Analysis
- max time kernel
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 16:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_019b29b8217d551f04de2c264eb1130b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_019b29b8217d551f04de2c264eb1130b_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-15_019b29b8217d551f04de2c264eb1130b_elex_mafia.exe
- Size 520KB
- Sample260815-t8a41szenf
- SHA256 89d639812054581025fa3743506df9ca94fd9d0676b74b3a6f179c52ffce7512
- MD5 019b29b8217d551f04de2c264eb1130b
- SHA1 d0f16f44f0a7d7c7a7ec5f0dc4130581fe748034
- SHA512 b109415e692763c7b0522e05043072eae03bc9e459686ae54fae5eaed7c60b9a74ee7e9fe3299afb6a45fe55ac8f29b8f920cd0b365c6118f20972d35b8f1233
- SSDEEP 12288:roRXOQjmOyTMqKWdgOKQHZMTEn+Mn3inzUkHNZE:rogQ9y132OvZMT4SgoN6
- TLSH T1BCB4F0127188C036E6D226345B25DFA11B7E7D725B2A92C737C43A6D2EB82C1E778347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4148 7A37.tmp 5324 7AF3.tmp 636 7BAE.tmp 4912 7C79.tmp 472 7D16.tmp 4260 7D93.tmp 2848 7E2F.tmp 4944 7EDB.tmp 2440 7F77.tmp 4120 8061.tmp 4372 81A9.tmp 5588 8217.tmp 236 8301.tmp 4312 83BD.tmp 3468 8478.tmp 240 8543.tmp 2368 85C0.tmp 5108 868B.tmp 4568 8747.tmp 1240 87E3.tmp 5784 8870.tmp 4688 892B.tmp 2648 8A06.tmp 5684 8AD1.tmp 2564 8B6D.tmp 3904 8BFA.tmp 3700 8CB6.tmp 2732 8D42.tmp 1160 8DEE.tmp 4808 8EB9.tmp 2084 8F55.tmp 5952 9040.tmp 1544 910B.tmp 1804 9188.tmp 4480 9215.tmp 3704 92A1.tmp 1052 932E.tmp 4648 93AB.tmp 3260 9428.tmp 2728 9495.tmp 2892 9522.tmp 4520 95BE.tmp 2984 966A.tmp 4852 96D7.tmp 2636 9745.tmp 5596 97C2.tmp 2404 983F.tmp 6140 98BC.tmp 5696 9948.tmp 4960 99D5.tmp 2500 9A52.tmp 5564 9ACF.tmp 4792 9B4C.tmp 4396 9BC9.tmp 4732 9C36.tmp 1928 9CD3.tmp 1880 9D50.tmp 2140 9DDC.tmp 960 9E59.tmp 1628 9ED6.tmp 3328 9F82.tmp 5676 A04D.tmp 944 A0DA.tmp 5760 A176.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D39D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6780.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E41D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C181.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5960 wrote to memory of 4148 5960 2026-08-15_019b29b8217d551f04de2c264eb1130b_elex_mafia.exe 89 PID 4148 wrote to memory of 5324 4148 7A37.tmp 90 PID 5324 wrote to memory of 636 5324 7AF3.tmp 91 PID 636 wrote to memory of 4912 636 7BAE.tmp 92 PID 4912 wrote to memory of 472 4912 7C79.tmp 93 PID 472 wrote to memory of 4260 472 7D16.tmp 94 PID 4260 wrote to memory of 2848 4260 7D93.tmp 95 PID 2848 wrote to memory of 4944 2848 7E2F.tmp 96 PID 4944 wrote to memory of 2440 4944 7EDB.tmp 97 PID 2440 wrote to memory of 4120 2440 7F77.tmp 98 PID 4120 wrote to memory of 4372 4120 8061.tmp 99 PID 4372 wrote to memory of 5588 4372 81A9.tmp 100 PID 5588 wrote to memory of 236 5588 8217.tmp 101 PID 236 wrote to memory of 4312 236 8301.tmp 102 PID 4312 wrote to memory of 3468 4312 83BD.tmp 103 PID 3468 wrote to memory of 240 3468 8478.tmp 104 PID 240 wrote to memory of 2368 240 8543.tmp 105 PID 2368 wrote to memory of 5108 2368 85C0.tmp 106 PID 5108 wrote to memory of 4568 5108 868B.tmp 107 PID 4568 wrote to memory of 1240 4568 8747.tmp 108 PID 1240 wrote to memory of 5784 1240 87E3.tmp 109 PID 5784 wrote to memory of 4688 5784 8870.tmp 110 PID 4688 wrote to memory of 2648 4688 892B.tmp 111 PID 2648 wrote to memory of 5684 2648 8A06.tmp 112 PID 5684 wrote to memory of 2564 5684 8AD1.tmp 113 PID 2564 wrote to memory of 3904 2564 8B6D.tmp 114 PID 3904 wrote to memory of 3700 3904 8BFA.tmp 115 PID 3700 wrote to memory of 2732 3700 8CB6.tmp 116 PID 2732 wrote to memory of 1160 2732 8D42.tmp 117 PID 1160 wrote to memory of 4808 1160 8DEE.tmp 118 PID 4808 wrote to memory of 2084 4808 8EB9.tmp 119 PID 2084 wrote to memory of 5952 2084 8F55.tmp 120 PID 5952 wrote to memory of 1544 5952 9040.tmp 121 PID 1544 wrote to memory of 1804 1544 910B.tmp 122 PID 1804 wrote to memory of 4480 1804 9188.tmp 123 PID 4480 wrote to memory of 3704 4480 9215.tmp 124 PID 3704 wrote to memory of 1052 3704 92A1.tmp 125 PID 1052 wrote to memory of 4648 1052 932E.tmp 126 PID 4648 wrote to memory of 3260 4648 93AB.tmp 127 PID 3260 wrote to memory of 2728 3260 9428.tmp 128 PID 2728 wrote to memory of 2892 2728 9495.tmp 129 PID 2892 wrote to memory of 4520 2892 9522.tmp 130 PID 4520 wrote to memory of 2984 4520 95BE.tmp 131 PID 2984 wrote to memory of 4852 2984 966A.tmp 132 PID 4852 wrote to memory of 2636 4852 96D7.tmp 133 PID 2636 wrote to memory of 5596 2636 9745.tmp 134 PID 5596 wrote to memory of 2404 5596 97C2.tmp 135 PID 2404 wrote to memory of 6140 2404 983F.tmp 136 PID 6140 wrote to memory of 5696 6140 98BC.tmp 137 PID 5696 wrote to memory of 4960 5696 9948.tmp 138 PID 4960 wrote to memory of 2500 4960 99D5.tmp 139 PID 2500 wrote to memory of 5564 2500 9A52.tmp 140 PID 5564 wrote to memory of 4792 5564 9ACF.tmp 141 PID 4792 wrote to memory of 4396 4792 9B4C.tmp 142 PID 4396 wrote to memory of 4732 4396 9BC9.tmp 143 PID 4732 wrote to memory of 1928 4732 9C36.tmp 144 PID 1928 wrote to memory of 1880 1928 9CD3.tmp 145 PID 1880 wrote to memory of 2140 1880 9D50.tmp 146 PID 2140 wrote to memory of 960 2140 9DDC.tmp 147 PID 960 wrote to memory of 1628 960 9E59.tmp 148 PID 1628 wrote to memory of 3328 1628 9ED6.tmp 149 PID 3328 wrote to memory of 5676 3328 9F82.tmp 150 PID 5676 wrote to memory of 944 5676 A04D.tmp 151 PID 944 wrote to memory of 5760 944 A0DA.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_019b29b8217d551f04de2c264eb1130b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_019b29b8217d551f04de2c264eb1130b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\8870.tmp"C:\Users\Admin\AppData\Local\Temp\8870.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8A06.tmp"C:\Users\Admin\AppData\Local\Temp\8A06.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\9188.tmp"C:\Users\Admin\AppData\Local\Temp\9188.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9428.tmp"C:\Users\Admin\AppData\Local\Temp\9428.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\98BC.tmp"C:\Users\Admin\AppData\Local\Temp\98BC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\99D5.tmp"C:\Users\Admin\AppData\Local\Temp\99D5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9A52.tmp"C:\Users\Admin\AppData\Local\Temp\9A52.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9F82.tmp"C:\Users\Admin\AppData\Local\Temp\9F82.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\A04D.tmp"C:\Users\Admin\AppData\Local\Temp\A04D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"65⤵
- Executes dropped EXE
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\A1E3.tmp"C:\Users\Admin\AppData\Local\Temp\A1E3.tmp"66⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A260.tmp"C:\Users\Admin\AppData\Local\Temp\A260.tmp"67⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"68⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\A36A.tmp"C:\Users\Admin\AppData\Local\Temp\A36A.tmp"69⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"70⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"71⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"72⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"73⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"74⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\A697.tmp"C:\Users\Admin\AppData\Local\Temp\A697.tmp"75⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"76⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"77⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A80E.tmp"C:\Users\Admin\AppData\Local\Temp\A80E.tmp"78⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"79⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\A965.tmp"C:\Users\Admin\AppData\Local\Temp\A965.tmp"80⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"81⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"82⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"83⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AB88.tmp"C:\Users\Admin\AppData\Local\Temp\AB88.tmp"84⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"85⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AC92.tmp"C:\Users\Admin\AppData\Local\Temp\AC92.tmp"86⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"87⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"88⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"89⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"90⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"91⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"92⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"93⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"94⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"95⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"96⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"97⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"98⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"99⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"100⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B414.tmp"C:\Users\Admin\AppData\Local\Temp\B414.tmp"101⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"102⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"103⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\B58B.tmp"C:\Users\Admin\AppData\Local\Temp\B58B.tmp"104⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"105⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\B665.tmp"C:\Users\Admin\AppData\Local\Temp\B665.tmp"106⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\B711.tmp"C:\Users\Admin\AppData\Local\Temp\B711.tmp"107⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"108⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"109⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"C:\Users\Admin\AppData\Local\Temp\B8B7.tmp"110⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\B925.tmp"C:\Users\Admin\AppData\Local\Temp\B925.tmp"111⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"112⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"113⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"114⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"115⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"116⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"119⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"120⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"121⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\BE74.tmp"C:\Users\Admin\AppData\Local\Temp\BE74.tmp"122⤵PID:5268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-