Analysis
- max time kernel
124s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_599b73bd6280d5ea7d3084fabc6271ce_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_599b73bd6280d5ea7d3084fabc6271ce_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-24_599b73bd6280d5ea7d3084fabc6271ce_elex_mafia.exe
- Size 520KB
- Sample260924-eaebfsyvaw
- SHA256 edbefa6b7391bb7a6ef8741a3988c3daf7c53341b8ac63f5b78acd93ab9088f7
- MD5 599b73bd6280d5ea7d3084fabc6271ce
- SHA1 05abd3edd26ed5849f49a98f3dcb9e20fb841df1
- SHA512 ca4f8f2493abf974564ffc66c0bd24920d469c2afaba36f13ff50427334945ee8f0d442ffcc5787066ba01b8302f93fc7b8b09d96527877f2ba43b7f30b39f39
- SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbm06ni7ezjbyymGJd0/CUfMVwfkn6nOTxJ:gj8fuxR21t5i8fAxtQ7zskXmRchNZ
- TLSH T1BEB4F1117588C033E89215354A66DBA24BBA7C795B3694C73BC0377E7EB92D1E63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5832 6BDB.tmp 3292 6C67.tmp 4248 6CC5.tmp 3620 6D90.tmp 5916 6E4C.tmp 6012 6F07.tmp 4752 7001.tmp 4280 709D.tmp 4456 7149.tmp 2732 71D6.tmp 1852 7291.tmp 2656 734D.tmp 4208 73CA.tmp 1984 7485.tmp 3448 7512.tmp 5668 75BE.tmp 1404 764A.tmp 2464 76B8.tmp 5340 7793.tmp 5544 783E.tmp 908 78FA.tmp 4796 7987.tmp 2612 7A61.tmp 3444 7B0D.tmp 4216 7BC9.tmp 3156 7C65.tmp 5532 7D01.tmp 712 7DAD.tmp 3308 7E88.tmp 4364 7F34.tmp 612 7FC0.tmp 4388 803D.tmp 3040 80F9.tmp 4708 8195.tmp 4504 8222.tmp 3764 829F.tmp 1308 830C.tmp 1988 8379.tmp 1456 83E7.tmp 1492 8473.tmp 5656 84F0.tmp 364 858D.tmp 2880 860A.tmp 3844 8687.tmp 5368 8723.tmp 4592 8790.tmp 4600 880D.tmp 388 887B.tmp 3264 8907.tmp 1780 8975.tmp 3536 8A01.tmp 3704 8A7E.tmp 5824 8B0B.tmp 2720 8B88.tmp 2864 8C05.tmp 3572 8CA1.tmp 1388 8D3D.tmp 5584 8DBA.tmp 2684 8E37.tmp 3436 8EE3.tmp 3408 8F51.tmp 5320 8FCE.tmp 796 905A.tmp 2964 90E7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D415.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A71E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 195C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 752C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D32B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C98B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C257.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A79B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 729C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C446.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B89E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 5832 2380 2026-09-24_599b73bd6280d5ea7d3084fabc6271ce_elex_mafia.exe 88 PID 5832 wrote to memory of 3292 5832 6BDB.tmp 90 PID 3292 wrote to memory of 4248 3292 6C67.tmp 91 PID 4248 wrote to memory of 3620 4248 6CC5.tmp 92 PID 3620 wrote to memory of 5916 3620 6D90.tmp 93 PID 5916 wrote to memory of 6012 5916 6E4C.tmp 94 PID 6012 wrote to memory of 4752 6012 6F07.tmp 95 PID 4752 wrote to memory of 4280 4752 7001.tmp 96 PID 4280 wrote to memory of 4456 4280 709D.tmp 97 PID 4456 wrote to memory of 2732 4456 7149.tmp 98 PID 2732 wrote to memory of 1852 2732 71D6.tmp 99 PID 1852 wrote to memory of 2656 1852 7291.tmp 100 PID 2656 wrote to memory of 4208 2656 734D.tmp 101 PID 4208 wrote to memory of 1984 4208 73CA.tmp 102 PID 1984 wrote to memory of 3448 1984 7485.tmp 103 PID 3448 wrote to memory of 5668 3448 7512.tmp 104 PID 5668 wrote to memory of 1404 5668 75BE.tmp 105 PID 1404 wrote to memory of 2464 1404 764A.tmp 106 PID 2464 wrote to memory of 5340 2464 76B8.tmp 107 PID 5340 wrote to memory of 5544 5340 7793.tmp 108 PID 5544 wrote to memory of 908 5544 783E.tmp 109 PID 908 wrote to memory of 4796 908 78FA.tmp 110 PID 4796 wrote to memory of 2612 4796 7987.tmp 111 PID 2612 wrote to memory of 3444 2612 7A61.tmp 112 PID 3444 wrote to memory of 4216 3444 7B0D.tmp 113 PID 4216 wrote to memory of 3156 4216 7BC9.tmp 114 PID 3156 wrote to memory of 5532 3156 7C65.tmp 115 PID 5532 wrote to memory of 712 5532 7D01.tmp 116 PID 712 wrote to memory of 3308 712 7DAD.tmp 117 PID 3308 wrote to memory of 4364 3308 7E88.tmp 118 PID 4364 wrote to memory of 612 4364 7F34.tmp 119 PID 612 wrote to memory of 4388 612 7FC0.tmp 120 PID 4388 wrote to memory of 3040 4388 803D.tmp 121 PID 3040 wrote to memory of 4708 3040 80F9.tmp 122 PID 4708 wrote to memory of 4504 4708 8195.tmp 123 PID 4504 wrote to memory of 3764 4504 8222.tmp 124 PID 3764 wrote to memory of 1308 3764 829F.tmp 125 PID 1308 wrote to memory of 1988 1308 830C.tmp 126 PID 1988 wrote to memory of 1456 1988 8379.tmp 127 PID 1456 wrote to memory of 1492 1456 83E7.tmp 128 PID 1492 wrote to memory of 5656 1492 8473.tmp 129 PID 5656 wrote to memory of 364 5656 84F0.tmp 130 PID 364 wrote to memory of 2880 364 858D.tmp 131 PID 2880 wrote to memory of 3844 2880 860A.tmp 132 PID 3844 wrote to memory of 5368 3844 8687.tmp 133 PID 5368 wrote to memory of 4592 5368 8723.tmp 134 PID 4592 wrote to memory of 4600 4592 8790.tmp 135 PID 4600 wrote to memory of 388 4600 880D.tmp 136 PID 388 wrote to memory of 3264 388 887B.tmp 137 PID 3264 wrote to memory of 1780 3264 8907.tmp 138 PID 1780 wrote to memory of 3536 1780 8975.tmp 139 PID 3536 wrote to memory of 3704 3536 8A01.tmp 140 PID 3704 wrote to memory of 5824 3704 8A7E.tmp 141 PID 5824 wrote to memory of 2720 5824 8B0B.tmp 142 PID 2720 wrote to memory of 2864 2720 8B88.tmp 143 PID 2864 wrote to memory of 3572 2864 8C05.tmp 144 PID 3572 wrote to memory of 1388 3572 8CA1.tmp 145 PID 1388 wrote to memory of 5584 1388 8D3D.tmp 146 PID 5584 wrote to memory of 2684 5584 8DBA.tmp 147 PID 2684 wrote to memory of 3436 2684 8E37.tmp 148 PID 3436 wrote to memory of 3408 3436 8EE3.tmp 149 PID 3408 wrote to memory of 5320 3408 8F51.tmp 150 PID 5320 wrote to memory of 796 5320 8FCE.tmp 151 PID 796 wrote to memory of 2964 796 905A.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_599b73bd6280d5ea7d3084fabc6271ce_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_599b73bd6280d5ea7d3084fabc6271ce_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\6C67.tmp"C:\Users\Admin\AppData\Local\Temp\6C67.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\6D90.tmp"C:\Users\Admin\AppData\Local\Temp\6D90.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\6F07.tmp"C:\Users\Admin\AppData\Local\Temp\6F07.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\7001.tmp"C:\Users\Admin\AppData\Local\Temp\7001.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\709D.tmp"C:\Users\Admin\AppData\Local\Temp\709D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\734D.tmp"C:\Users\Admin\AppData\Local\Temp\734D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\73CA.tmp"C:\Users\Admin\AppData\Local\Temp\73CA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7485.tmp"C:\Users\Admin\AppData\Local\Temp\7485.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\75BE.tmp"C:\Users\Admin\AppData\Local\Temp\75BE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\764A.tmp"C:\Users\Admin\AppData\Local\Temp\764A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\76B8.tmp"C:\Users\Admin\AppData\Local\Temp\76B8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7793.tmp"C:\Users\Admin\AppData\Local\Temp\7793.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\783E.tmp"C:\Users\Admin\AppData\Local\Temp\783E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\78FA.tmp"C:\Users\Admin\AppData\Local\Temp\78FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\7987.tmp"C:\Users\Admin\AppData\Local\Temp\7987.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\7A61.tmp"C:\Users\Admin\AppData\Local\Temp\7A61.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\7C65.tmp"C:\Users\Admin\AppData\Local\Temp\7C65.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\7D01.tmp"C:\Users\Admin\AppData\Local\Temp\7D01.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\7DAD.tmp"C:\Users\Admin\AppData\Local\Temp\7DAD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\7E88.tmp"C:\Users\Admin\AppData\Local\Temp\7E88.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\7F34.tmp"C:\Users\Admin\AppData\Local\Temp\7F34.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\803D.tmp"C:\Users\Admin\AppData\Local\Temp\803D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\80F9.tmp"C:\Users\Admin\AppData\Local\Temp\80F9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8195.tmp"C:\Users\Admin\AppData\Local\Temp\8195.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\829F.tmp"C:\Users\Admin\AppData\Local\Temp\829F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\830C.tmp"C:\Users\Admin\AppData\Local\Temp\830C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\8379.tmp"C:\Users\Admin\AppData\Local\Temp\8379.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\83E7.tmp"C:\Users\Admin\AppData\Local\Temp\83E7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\8473.tmp"C:\Users\Admin\AppData\Local\Temp\8473.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\858D.tmp"C:\Users\Admin\AppData\Local\Temp\858D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\860A.tmp"C:\Users\Admin\AppData\Local\Temp\860A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\8687.tmp"C:\Users\Admin\AppData\Local\Temp\8687.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\8723.tmp"C:\Users\Admin\AppData\Local\Temp\8723.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\8790.tmp"C:\Users\Admin\AppData\Local\Temp\8790.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\880D.tmp"C:\Users\Admin\AppData\Local\Temp\880D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\887B.tmp"C:\Users\Admin\AppData\Local\Temp\887B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\8907.tmp"C:\Users\Admin\AppData\Local\Temp\8907.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\8975.tmp"C:\Users\Admin\AppData\Local\Temp\8975.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\8A01.tmp"C:\Users\Admin\AppData\Local\Temp\8A01.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8A7E.tmp"C:\Users\Admin\AppData\Local\Temp\8A7E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8C05.tmp"C:\Users\Admin\AppData\Local\Temp\8C05.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\8E37.tmp"C:\Users\Admin\AppData\Local\Temp\8E37.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\8FCE.tmp"C:\Users\Admin\AppData\Local\Temp\8FCE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\905A.tmp"C:\Users\Admin\AppData\Local\Temp\905A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\90E7.tmp"C:\Users\Admin\AppData\Local\Temp\90E7.tmp"65⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\9154.tmp"C:\Users\Admin\AppData\Local\Temp\9154.tmp"66⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\91E1.tmp"C:\Users\Admin\AppData\Local\Temp\91E1.tmp"67⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\9665.tmp"C:\Users\Admin\AppData\Local\Temp\9665.tmp"68⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"70⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"71⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"72⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"73⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9982.tmp"C:\Users\Admin\AppData\Local\Temp\9982.tmp"74⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"75⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"76⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\9AF9.tmp"C:\Users\Admin\AppData\Local\Temp\9AF9.tmp"77⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\9B66.tmp"C:\Users\Admin\AppData\Local\Temp\9B66.tmp"78⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\9BD4.tmp"C:\Users\Admin\AppData\Local\Temp\9BD4.tmp"79⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\9C41.tmp"C:\Users\Admin\AppData\Local\Temp\9C41.tmp"80⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"81⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"82⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\9DC8.tmp"C:\Users\Admin\AppData\Local\Temp\9DC8.tmp"83⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\9E35.tmp"C:\Users\Admin\AppData\Local\Temp\9E35.tmp"84⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"85⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\9F3F.tmp"C:\Users\Admin\AppData\Local\Temp\9F3F.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\9FCB.tmp"C:\Users\Admin\AppData\Local\Temp\9FCB.tmp"87⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\A077.tmp"C:\Users\Admin\AppData\Local\Temp\A077.tmp"88⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\A0D5.tmp"C:\Users\Admin\AppData\Local\Temp\A0D5.tmp"89⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\A171.tmp"C:\Users\Admin\AppData\Local\Temp\A171.tmp"90⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"91⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A29A.tmp"C:\Users\Admin\AppData\Local\Temp\A29A.tmp"92⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\A317.tmp"C:\Users\Admin\AppData\Local\Temp\A317.tmp"93⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\A394.tmp"C:\Users\Admin\AppData\Local\Temp\A394.tmp"94⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\A421.tmp"C:\Users\Admin\AppData\Local\Temp\A421.tmp"95⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"96⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\A51B.tmp"C:\Users\Admin\AppData\Local\Temp\A51B.tmp"97⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A5B7.tmp"C:\Users\Admin\AppData\Local\Temp\A5B7.tmp"98⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A624.tmp"C:\Users\Admin\AppData\Local\Temp\A624.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\A6A1.tmp"C:\Users\Admin\AppData\Local\Temp\A6A1.tmp"100⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A71E.tmp"C:\Users\Admin\AppData\Local\Temp\A71E.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\A79B.tmp"C:\Users\Admin\AppData\Local\Temp\A79B.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\A818.tmp"C:\Users\Admin\AppData\Local\Temp\A818.tmp"103⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\A8C4.tmp"C:\Users\Admin\AppData\Local\Temp\A8C4.tmp"104⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\A951.tmp"C:\Users\Admin\AppData\Local\Temp\A951.tmp"105⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\A9CE.tmp"C:\Users\Admin\AppData\Local\Temp\A9CE.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\AA4B.tmp"C:\Users\Admin\AppData\Local\Temp\AA4B.tmp"107⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"108⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\AB55.tmp"C:\Users\Admin\AppData\Local\Temp\AB55.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\ABC2.tmp"C:\Users\Admin\AppData\Local\Temp\ABC2.tmp"110⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\AC4F.tmp"C:\Users\Admin\AppData\Local\Temp\AC4F.tmp"111⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\ACEB.tmp"C:\Users\Admin\AppData\Local\Temp\ACEB.tmp"112⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\AD68.tmp"C:\Users\Admin\AppData\Local\Temp\AD68.tmp"113⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\ADE5.tmp"C:\Users\Admin\AppData\Local\Temp\ADE5.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\AE62.tmp"C:\Users\Admin\AppData\Local\Temp\AE62.tmp"115⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\AEDF.tmp"C:\Users\Admin\AppData\Local\Temp\AEDF.tmp"116⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\AF5C.tmp"C:\Users\Admin\AppData\Local\Temp\AF5C.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\AFC9.tmp"C:\Users\Admin\AppData\Local\Temp\AFC9.tmp"118⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\B046.tmp"C:\Users\Admin\AppData\Local\Temp\B046.tmp"119⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\B0B4.tmp"C:\Users\Admin\AppData\Local\Temp\B0B4.tmp"120⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\B121.tmp"C:\Users\Admin\AppData\Local\Temp\B121.tmp"121⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\B18E.tmp"C:\Users\Admin\AppData\Local\Temp\B18E.tmp"122⤵PID:3088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-