin\AppData\Local\Temp\8052.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\8294.tmp"C:\Users\Admin\AppData\Local\Temp\8294.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\839D.tmp"C:\Users\Admin\AppData\Local\Temp\839D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\8497.tmp"C:\Users\Admin\AppData\Local\Temp\8497.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8FF2.tmp"C:\Users\Admin\AppData\Local\Temp\8FF2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\9188.tmp"C:\Users\Admin\AppData\Local\Temp\9188.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\9292.tmp"C:\Users\Admin\AppData\Local\Temp\9292.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\9560.tmp"C:\Users\Admin\AppData\Local\Temp\9560.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\9689.tmp"C:\Users\Admin\AppData\Local\Temp\9689.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\9D01.tmp"C:\Users\Admin\AppData\Local\Temp\9D01.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\A30C.tmp"C:\Users\Admin\AppData\Local\Temp\A30C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\A687.tmp"C:\Users\Admin\AppData\Local\Temp\A687.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\A733.tmp"C:\Users\Admin\AppData\Local\Temp\A733.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\A87B.tmp"C:\Users\Admin\AppData\Local\Temp\A87B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\A908.tmp"C:\Users\Admin\AppData\Local\Temp\A908.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\A994.tmp"C:\Users\Admin\AppData\Local\Temp\A994.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\AA50.tmp"C:\Users\Admin\AppData\Local\Temp\AA50.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\AB79.tmp"C:\Users\Admin\AppData\Local\Temp\AB79.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"65⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"66⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"67⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\B433.tmp"C:\Users\Admin\AppData\Local\Temp\B433.tmp"68⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"69⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\B57B.tmp"C:\Users\Admin\AppData\Local\Temp\B57B.tmp"70⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"71⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"72⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"73⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"74⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"75⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"76⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"77⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"78⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\BB28.tmp"C:\Users\Admin\AppData\Local\Temp\BB28.tmp"79⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"80⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"81⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"82⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"83⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"84⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"85⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\C01A.tmp"C:\Users\Admin\AppData\Local\Temp\C01A.tmp"87⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"88⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"89⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"91⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"93⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"94⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\C46F.tmp"C:\Users\Admin\AppData\Local\Temp\C46F.tmp"95⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"97⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\C634.tmp"C:\Users\Admin\AppData\Local\Temp\C634.tmp"98⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"99⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"100⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\C896.tmp"C:\Users\Admin\AppData\Local\Temp\C896.tmp"102⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"103⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"104⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"105⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"106⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"108⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"110⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"111⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\CE43.tmp"C:\Users\Admin\AppData\Local\Temp\CE43.tmp"112⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"114⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"115⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"116⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"117⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"118⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\D22B.tmp"C:\Users\Admin\AppData\Local\Temp\D22B.tmp"119⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"120⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"121⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"122⤵PID:1560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-