Analysis
- max time kernel
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 12:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_86194c783c6a60362e74694e91bff12c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_86194c783c6a60362e74694e91bff12c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-20_86194c783c6a60362e74694e91bff12c_elex_mafia.exe
- Size 560KB
- Sample260820-phhnysdb98
- SHA256 8b50f61fca6c4e39f06ae8a6feb9aab6dd439faeea32286425cf88995cc50177
- MD5 86194c783c6a60362e74694e91bff12c
- SHA1 eaed67f5d1771c6ca57f430c35b7964132501161
- SHA512 8f10242c18b6b89e44d2ec27e026c0b63a1085f38ba0e24b5d7eb8b47c6b905d97fcc2cece176b78dd03d6f12ed4e519ab1ecb3f4cb9f7febaf1f43d08f5b40b
- SSDEEP 12288:MlFXOQUDmrC8SdqYZmzvOKAZ65UvLeRdRQ+PBYI3IZxV:MlUQbC8SdkyKqAUvCRxPN3IR
- TLSH T1B7C4F1227584C073E1A316304A12DBA66B3F7D345B3AA4C73790266EAFB47D0DA7434B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4900 D140.tmp 4324 D279.tmp 4448 D3B1.tmp 2956 D43E.tmp 5196 D5B5.tmp 2764 D72C.tmp 4120 D94F.tmp 1164 DAC6.tmp 4612 DC1E.tmp 5352 DD66.tmp 3048 DE9E.tmp 6088 DFC7.tmp 2808 E14E.tmp 3476 E257.tmp 1316 E3FD.tmp 1212 E526.tmp 4768 E64F.tmp 4648 E759.tmp 1544 E882.tmp 3324 E98B.tmp 5016 EAD3.tmp 3704 EBED.tmp 2392 ED83.tmp 1004 EE8C.tmp 5924 EF96.tmp 5992 F0A0.tmp 1272 F1D8.tmp 5516 F2F1.tmp 5620 F449.tmp 5788 F5D0.tmp 2568 F747.tmp 2088 F88F.tmp 5292 F9F6.tmp 4928 FA83.tmp 1568 FB6D.tmp 3180 FC67.tmp 4980 FD42.tmp 1960 FDEE.tmp 5612 FEA9.tmp 3724 FF84.tmp 5044 20.tmp 2668 11A.tmp 4268 1D6.tmp 2076 282.tmp 5024 35D.tmp 2116 447.tmp 4620 522.tmp 3456 5AE.tmp 5724 64B.tmp 4908 6C8.tmp 5800 754.tmp 1776 7E1.tmp 5312 88D.tmp 4764 90A.tmp 2172 9A6.tmp 3408 A23.tmp 1120 AA0.tmp 2484 B2D.tmp 4704 BB9.tmp 5192 C55.tmp 3788 CD2.tmp 4364 D6F.tmp 4624 E1B.tmp 4148 EA7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 686B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 531E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8019.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D43E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8912.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 345F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 615B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8713.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 4900 1204 2026-08-20_86194c783c6a60362e74694e91bff12c_elex_mafia.exe 88 PID 4900 wrote to memory of 4324 4900 D140.tmp 89 PID 4324 wrote to memory of 4448 4324 D279.tmp 90 PID 4448 wrote to memory of 2956 4448 D3B1.tmp 91 PID 2956 wrote to memory of 5196 2956 D43E.tmp 92 PID 5196 wrote to memory of 2764 5196 D5B5.tmp 93 PID 2764 wrote to memory of 4120 2764 D72C.tmp 94 PID 4120 wrote to memory of 1164 4120 D94F.tmp 95 PID 1164 wrote to memory of 4612 1164 DAC6.tmp 96 PID 4612 wrote to memory of 5352 4612 DC1E.tmp 97 PID 5352 wrote to memory of 3048 5352 DD66.tmp 98 PID 3048 wrote to memory of 6088 3048 DE9E.tmp 99 PID 6088 wrote to memory of 2808 6088 DFC7.tmp 100 PID 2808 wrote to memory of 3476 2808 E14E.tmp 101 PID 3476 wrote to memory of 1316 3476 E257.tmp 102 PID 1316 wrote to memory of 1212 1316 E3FD.tmp 103 PID 1212 wrote to memory of 4768 1212 E526.tmp 104 PID 4768 wrote to memory of 4648 4768 E64F.tmp 105 PID 4648 wrote to memory of 1544 4648 E759.tmp 106 PID 1544 wrote to memory of 3324 1544 E882.tmp 107 PID 3324 wrote to memory of 5016 3324 E98B.tmp 108 PID 5016 wrote to memory of 3704 5016 EAD3.tmp 109 PID 3704 wrote to memory of 2392 3704 EBED.tmp 110 PID 2392 wrote to memory of 1004 2392 ED83.tmp 111 PID 1004 wrote to memory of 5924 1004 EE8C.tmp 112 PID 5924 wrote to memory of 5992 5924 EF96.tmp 113 PID 5992 wrote to memory of 1272 5992 F0A0.tmp 114 PID 1272 wrote to memory of 5516 1272 F1D8.tmp 115 PID 5516 wrote to memory of 5620 5516 F2F1.tmp 116 PID 5620 wrote to memory of 5788 5620 F449.tmp 117 PID 5788 wrote to memory of 2568 5788 F5D0.tmp 118 PID 2568 wrote to memory of 2088 2568 F747.tmp 119 PID 2088 wrote to memory of 5292 2088 F88F.tmp 120 PID 5292 wrote to memory of 4928 5292 F9F6.tmp 121 PID 4928 wrote to memory of 1568 4928 FA83.tmp 122 PID 1568 wrote to memory of 3180 1568 FB6D.tmp 123 PID 3180 wrote to memory of 4980 3180 FC67.tmp 124 PID 4980 wrote to memory of 1960 4980 FD42.tmp 125 PID 1960 wrote to memory of 5612 1960 FDEE.tmp 126 PID 5612 wrote to memory of 3724 5612 FEA9.tmp 127 PID 3724 wrote to memory of 5044 3724 FF84.tmp 128 PID 5044 wrote to memory of 2668 5044 20.tmp 129 PID 2668 wrote to memory of 4268 2668 11A.tmp 130 PID 4268 wrote to memory of 2076 4268 1D6.tmp 131 PID 2076 wrote to memory of 5024 2076 282.tmp 132 PID 5024 wrote to memory of 2116 5024 35D.tmp 133 PID 2116 wrote to memory of 4620 2116 447.tmp 134 PID 4620 wrote to memory of 3456 4620 522.tmp 135 PID 3456 wrote to memory of 5724 3456 5AE.tmp 136 PID 5724 wrote to memory of 4908 5724 64B.tmp 137 PID 4908 wrote to memory of 5800 4908 6C8.tmp 138 PID 5800 wrote to memory of 1776 5800 754.tmp 139 PID 1776 wrote to memory of 5312 1776 7E1.tmp 140 PID 5312 wrote to memory of 4764 5312 88D.tmp 141 PID 4764 wrote to memory of 2172 4764 90A.tmp 142 PID 2172 wrote to memory of 3408 2172 9A6.tmp 143 PID 3408 wrote to memory of 1120 3408 A23.tmp 144 PID 1120 wrote to memory of 2484 1120 AA0.tmp 145 PID 2484 wrote to memory of 4704 2484 B2D.tmp 146 PID 4704 wrote to memory of 5192 4704 BB9.tmp 147 PID 5192 wrote to memory of 3788 5192 C55.tmp 148 PID 3788 wrote to memory of 4364 3788 CD2.tmp 149 PID 4364 wrote to memory of 4624 4364 D6F.tmp 150 PID 4624 wrote to memory of 4148 4624 E1B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_86194c783c6a60362e74694e91bff12c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_86194c783c6a60362e74694e91bff12c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\D279.tmp"C:\Users\Admin\AppData\Local\Temp\D279.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\D43E.tmp"C:\Users\Admin\AppData\Local\Temp\D43E.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\E98B.tmp"C:\Users\Admin\AppData\Local\Temp\E98B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\F747.tmp"C:\Users\Admin\AppData\Local\Temp\F747.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\FEA9.tmp"C:\Users\Admin\AppData\Local\Temp\FEA9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\1D6.tmp"C:\Users\Admin\AppData\Local\Temp\1D6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\282.tmp"C:\Users\Admin\AppData\Local\Temp\282.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\35D.tmp"C:\Users\Admin\AppData\Local\Temp\35D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\6C8.tmp"C:\Users\Admin\AppData\Local\Temp\6C8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\AA0.tmp"C:\Users\Admin\AppData\Local\Temp\AA0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\B2D.tmp"C:\Users\Admin\AppData\Local\Temp\B2D.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\BB9.tmp"C:\Users\Admin\AppData\Local\Temp\BB9.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\C55.tmp"C:\Users\Admin\AppData\Local\Temp\C55.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\D6F.tmp"C:\Users\Admin\AppData\Local\Temp\D6F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"65⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"66⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\FC0.tmp"C:\Users\Admin\AppData\Local\Temp\FC0.tmp"67⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"68⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\10E9.tmp"C:\Users\Admin\AppData\Local\Temp\10E9.tmp"69⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"70⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"71⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"72⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\132B.tmp"C:\Users\Admin\AppData\Local\Temp\132B.tmp"73⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"74⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"75⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\14C2.tmp"C:\Users\Admin\AppData\Local\Temp\14C2.tmp"76⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"77⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"78⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"79⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"80⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"81⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"82⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\18B9.tmp"C:\Users\Admin\AppData\Local\Temp\18B9.tmp"83⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\1975.tmp"C:\Users\Admin\AppData\Local\Temp\1975.tmp"84⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\1A01.tmp"C:\Users\Admin\AppData\Local\Temp\1A01.tmp"85⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"86⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"87⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"88⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\1C44.tmp"C:\Users\Admin\AppData\Local\Temp\1C44.tmp"89⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"90⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"91⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"92⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"93⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"94⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"95⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\203B.tmp"C:\Users\Admin\AppData\Local\Temp\203B.tmp"96⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\20B8.tmp"C:\Users\Admin\AppData\Local\Temp\20B8.tmp"97⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2145.tmp"C:\Users\Admin\AppData\Local\Temp\2145.tmp"98⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\21C2.tmp"C:\Users\Admin\AppData\Local\Temp\21C2.tmp"99⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"100⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\22DB.tmp"C:\Users\Admin\AppData\Local\Temp\22DB.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"102⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\23F4.tmp"C:\Users\Admin\AppData\Local\Temp\23F4.tmp"103⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"104⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"105⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"106⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2608.tmp"C:\Users\Admin\AppData\Local\Temp\2608.tmp"107⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"108⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\2711.tmp"C:\Users\Admin\AppData\Local\Temp\2711.tmp"109⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\278E.tmp"C:\Users\Admin\AppData\Local\Temp\278E.tmp"110⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\281B.tmp"C:\Users\Admin\AppData\Local\Temp\281B.tmp"111⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\28B7.tmp"C:\Users\Admin\AppData\Local\Temp\28B7.tmp"112⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"114⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"115⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\2B09.tmp"C:\Users\Admin\AppData\Local\Temp\2B09.tmp"116⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"117⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"118⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"119⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2D99.tmp"C:\Users\Admin\AppData\Local\Temp\2D99.tmp"120⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\2E06.tmp"C:\Users\Admin\AppData\Local\Temp\2E06.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"122⤵PID:4060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-