Analysis
- max time kernel
124s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-13_e4f4ecd08f175ebe18aa558b8ce87135_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_e4f4ecd08f175ebe18aa558b8ce87135_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-13_e4f4ecd08f175ebe18aa558b8ce87135_elex_mafia.exe
- Size 524KB
- Sample260813-jsb19stvbt
- SHA256 96c6f745fcc87f83fae30c10a17f7afdffbe7a7cbbc3a13ab297eba428ca6aec
- MD5 e4f4ecd08f175ebe18aa558b8ce87135
- SHA1 15d1d8b6084d457d595e3f917c2e164f464889c2
- SHA512 98e0bef6b80e9e45fff16c4a3682401773fd2a75889751db407af92c8052ef1be40bf4d6a6d441860e952738938de56694324256f26ce6cb6f94188554caff23
- SSDEEP 12288:TRyZzqyL66TMkbzpEJZ3/WqnRfO2zjZ/sjMQcvqq7dNZ:TRyQylTRb9s/DxHZvXZN
- TLSH T1AFB4F016B585C032E6D201324F6AEBA1597A7D719B2664CB3BD5367E2EF03D093B430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 476 8A35.tmp 3492 8B3F.tmp 2332 8C39.tmp 4612 8DA0.tmp 1828 8EAA.tmp 2712 9011.tmp 256 9169.tmp 4704 9282.tmp 4516 931E.tmp 2616 9437.tmp 1932 9551.tmp 1804 963B.tmp 5884 9774.tmp 1996 986E.tmp 1632 9977.tmp 3552 9AB0.tmp 3368 9BE8.tmp 704 9CB3.tmp 4532 9DBD.tmp 4356 9EE6.tmp 3020 A01E.tmp 2796 A109.tmp 3444 A222.tmp 856 A34B.tmp 5368 A435.tmp 3668 A56E.tmp 4216 A6E5.tmp 5312 A7B0.tmp 2864 A88B.tmp 4240 A965.tmp 1524 AA6F.tmp 5352 AB69.tmp 1612 AC82.tmp 1476 AD0F.tmp 2108 AD9B.tmp 4264 AE38.tmp 5264 AEF3.tmp 4492 AF70.tmp 3112 B00C.tmp 1780 B0F7.tmp 4512 B1A3.tmp 4788 B22F.tmp 2248 B2BC.tmp 4596 B349.tmp 5540 B3C6.tmp 4536 B462.tmp 3172 B54C.tmp 5624 B5F8.tmp 1860 B6B4.tmp 2512 B740.tmp 4844 B7BD.tmp 5020 B83A.tmp 4488 B8A8.tmp 1988 B925.tmp 360 B992.tmp 5012 B9FF.tmp 3328 BAAB.tmp 1324 BB38.tmp 5048 BBB5.tmp 5276 BC22.tmp 2772 BC90.tmp 6136 BCFD.tmp 1800 BD6A.tmp 5280 BDF7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 688F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A52A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 328B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F03D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4051.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 146F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9694.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2996 wrote to memory of 476 2996 2026-08-13_e4f4ecd08f175ebe18aa558b8ce87135_elex_mafia.exe 90 PID 476 wrote to memory of 3492 476 8A35.tmp 91 PID 3492 wrote to memory of 2332 3492 8B3F.tmp 92 PID 2332 wrote to memory of 4612 2332 8C39.tmp 93 PID 4612 wrote to memory of 1828 4612 8DA0.tmp 94 PID 1828 wrote to memory of 2712 1828 8EAA.tmp 95 PID 2712 wrote to memory of 256 2712 9011.tmp 96 PID 256 wrote to memory of 4704 256 9169.tmp 97 PID 4704 wrote to memory of 4516 4704 9282.tmp 98 PID 4516 wrote to memory of 2616 4516 931E.tmp 99 PID 2616 wrote to memory of 1932 2616 9437.tmp 100 PID 1932 wrote to memory of 1804 1932 9551.tmp 101 PID 1804 wrote to memory of 5884 1804 963B.tmp 102 PID 5884 wrote to memory of 1996 5884 9774.tmp 103 PID 1996 wrote to memory of 1632 1996 986E.tmp 104 PID 1632 wrote to memory of 3552 1632 9977.tmp 105 PID 3552 wrote to memory of 3368 3552 9AB0.tmp 106 PID 3368 wrote to memory of 704 3368 9BE8.tmp 107 PID 704 wrote to memory of 4532 704 9CB3.tmp 108 PID 4532 wrote to memory of 4356 4532 9DBD.tmp 109 PID 4356 wrote to memory of 3020 4356 9EE6.tmp 110 PID 3020 wrote to memory of 2796 3020 A01E.tmp 111 PID 2796 wrote to memory of 3444 2796 A109.tmp 112 PID 3444 wrote to memory of 856 3444 A222.tmp 113 PID 856 wrote to memory of 5368 856 A34B.tmp 114 PID 5368 wrote to memory of 3668 5368 A435.tmp 115 PID 3668 wrote to memory of 4216 3668 A56E.tmp 116 PID 4216 wrote to memory of 5312 4216 A6E5.tmp 117 PID 5312 wrote to memory of 2864 5312 A7B0.tmp 118 PID 2864 wrote to memory of 4240 2864 A88B.tmp 119 PID 4240 wrote to memory of 1524 4240 A965.tmp 120 PID 1524 wrote to memory of 5352 1524 AA6F.tmp 121 PID 5352 wrote to memory of 1612 5352 AB69.tmp 122 PID 1612 wrote to memory of 1476 1612 AC82.tmp 123 PID 1476 wrote to memory of 2108 1476 AD0F.tmp 124 PID 2108 wrote to memory of 4264 2108 AD9B.tmp 125 PID 4264 wrote to memory of 5264 4264 AE38.tmp 126 PID 5264 wrote to memory of 4492 5264 AEF3.tmp 127 PID 4492 wrote to memory of 3112 4492 AF70.tmp 128 PID 3112 wrote to memory of 1780 3112 B00C.tmp 129 PID 1780 wrote to memory of 4512 1780 B0F7.tmp 130 PID 4512 wrote to memory of 4788 4512 B1A3.tmp 131 PID 4788 wrote to memory of 2248 4788 B22F.tmp 132 PID 2248 wrote to memory of 4596 2248 B2BC.tmp 133 PID 4596 wrote to memory of 5540 4596 B349.tmp 134 PID 5540 wrote to memory of 4536 5540 B3C6.tmp 135 PID 4536 wrote to memory of 3172 4536 B462.tmp 136 PID 3172 wrote to memory of 5624 3172 B54C.tmp 137 PID 5624 wrote to memory of 1860 5624 B5F8.tmp 138 PID 1860 wrote to memory of 2512 1860 B6B4.tmp 139 PID 2512 wrote to memory of 4844 2512 B740.tmp 140 PID 4844 wrote to memory of 5020 4844 B7BD.tmp 141 PID 5020 wrote to memory of 4488 5020 B83A.tmp 142 PID 4488 wrote to memory of 1988 4488 B8A8.tmp 143 PID 1988 wrote to memory of 360 1988 B925.tmp 144 PID 360 wrote to memory of 5012 360 B992.tmp 145 PID 5012 wrote to memory of 3328 5012 B9FF.tmp 146 PID 3328 wrote to memory of 1324 3328 BAAB.tmp 147 PID 1324 wrote to memory of 5048 1324 BB38.tmp 148 PID 5048 wrote to memory of 5276 5048 BBB5.tmp 149 PID 5276 wrote to memory of 2772 5276 BC22.tmp 150 PID 2772 wrote to memory of 6136 2772 BC90.tmp 151 PID 6136 wrote to memory of 1800 6136 BCFD.tmp 152 PID 1800 wrote to memory of 5280 1800 BD6A.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_e4f4ecd08f175ebe18aa558b8ce87135_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e4f4ecd08f175ebe18aa558b8ce87135_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8A35.tmp"C:\Users\Admin\AppData\Local\Temp\8A35.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\9282.tmp"C:\Users\Admin\AppData\Local\Temp\9282.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9774.tmp"C:\Users\Admin\AppData\Local\Temp\9774.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9977.tmp"C:\Users\Admin\AppData\Local\Temp\9977.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A222.tmp"C:\Users\Admin\AppData\Local\Temp\A222.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\A34B.tmp"C:\Users\Admin\AppData\Local\Temp\A34B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A435.tmp"C:\Users\Admin\AppData\Local\Temp\A435.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\A965.tmp"C:\Users\Admin\AppData\Local\Temp\A965.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\AE38.tmp"C:\Users\Admin\AppData\Local\Temp\AE38.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"C:\Users\Admin\AppData\Local\Temp\AEF3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\AF70.tmp"C:\Users\Admin\AppData\Local\Temp\AF70.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\B54C.tmp"C:\Users\Admin\AppData\Local\Temp\B54C.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\B740.tmp"C:\Users\Admin\AppData\Local\Temp\B740.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\B925.tmp"C:\Users\Admin\AppData\Local\Temp\B925.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\B992.tmp"C:\Users\Admin\AppData\Local\Temp\B992.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\BB38.tmp"C:\Users\Admin\AppData\Local\Temp\BB38.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\BC22.tmp"C:\Users\Admin\AppData\Local\Temp\BC22.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\BC90.tmp"C:\Users\Admin\AppData\Local\Temp\BC90.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"C:\Users\Admin\AppData\Local\Temp\BCFD.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"65⤵
- Executes dropped EXE
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\BE64.tmp"C:\Users\Admin\AppData\Local\Temp\BE64.tmp"66⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"67⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"68⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C058.tmp"C:\Users\Admin\AppData\Local\Temp\C058.tmp"70⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"71⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\C162.tmp"C:\Users\Admin\AppData\Local\Temp\C162.tmp"72⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"73⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\C25C.tmp"C:\Users\Admin\AppData\Local\Temp\C25C.tmp"74⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"75⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"76⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"77⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\C450.tmp"C:\Users\Admin\AppData\Local\Temp\C450.tmp"78⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"79⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"80⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"81⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\C692.tmp"C:\Users\Admin\AppData\Local\Temp\C692.tmp"82⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"83⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"84⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"85⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"87⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"88⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"89⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"90⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"91⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\CB74.tmp"C:\Users\Admin\AppData\Local\Temp\CB74.tmp"92⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"94⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"95⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"96⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"97⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"98⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"C:\Users\Admin\AppData\Local\Temp\CEEF.tmp"99⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"100⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"101⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"102⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"103⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"104⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"105⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"106⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"107⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"108⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"109⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"110⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"111⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"C:\Users\Admin\AppData\Local\Temp\D5F4.tmp"113⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\D680.tmp"C:\Users\Admin\AppData\Local\Temp\D680.tmp"114⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"115⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\D77A.tmp"C:\Users\Admin\AppData\Local\Temp\D77A.tmp"116⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"117⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"118⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"119⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"120⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"121⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"122⤵PID:5832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-