Analysis
- max time kernel
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-31_ccbe8dd1462b3d1991d4f8b74250acab_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_ccbe8dd1462b3d1991d4f8b74250acab_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-31_ccbe8dd1462b3d1991d4f8b74250acab_elex_mafia.exe
- Size 520KB
- Sample260831-ryjmasterh
- SHA256 7f63ce5e1a761ba7e18f41dcc2ca65ba36f260f32ea7f35bbf996c8e80e1320f
- MD5 ccbe8dd1462b3d1991d4f8b74250acab
- SHA1 3f1c4e0447348eed7fc2b4020d4ed350f9c019fb
- SHA512 63b70bc4e0c7dbdfb84b3688966e36ade90e9042ec58a7580ab9a6494afac917c61dfc68b9650b3ffd871115c26ce6a99386abedd03c26c51d3dc77fae452c49
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLvpJxFzhC74VtMIdmF0bzZ0AnTEst46r5sH3d6:roRXOQjmOyBjF1oIqaNxEsG6SNZE
- TLSH T1B0B4F1127089C036E58221348B26DF615A3EBD375B2A96C73BC43A6DAFF42D1E674347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4304 F488.tmp 2164 F505.tmp 1268 F5DF.tmp 4584 F6E9.tmp 4672 F7B4.tmp 4660 F831.tmp 2984 F8BE.tmp 5316 F96A.tmp 5000 FA35.tmp 2676 FAB2.tmp 4520 FB3E.tmp 5736 FBCB.tmp 3708 FC96.tmp 2072 FD32.tmp 2936 FDCF.tmp 5704 FE7B.tmp 3476 FF07.tmp 4912 FFC3.tmp 4948 5F.tmp 5392 FB.tmp 1408 1B7.tmp 3260 253.tmp 2016 2FF.tmp 2448 3BA.tmp 2768 466.tmp 3008 531.tmp 3404 5CE.tmp 5788 65A.tmp 2360 6E7.tmp 4664 7D1.tmp 5460 88D.tmp 3944 948.tmp 4348 A13.tmp 2732 AA0.tmp 5412 B0D.tmp 5992 B8A.tmp 960 BF8.tmp 2624 C75.tmp 5140 D01.tmp 3336 D6F.tmp 1932 DEC.tmp 1076 E69.tmp 1736 EF5.tmp 1044 F63.tmp 3932 FE0.tmp 4824 106C.tmp 3064 10F9.tmp 8 1176.tmp 4208 11F3.tmp 2824 128F.tmp 808 130C.tmp 4376 137A.tmp 5824 1406.tmp 4380 1483.tmp 4216 1500.tmp 2288 156E.tmp 1940 15DB.tmp 1116 1677.tmp 5108 1704.tmp 1660 1790.tmp 476 17FE.tmp 2388 189A.tmp 4768 1917.tmp 4052 1994.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9382.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E03F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E897.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F171.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 351B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 489E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 4304 2680 2026-08-31_ccbe8dd1462b3d1991d4f8b74250acab_elex_mafia.exe 88 PID 4304 wrote to memory of 2164 4304 F488.tmp 89 PID 2164 wrote to memory of 1268 2164 F505.tmp 90 PID 1268 wrote to memory of 4584 1268 F5DF.tmp 91 PID 4584 wrote to memory of 4672 4584 F6E9.tmp 92 PID 4672 wrote to memory of 4660 4672 F7B4.tmp 93 PID 4660 wrote to memory of 2984 4660 F831.tmp 94 PID 2984 wrote to memory of 5316 2984 F8BE.tmp 95 PID 5316 wrote to memory of 5000 5316 F96A.tmp 96 PID 5000 wrote to memory of 2676 5000 FA35.tmp 97 PID 2676 wrote to memory of 4520 2676 FAB2.tmp 98 PID 4520 wrote to memory of 5736 4520 FB3E.tmp 99 PID 5736 wrote to memory of 3708 5736 FBCB.tmp 100 PID 3708 wrote to memory of 2072 3708 FC96.tmp 101 PID 2072 wrote to memory of 2936 2072 FD32.tmp 102 PID 2936 wrote to memory of 5704 2936 FDCF.tmp 103 PID 5704 wrote to memory of 3476 5704 FE7B.tmp 104 PID 3476 wrote to memory of 4912 3476 FF07.tmp 105 PID 4912 wrote to memory of 4948 4912 FFC3.tmp 106 PID 4948 wrote to memory of 5392 4948 5F.tmp 107 PID 5392 wrote to memory of 1408 5392 FB.tmp 108 PID 1408 wrote to memory of 3260 1408 1B7.tmp 109 PID 3260 wrote to memory of 2016 3260 253.tmp 110 PID 2016 wrote to memory of 2448 2016 2FF.tmp 111 PID 2448 wrote to memory of 2768 2448 3BA.tmp 112 PID 2768 wrote to memory of 3008 2768 466.tmp 113 PID 3008 wrote to memory of 3404 3008 531.tmp 114 PID 3404 wrote to memory of 5788 3404 5CE.tmp 115 PID 5788 wrote to memory of 2360 5788 65A.tmp 116 PID 2360 wrote to memory of 4664 2360 6E7.tmp 117 PID 4664 wrote to memory of 5460 4664 7D1.tmp 118 PID 5460 wrote to memory of 3944 5460 88D.tmp 119 PID 3944 wrote to memory of 4348 3944 948.tmp 120 PID 4348 wrote to memory of 2732 4348 A13.tmp 121 PID 2732 wrote to memory of 5412 2732 AA0.tmp 122 PID 5412 wrote to memory of 5992 5412 B0D.tmp 123 PID 5992 wrote to memory of 960 5992 B8A.tmp 124 PID 960 wrote to memory of 2624 960 BF8.tmp 125 PID 2624 wrote to memory of 5140 2624 C75.tmp 126 PID 5140 wrote to memory of 3336 5140 D01.tmp 127 PID 3336 wrote to memory of 1932 3336 D6F.tmp 128 PID 1932 wrote to memory of 1076 1932 DEC.tmp 129 PID 1076 wrote to memory of 1736 1076 E69.tmp 130 PID 1736 wrote to memory of 1044 1736 EF5.tmp 131 PID 1044 wrote to memory of 3932 1044 F63.tmp 132 PID 3932 wrote to memory of 4824 3932 FE0.tmp 133 PID 4824 wrote to memory of 3064 4824 106C.tmp 134 PID 3064 wrote to memory of 8 3064 10F9.tmp 135 PID 8 wrote to memory of 4208 8 1176.tmp 136 PID 4208 wrote to memory of 2824 4208 11F3.tmp 137 PID 2824 wrote to memory of 808 2824 128F.tmp 138 PID 808 wrote to memory of 4376 808 130C.tmp 139 PID 4376 wrote to memory of 5824 4376 137A.tmp 140 PID 5824 wrote to memory of 4380 5824 1406.tmp 141 PID 4380 wrote to memory of 4216 4380 1483.tmp 142 PID 4216 wrote to memory of 2288 4216 1500.tmp 143 PID 2288 wrote to memory of 1940 2288 156E.tmp 144 PID 1940 wrote to memory of 1116 1940 15DB.tmp 145 PID 1116 wrote to memory of 5108 1116 1677.tmp 146 PID 5108 wrote to memory of 1660 5108 1704.tmp 147 PID 1660 wrote to memory of 476 1660 1790.tmp 148 PID 476 wrote to memory of 2388 476 17FE.tmp 149 PID 2388 wrote to memory of 4768 2388 189A.tmp 150 PID 4768 wrote to memory of 4052 4768 1917.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_ccbe8dd1462b3d1991d4f8b74250acab_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_ccbe8dd1462b3d1991d4f8b74250acab_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F488.tmp"C:\Users\Admin\AppData\Local\Temp\F488.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\F505.tmp"C:\Users\Admin\AppData\Local\Temp\F505.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F96A.tmp"C:\Users\Admin\AppData\Local\Temp\F96A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\FA35.tmp"C:\Users\Admin\AppData\Local\Temp\FA35.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\FC96.tmp"C:\Users\Admin\AppData\Local\Temp\FC96.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\FD32.tmp"C:\Users\Admin\AppData\Local\Temp\FD32.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\FB.tmp"C:\Users\Admin\AppData\Local\Temp\FB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\1B7.tmp"C:\Users\Admin\AppData\Local\Temp\1B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\253.tmp"C:\Users\Admin\AppData\Local\Temp\253.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\6E7.tmp"C:\Users\Admin\AppData\Local\Temp\6E7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7D1.tmp"C:\Users\Admin\AppData\Local\Temp\7D1.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\AA0.tmp"C:\Users\Admin\AppData\Local\Temp\AA0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\D6F.tmp"C:\Users\Admin\AppData\Local\Temp\D6F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\DEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\E69.tmp"C:\Users\Admin\AppData\Local\Temp\E69.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\EF5.tmp"C:\Users\Admin\AppData\Local\Temp\EF5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\F63.tmp"C:\Users\Admin\AppData\Local\Temp\F63.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\11F3.tmp"C:\Users\Admin\AppData\Local\Temp\11F3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\130C.tmp"C:\Users\Admin\AppData\Local\Temp\130C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\137A.tmp"C:\Users\Admin\AppData\Local\Temp\137A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\1483.tmp"C:\Users\Admin\AppData\Local\Temp\1483.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\1500.tmp"C:\Users\Admin\AppData\Local\Temp\1500.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1677.tmp"C:\Users\Admin\AppData\Local\Temp\1677.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\1704.tmp"C:\Users\Admin\AppData\Local\Temp\1704.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1917.tmp"C:\Users\Admin\AppData\Local\Temp\1917.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"65⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\1A11.tmp"C:\Users\Admin\AppData\Local\Temp\1A11.tmp"66⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\1A8E.tmp"C:\Users\Admin\AppData\Local\Temp\1A8E.tmp"67⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"68⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"69⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"70⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\1C82.tmp"C:\Users\Admin\AppData\Local\Temp\1C82.tmp"71⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"72⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"73⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"74⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"75⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"76⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"77⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"78⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"79⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2126.tmp"C:\Users\Admin\AppData\Local\Temp\2126.tmp"80⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\21C2.tmp"C:\Users\Admin\AppData\Local\Temp\21C2.tmp"81⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"82⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:684 -
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"84⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"85⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2442.tmp"C:\Users\Admin\AppData\Local\Temp\2442.tmp"86⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"87⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"88⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"89⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\2627.tmp"C:\Users\Admin\AppData\Local\Temp\2627.tmp"90⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"91⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"92⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"93⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"94⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\28B7.tmp"C:\Users\Admin\AppData\Local\Temp\28B7.tmp"95⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2963.tmp"C:\Users\Admin\AppData\Local\Temp\2963.tmp"96⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\29F0.tmp"C:\Users\Admin\AppData\Local\Temp\29F0.tmp"97⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\2A5D.tmp"C:\Users\Admin\AppData\Local\Temp\2A5D.tmp"98⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"99⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"100⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"101⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2C41.tmp"C:\Users\Admin\AppData\Local\Temp\2C41.tmp"102⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"103⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"104⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"105⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\2E26.tmp"C:\Users\Admin\AppData\Local\Temp\2E26.tmp"106⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"107⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"108⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"109⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\301A.tmp"C:\Users\Admin\AppData\Local\Temp\301A.tmp"110⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"111⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3104.tmp"C:\Users\Admin\AppData\Local\Temp\3104.tmp"112⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"113⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\320E.tmp"C:\Users\Admin\AppData\Local\Temp\320E.tmp"114⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\328B.tmp"C:\Users\Admin\AppData\Local\Temp\328B.tmp"115⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3327.tmp"C:\Users\Admin\AppData\Local\Temp\3327.tmp"116⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\33A4.tmp"C:\Users\Admin\AppData\Local\Temp\33A4.tmp"117⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\3421.tmp"C:\Users\Admin\AppData\Local\Temp\3421.tmp"118⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\34AE.tmp"C:\Users\Admin\AppData\Local\Temp\34AE.tmp"119⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\351B.tmp"C:\Users\Admin\AppData\Local\Temp\351B.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"121⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3615.tmp"C:\Users\Admin\AppData\Local\Temp\3615.tmp"122⤵PID:5908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-