Analysis
- max time kernel
132s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_056f8a1f5154d902a993572b24710e32_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_056f8a1f5154d902a993572b24710e32_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-15_056f8a1f5154d902a993572b24710e32_elex_mafia.exe
- Size 560KB
- Sample260815-g4mk2a1bpf
- SHA256 38d6b54bd2c8801f87b4a8c9ee4b6ef1a0a1a4bdebb28014adca8d1a9f529c01
- MD5 056f8a1f5154d902a993572b24710e32
- SHA1 e109a15f9da3b6ff6f77966564dc655dd209e759
- SHA512 c09062c33608046dce9a7bd8ee63d4e4f5eaaa7e6e137c5f2e6a552c940d6bf3898740acbdc995d35dc13f50f2b93b43c8b3d739a6382bcd457ba1e4ec13089e
- SSDEEP 12288:MlFXOQUDmrC8SX41DikL9lYSivFX3qjuAIZxV:MlUQbC8So1GktYFnqjBIR
- TLSH T12AC4F1137548C0B3E69202304A52DBA52B3F7C75572AA4C73794263DAFB92D1EB3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4100 EB26.tmp 944 EBD2.tmp 4240 ED59.tmp 4092 EEB0.tmp 1016 F121.tmp 3744 F24A.tmp 3444 F383.tmp 4696 F49C.tmp 4712 F5D5.tmp 4192 F6CF.tmp 4808 F7C9.tmp 1616 F8C3.tmp 5076 F9FB.tmp 236 FB14.tmp 4796 FC4D.tmp 4512 FD56.tmp 1076 FE70.tmp 2760 FF5A.tmp 1432 73.tmp 5868 19C.tmp 4836 2C5.tmp 4752 3BF.tmp 720 4F8.tmp 2536 64F.tmp 5180 788.tmp 3772 891.tmp 5824 98B.tmp 1096 AD4.tmp 2424 BCE.tmp 5396 D54.tmp 4628 E4E.tmp 1260 F87.tmp 912 1071.tmp 600 110D.tmp 5628 1207.tmp 1932 1301.tmp 2848 13BD.tmp 4256 1459.tmp 4700 14D6.tmp 964 15B1.tmp 2416 164D.tmp 1944 16E9.tmp 1304 17B4.tmp 4424 189F.tmp 2884 19A8.tmp 4276 1A45.tmp 5728 1B10.tmp 1488 1BFA.tmp 4488 1C96.tmp 4304 1D23.tmp 6032 1DB0.tmp 5336 1E3C.tmp 1240 1EB9.tmp 4116 1F36.tmp 5888 1FC3.tmp 1148 2040.tmp 1248 20CD.tmp 2388 2159.tmp 3296 21D6.tmp 572 2253.tmp 4128 22C1.tmp 5820 234D.tmp 1896 23CA.tmp 1060 2457.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 598B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 346F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B45D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 377C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1203.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21A3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 4100 3328 2026-08-15_056f8a1f5154d902a993572b24710e32_elex_mafia.exe 89 PID 4100 wrote to memory of 944 4100 EB26.tmp 90 PID 944 wrote to memory of 4240 944 EBD2.tmp 91 PID 4240 wrote to memory of 4092 4240 ED59.tmp 92 PID 4092 wrote to memory of 1016 4092 EEB0.tmp 93 PID 1016 wrote to memory of 3744 1016 F121.tmp 94 PID 3744 wrote to memory of 3444 3744 F24A.tmp 95 PID 3444 wrote to memory of 4696 3444 F383.tmp 96 PID 4696 wrote to memory of 4712 4696 F49C.tmp 97 PID 4712 wrote to memory of 4192 4712 F5D5.tmp 98 PID 4192 wrote to memory of 4808 4192 F6CF.tmp 99 PID 4808 wrote to memory of 1616 4808 F7C9.tmp 100 PID 1616 wrote to memory of 5076 1616 F8C3.tmp 101 PID 5076 wrote to memory of 236 5076 F9FB.tmp 102 PID 236 wrote to memory of 4796 236 FB14.tmp 103 PID 4796 wrote to memory of 4512 4796 FC4D.tmp 104 PID 4512 wrote to memory of 1076 4512 FD56.tmp 105 PID 1076 wrote to memory of 2760 1076 FE70.tmp 106 PID 2760 wrote to memory of 1432 2760 FF5A.tmp 107 PID 1432 wrote to memory of 5868 1432 73.tmp 108 PID 5868 wrote to memory of 4836 5868 19C.tmp 109 PID 4836 wrote to memory of 4752 4836 2C5.tmp 110 PID 4752 wrote to memory of 720 4752 3BF.tmp 111 PID 720 wrote to memory of 2536 720 4F8.tmp 112 PID 2536 wrote to memory of 5180 2536 64F.tmp 113 PID 5180 wrote to memory of 3772 5180 788.tmp 114 PID 3772 wrote to memory of 5824 3772 891.tmp 115 PID 5824 wrote to memory of 1096 5824 98B.tmp 116 PID 1096 wrote to memory of 2424 1096 AD4.tmp 117 PID 2424 wrote to memory of 5396 2424 BCE.tmp 118 PID 5396 wrote to memory of 4628 5396 D54.tmp 119 PID 4628 wrote to memory of 1260 4628 E4E.tmp 120 PID 1260 wrote to memory of 912 1260 F87.tmp 121 PID 912 wrote to memory of 600 912 1071.tmp 122 PID 600 wrote to memory of 5628 600 110D.tmp 123 PID 5628 wrote to memory of 1932 5628 1207.tmp 124 PID 1932 wrote to memory of 2848 1932 1301.tmp 125 PID 2848 wrote to memory of 4256 2848 13BD.tmp 126 PID 4256 wrote to memory of 4700 4256 1459.tmp 127 PID 4700 wrote to memory of 964 4700 14D6.tmp 128 PID 964 wrote to memory of 2416 964 15B1.tmp 129 PID 2416 wrote to memory of 1944 2416 164D.tmp 130 PID 1944 wrote to memory of 1304 1944 16E9.tmp 131 PID 1304 wrote to memory of 4424 1304 17B4.tmp 132 PID 4424 wrote to memory of 2884 4424 189F.tmp 133 PID 2884 wrote to memory of 4276 2884 19A8.tmp 134 PID 4276 wrote to memory of 5728 4276 1A45.tmp 135 PID 5728 wrote to memory of 1488 5728 1B10.tmp 136 PID 1488 wrote to memory of 4488 1488 1BFA.tmp 137 PID 4488 wrote to memory of 4304 4488 1C96.tmp 138 PID 4304 wrote to memory of 6032 4304 1D23.tmp 139 PID 6032 wrote to memory of 5336 6032 1DB0.tmp 140 PID 5336 wrote to memory of 1240 5336 1E3C.tmp 141 PID 1240 wrote to memory of 4116 1240 1EB9.tmp 142 PID 4116 wrote to memory of 5888 4116 1F36.tmp 143 PID 5888 wrote to memory of 1148 5888 1FC3.tmp 144 PID 1148 wrote to memory of 1248 1148 2040.tmp 145 PID 1248 wrote to memory of 2388 1248 20CD.tmp 146 PID 2388 wrote to memory of 3296 2388 2159.tmp 147 PID 3296 wrote to memory of 572 3296 21D6.tmp 148 PID 572 wrote to memory of 4128 572 2253.tmp 149 PID 4128 wrote to memory of 5820 4128 22C1.tmp 150 PID 5820 wrote to memory of 1896 5820 234D.tmp 151 PID 1896 wrote to memory of 1060 1896 23CA.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_056f8a1f5154d902a993572b24710e32_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_056f8a1f5154d902a993572b24710e32_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\ED59.tmp"C:\Users\Admin\AppData\Local\Temp\ED59.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\FC4D.tmp"C:\Users\Admin\AppData\Local\Temp\FC4D.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\FD56.tmp"C:\Users\Admin\AppData\Local\Temp\FD56.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\FE70.tmp"C:\Users\Admin\AppData\Local\Temp\FE70.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\73.tmp"C:\Users\Admin\AppData\Local\Temp\73.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\2C5.tmp"C:\Users\Admin\AppData\Local\Temp\2C5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4F8.tmp"C:\Users\Admin\AppData\Local\Temp\4F8.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\64F.tmp"C:\Users\Admin\AppData\Local\Temp\64F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\891.tmp"C:\Users\Admin\AppData\Local\Temp\891.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\98B.tmp"C:\Users\Admin\AppData\Local\Temp\98B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\AD4.tmp"C:\Users\Admin\AppData\Local\Temp\AD4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\E4E.tmp"C:\Users\Admin\AppData\Local\Temp\E4E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1071.tmp"C:\Users\Admin\AppData\Local\Temp\1071.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1207.tmp"C:\Users\Admin\AppData\Local\Temp\1207.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\1301.tmp"C:\Users\Admin\AppData\Local\Temp\1301.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\14D6.tmp"C:\Users\Admin\AppData\Local\Temp\14D6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\17B4.tmp"C:\Users\Admin\AppData\Local\Temp\17B4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\1B10.tmp"C:\Users\Admin\AppData\Local\Temp\1B10.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"C:\Users\Admin\AppData\Local\Temp\1BFA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\1DB0.tmp"C:\Users\Admin\AppData\Local\Temp\1DB0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1F36.tmp"C:\Users\Admin\AppData\Local\Temp\1F36.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\2040.tmp"C:\Users\Admin\AppData\Local\Temp\2040.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\21D6.tmp"C:\Users\Admin\AppData\Local\Temp\21D6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\234D.tmp"C:\Users\Admin\AppData\Local\Temp\234D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\2457.tmp"C:\Users\Admin\AppData\Local\Temp\2457.tmp"65⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"66⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\2560.tmp"C:\Users\Admin\AppData\Local\Temp\2560.tmp"67⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"68⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\265A.tmp"C:\Users\Admin\AppData\Local\Temp\265A.tmp"69⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"70⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"71⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"72⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\287D.tmp"C:\Users\Admin\AppData\Local\Temp\287D.tmp"73⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"74⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\2977.tmp"C:\Users\Admin\AppData\Local\Temp\2977.tmp"75⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"76⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"77⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"78⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"79⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"80⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"81⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\2D11.tmp"C:\Users\Admin\AppData\Local\Temp\2D11.tmp"82⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"83⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"84⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"85⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\2F24.tmp"C:\Users\Admin\AppData\Local\Temp\2F24.tmp"86⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"87⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"88⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\30DA.tmp"C:\Users\Admin\AppData\Local\Temp\30DA.tmp"89⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\3167.tmp"90⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\3212.tmp"C:\Users\Admin\AppData\Local\Temp\3212.tmp"91⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"92⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\32FD.tmp"C:\Users\Admin\AppData\Local\Temp\32FD.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"94⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"95⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"96⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"97⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"98⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"99⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"100⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"101⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\380E.tmp"C:\Users\Admin\AppData\Local\Temp\380E.tmp"102⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\38AA.tmp"C:\Users\Admin\AppData\Local\Temp\38AA.tmp"103⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"104⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\39B4.tmp"C:\Users\Admin\AppData\Local\Temp\39B4.tmp"105⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"106⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"107⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"108⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"109⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"110⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"111⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"113⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"114⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"115⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"116⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"117⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4174.tmp"C:\Users\Admin\AppData\Local\Temp\4174.tmp"118⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\4201.tmp"C:\Users\Admin\AppData\Local\Temp\4201.tmp"119⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"120⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"121⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"122⤵PID:1192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-