Analysis
- max time kernel
131s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-26_f151043bdd2190b46fefb55a57073db8_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-26_f151043bdd2190b46fefb55a57073db8_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-26_f151043bdd2190b46fefb55a57073db8_elex_mafia.exe
- Size 816KB
- Sample260827-dnbl2sxtbw
- SHA256 2b5fa587cfd95ceeb5bd35a0044d58867bf7d6d03eec453dc1cd9721823b4bd7
- MD5 f151043bdd2190b46fefb55a57073db8
- SHA1 6424e70f5990236120b4e0ff9078018bf8aceeac
- SHA512 5d349518d006f5d81e1778c35b3535a430fb1487c11f620908bbad9d830434f83e4a21c08a9d3f9da08ed5cd6e913dee37afe2c8bbb02df375a7fc51f5da83a5
- SSDEEP 6144:2fzZD/P+lZs2rdEkyc54b8DsanxRl9DZcL0EdhndOfix4Pu8Evsq9UlGoG5mNyTD:+mF/W8Dsy3bEndOqx4W8EnG1KMNk3Z
- TLSH T1BD05F125B648C032E69301340A6AEF96097ABD654B27A5C77BE0376D6FF43D2DA35303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4828 620.tmp 3308 6CC.tmp 1492 7B7.tmp 3336 843.tmp 4664 92E.tmp 2596 9CA.tmp 1848 A76.tmp 4072 B31.tmp 5632 C3B.tmp 2792 D45.tmp 2136 DE1.tmp 1132 EFA.tmp 4640 FE4.tmp 2268 10A0.tmp 888 115B.tmp 2496 1265.tmp 2704 1301.tmp 5072 13EC.tmp 264 1498.tmp 4532 1563.tmp 4344 163D.tmp 5520 16BA.tmp 3440 17B4.tmp 772 1851.tmp 5560 18FD.tmp 5664 1989.tmp 5488 1A45.tmp 1076 1AF1.tmp 1576 1BBC.tmp 5616 1C77.tmp 3008 1D71.tmp 4932 1E3C.tmp 3128 1EE8.tmp 5712 1F84.tmp 2960 2030.tmp 5820 20CD.tmp 2920 214A.tmp 1760 21D6.tmp 5620 2263.tmp 2628 22EF.tmp 1732 238C.tmp 1272 2409.tmp 2448 2486.tmp 1516 2512.tmp 2404 258F.tmp 1968 25FD.tmp 1524 267A.tmp 2480 26F7.tmp 3872 2783.tmp 1644 2800.tmp 5364 287D.tmp 3480 28FA.tmp 3964 2997.tmp 2720 2A23.tmp 2736 2A91.tmp 3764 2B1D.tmp 5892 2BAA.tmp 5952 2C36.tmp 4632 2CD3.tmp 2848 2D30.tmp 1740 2DAD.tmp 4496 2E3A.tmp 2248 2EB7.tmp 4540 2F34.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 643E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 762B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 367.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 937C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9CC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4828 1208 2026-08-26_f151043bdd2190b46fefb55a57073db8_elex_mafia.exe 89 PID 4828 wrote to memory of 3308 4828 620.tmp 90 PID 3308 wrote to memory of 1492 3308 6CC.tmp 91 PID 1492 wrote to memory of 3336 1492 7B7.tmp 92 PID 3336 wrote to memory of 4664 3336 843.tmp 93 PID 4664 wrote to memory of 2596 4664 92E.tmp 94 PID 2596 wrote to memory of 1848 2596 9CA.tmp 95 PID 1848 wrote to memory of 4072 1848 A76.tmp 96 PID 4072 wrote to memory of 5632 4072 B31.tmp 97 PID 5632 wrote to memory of 2792 5632 C3B.tmp 98 PID 2792 wrote to memory of 2136 2792 D45.tmp 99 PID 2136 wrote to memory of 1132 2136 DE1.tmp 100 PID 1132 wrote to memory of 4640 1132 EFA.tmp 101 PID 4640 wrote to memory of 2268 4640 FE4.tmp 102 PID 2268 wrote to memory of 888 2268 10A0.tmp 103 PID 888 wrote to memory of 2496 888 115B.tmp 104 PID 2496 wrote to memory of 2704 2496 1265.tmp 105 PID 2704 wrote to memory of 5072 2704 1301.tmp 106 PID 5072 wrote to memory of 264 5072 13EC.tmp 107 PID 264 wrote to memory of 4532 264 1498.tmp 108 PID 4532 wrote to memory of 4344 4532 1563.tmp 109 PID 4344 wrote to memory of 5520 4344 163D.tmp 110 PID 5520 wrote to memory of 3440 5520 16BA.tmp 111 PID 3440 wrote to memory of 772 3440 17B4.tmp 112 PID 772 wrote to memory of 5560 772 1851.tmp 113 PID 5560 wrote to memory of 5664 5560 18FD.tmp 114 PID 5664 wrote to memory of 5488 5664 1989.tmp 115 PID 5488 wrote to memory of 1076 5488 1A45.tmp 116 PID 1076 wrote to memory of 1576 1076 1AF1.tmp 117 PID 1576 wrote to memory of 5616 1576 1BBC.tmp 118 PID 5616 wrote to memory of 3008 5616 1C77.tmp 119 PID 3008 wrote to memory of 4932 3008 1D71.tmp 120 PID 4932 wrote to memory of 3128 4932 1E3C.tmp 121 PID 3128 wrote to memory of 5712 3128 1EE8.tmp 122 PID 5712 wrote to memory of 2960 5712 1F84.tmp 123 PID 2960 wrote to memory of 5820 2960 2030.tmp 124 PID 5820 wrote to memory of 2920 5820 20CD.tmp 125 PID 2920 wrote to memory of 1760 2920 214A.tmp 126 PID 1760 wrote to memory of 5620 1760 21D6.tmp 127 PID 5620 wrote to memory of 2628 5620 2263.tmp 128 PID 2628 wrote to memory of 1732 2628 22EF.tmp 129 PID 1732 wrote to memory of 1272 1732 238C.tmp 130 PID 1272 wrote to memory of 2448 1272 2409.tmp 131 PID 2448 wrote to memory of 1516 2448 2486.tmp 132 PID 1516 wrote to memory of 2404 1516 2512.tmp 133 PID 2404 wrote to memory of 1968 2404 258F.tmp 134 PID 1968 wrote to memory of 1524 1968 25FD.tmp 135 PID 1524 wrote to memory of 2480 1524 267A.tmp 136 PID 2480 wrote to memory of 3872 2480 26F7.tmp 137 PID 3872 wrote to memory of 1644 3872 2783.tmp 138 PID 1644 wrote to memory of 5364 1644 2800.tmp 139 PID 5364 wrote to memory of 3480 5364 287D.tmp 140 PID 3480 wrote to memory of 3964 3480 28FA.tmp 141 PID 3964 wrote to memory of 2720 3964 2997.tmp 142 PID 2720 wrote to memory of 2736 2720 2A23.tmp 143 PID 2736 wrote to memory of 3764 2736 2A91.tmp 144 PID 3764 wrote to memory of 5892 3764 2B1D.tmp 145 PID 5892 wrote to memory of 5952 5892 2BAA.tmp 146 PID 5952 wrote to memory of 4632 5952 2C36.tmp 147 PID 4632 wrote to memory of 2848 4632 2CD3.tmp 148 PID 2848 wrote to memory of 1740 2848 2D30.tmp 149 PID 1740 wrote to memory of 4496 1740 2DAD.tmp 150 PID 4496 wrote to memory of 2248 4496 2E3A.tmp 151 PID 2248 wrote to memory of 4540 2248 2EB7.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-26_f151043bdd2190b46fefb55a57073db8_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f151043bdd2190b46fefb55a57073db8_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\620.tmp"C:\Users\Admin\AppData\Local\Temp\620.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B31.tmp"C:\Users\Admin\AppData\Local\Temp\B31.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\C3B.tmp"C:\Users\Admin\AppData\Local\Temp\C3B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\D45.tmp"C:\Users\Admin\AppData\Local\Temp\D45.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\DE1.tmp"C:\Users\Admin\AppData\Local\Temp\DE1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\FE4.tmp"C:\Users\Admin\AppData\Local\Temp\FE4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\10A0.tmp"C:\Users\Admin\AppData\Local\Temp\10A0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\115B.tmp"C:\Users\Admin\AppData\Local\Temp\115B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\1301.tmp"C:\Users\Admin\AppData\Local\Temp\1301.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\17B4.tmp"C:\Users\Admin\AppData\Local\Temp\17B4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\1C77.tmp"C:\Users\Admin\AppData\Local\Temp\1C77.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\2030.tmp"C:\Users\Admin\AppData\Local\Temp\2030.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\214A.tmp"C:\Users\Admin\AppData\Local\Temp\214A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\21D6.tmp"C:\Users\Admin\AppData\Local\Temp\21D6.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2263.tmp"C:\Users\Admin\AppData\Local\Temp\2263.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\238C.tmp"C:\Users\Admin\AppData\Local\Temp\238C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\2486.tmp"C:\Users\Admin\AppData\Local\Temp\2486.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\258F.tmp"C:\Users\Admin\AppData\Local\Temp\258F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\287D.tmp"C:\Users\Admin\AppData\Local\Temp\287D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2A91.tmp"C:\Users\Admin\AppData\Local\Temp\2A91.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\2C36.tmp"C:\Users\Admin\AppData\Local\Temp\2C36.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"65⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"66⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"67⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"68⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"69⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"70⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"71⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:472 -
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"73⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"75⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"76⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\352F.tmp"C:\Users\Admin\AppData\Local\Temp\352F.tmp"77⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\35BC.tmp"C:\Users\Admin\AppData\Local\Temp\35BC.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3649.tmp"C:\Users\Admin\AppData\Local\Temp\3649.tmp"79⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"80⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"81⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"82⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\385C.tmp"C:\Users\Admin\AppData\Local\Temp\385C.tmp"83⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\3946.tmp"C:\Users\Admin\AppData\Local\Temp\3946.tmp"85⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"86⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"88⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"89⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"90⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"92⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"93⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"95⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"96⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3F41.tmp"C:\Users\Admin\AppData\Local\Temp\3F41.tmp"97⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"98⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"99⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"100⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4126.tmp"C:\Users\Admin\AppData\Local\Temp\4126.tmp"101⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\41D2.tmp"C:\Users\Admin\AppData\Local\Temp\41D2.tmp"102⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"103⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\42CC.tmp"C:\Users\Admin\AppData\Local\Temp\42CC.tmp"104⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"105⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"106⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"107⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"108⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"109⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"110⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\4666.tmp"C:\Users\Admin\AppData\Local\Temp\4666.tmp"111⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\46F2.tmp"C:\Users\Admin\AppData\Local\Temp\46F2.tmp"112⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\476F.tmp"C:\Users\Admin\AppData\Local\Temp\476F.tmp"113⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"114⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\4869.tmp"C:\Users\Admin\AppData\Local\Temp\4869.tmp"115⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"116⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\4982.tmp"C:\Users\Admin\AppData\Local\Temp\4982.tmp"117⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"118⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"119⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\4B09.tmp"C:\Users\Admin\AppData\Local\Temp\4B09.tmp"120⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\4B96.tmp"C:\Users\Admin\AppData\Local\Temp\4B96.tmp"121⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"122⤵PID:5756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-