Analysis
- max time kernel
125s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe
- Size 524KB
- Sample261002-xe74fawanf
- SHA256 56b48a467006fd368c3db9194fe9d9ab4bacbf8fb1296fa535ef35ea1852e604
- MD5 1dcf92a4bb69ffb57067f024c5e14ca9
- SHA1 3594d1fbf9062a08f54bdf8074971b98d546d929
- SHA512 86b5ae2d66c5d84df261abec807ac14746ab9ad019f7740d3fdb836614910e5bcb32867b0bb6df42bda1ce88c1825e23d1ed2dd5d7d549fd8aa86a0b2f8f23b8
- SSDEEP 12288:TRyZzqyL66Tv+XH3O7jlvUVp9xaIdX6OpG96jNZ:TRyQylTvQevlvo28X6UGEjN
- TLSH T16EB4F126B188C432E5D205324E65DF92597A3C719B67A4CB3BC4266E2FF13E1E27530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2496 5AC8.tmp 3152 5B65.tmp 5668 5C7E.tmp 3308 5D1A.tmp 6028 5E24.tmp 3408 5F2D.tmp 5152 5FF8.tmp 4128 6075.tmp 4276 6150.tmp 4548 625A.tmp 2732 6344.tmp 3008 63B2.tmp 4332 648C.tmp 5904 6548.tmp 4648 6623.tmp 6032 670D.tmp 2008 67C8.tmp 1684 6901.tmp 4192 69FB.tmp 4284 6AA7.tmp 5968 6B82.tmp 5996 6C3D.tmp 5160 6D95.tmp 5992 6E60.tmp 428 6F3B.tmp 1400 7006.tmp 1680 70F0.tmp 6004 71EA.tmp 4440 72F4.tmp 1008 73CF.tmp 4816 74F7.tmp 5288 75C3.tmp 5684 768E.tmp 5944 771A.tmp 5936 77A7.tmp 3528 7853.tmp 1408 78DF.tmp 4132 79BA.tmp 4468 7A76.tmp 3768 7B31.tmp 4968 7BDD.tmp 1604 7CC7.tmp 1548 7D64.tmp 4136 7DE1.tmp 3344 7E7D.tmp 1196 7F58.tmp 2004 7FF4.tmp 5368 80AF.tmp 4756 816B.tmp 5772 81E8.tmp 5392 8265.tmp 4768 82E2.tmp 4996 835F.tmp 1688 83CC.tmp 4356 8449.tmp 4240 84C6.tmp 4808 8543.tmp 4888 85D0.tmp 4732 863D.tmp 1272 86BA.tmp 2024 8728.tmp 248 87A5.tmp 52 8822.tmp 4372 889F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F82C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A85C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F32B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D86F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 975F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 989C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A677.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 2496 996 2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe 88 PID 2496 wrote to memory of 3152 2496 5AC8.tmp 90 PID 3152 wrote to memory of 5668 3152 5B65.tmp 91 PID 5668 wrote to memory of 3308 5668 5C7E.tmp 92 PID 3308 wrote to memory of 6028 3308 5D1A.tmp 93 PID 6028 wrote to memory of 3408 6028 5E24.tmp 94 PID 3408 wrote to memory of 5152 3408 5F2D.tmp 95 PID 5152 wrote to memory of 4128 5152 5FF8.tmp 96 PID 4128 wrote to memory of 4276 4128 6075.tmp 97 PID 4276 wrote to memory of 4548 4276 6150.tmp 98 PID 4548 wrote to memory of 2732 4548 625A.tmp 99 PID 2732 wrote to memory of 3008 2732 6344.tmp 100 PID 3008 wrote to memory of 4332 3008 63B2.tmp 101 PID 4332 wrote to memory of 5904 4332 648C.tmp 102 PID 5904 wrote to memory of 4648 5904 6548.tmp 103 PID 4648 wrote to memory of 6032 4648 6623.tmp 104 PID 6032 wrote to memory of 2008 6032 670D.tmp 105 PID 2008 wrote to memory of 1684 2008 67C8.tmp 106 PID 1684 wrote to memory of 4192 1684 6901.tmp 107 PID 4192 wrote to memory of 4284 4192 69FB.tmp 108 PID 4284 wrote to memory of 5968 4284 6AA7.tmp 109 PID 5968 wrote to memory of 5996 5968 6B82.tmp 110 PID 5996 wrote to memory of 5160 5996 6C3D.tmp 111 PID 5160 wrote to memory of 5992 5160 6D95.tmp 112 PID 5992 wrote to memory of 428 5992 6E60.tmp 113 PID 428 wrote to memory of 1400 428 6F3B.tmp 114 PID 1400 wrote to memory of 1680 1400 7006.tmp 115 PID 1680 wrote to memory of 6004 1680 70F0.tmp 116 PID 6004 wrote to memory of 4440 6004 71EA.tmp 117 PID 4440 wrote to memory of 1008 4440 72F4.tmp 118 PID 1008 wrote to memory of 4816 1008 73CF.tmp 119 PID 4816 wrote to memory of 5288 4816 74F7.tmp 120 PID 5288 wrote to memory of 5684 5288 75C3.tmp 121 PID 5684 wrote to memory of 5944 5684 768E.tmp 122 PID 5944 wrote to memory of 5936 5944 771A.tmp 123 PID 5936 wrote to memory of 3528 5936 77A7.tmp 124 PID 3528 wrote to memory of 1408 3528 7853.tmp 125 PID 1408 wrote to memory of 4132 1408 78DF.tmp 126 PID 4132 wrote to memory of 4468 4132 79BA.tmp 127 PID 4468 wrote to memory of 3768 4468 7A76.tmp 128 PID 3768 wrote to memory of 4968 3768 7B31.tmp 129 PID 4968 wrote to memory of 1604 4968 7BDD.tmp 130 PID 1604 wrote to memory of 1548 1604 7CC7.tmp 131 PID 1548 wrote to memory of 4136 1548 7D64.tmp 132 PID 4136 wrote to memory of 3344 4136 7DE1.tmp 133 PID 3344 wrote to memory of 1196 3344 7E7D.tmp 134 PID 1196 wrote to memory of 2004 1196 7F58.tmp 135 PID 2004 wrote to memory of 5368 2004 7FF4.tmp 136 PID 5368 wrote to memory of 4756 5368 80AF.tmp 137 PID 4756 wrote to memory of 5772 4756 816B.tmp 138 PID 5772 wrote to memory of 5392 5772 81E8.tmp 139 PID 5392 wrote to memory of 4768 5392 8265.tmp 140 PID 4768 wrote to memory of 4996 4768 82E2.tmp 141 PID 4996 wrote to memory of 1688 4996 835F.tmp 142 PID 1688 wrote to memory of 4356 1688 83CC.tmp 143 PID 4356 wrote to memory of 4240 4356 8449.tmp 144 PID 4240 wrote to memory of 4808 4240 84C6.tmp 145 PID 4808 wrote to memory of 4888 4808 8543.tmp 146 PID 4888 wrote to memory of 4732 4888 85D0.tmp 147 PID 4732 wrote to memory of 1272 4732 863D.tmp 148 PID 1272 wrote to memory of 2024 1272 86BA.tmp 149 PID 2024 wrote to memory of 248 2024 8728.tmp 150 PID 248 wrote to memory of 52 248 87A5.tmp 151 PID 52 wrote to memory of 4372 52 8822.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5B65.tmp"C:\Users\Admin\AppData\Local\Temp\5B65.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\6075.tmp"C:\Users\Admin\AppData\Local\Temp\6075.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\6344.tmp"C:\Users\Admin\AppData\Local\Temp\6344.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\63B2.tmp"C:\Users\Admin\AppData\Local\Temp\63B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\6B82.tmp"C:\Users\Admin\AppData\Local\Temp\6B82.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\6D95.tmp"C:\Users\Admin\AppData\Local\Temp\6D95.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\6E60.tmp"C:\Users\Admin\AppData\Local\Temp\6E60.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\71EA.tmp"C:\Users\Admin\AppData\Local\Temp\71EA.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\73CF.tmp"C:\Users\Admin\AppData\Local\Temp\73CF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\75C3.tmp"C:\Users\Admin\AppData\Local\Temp\75C3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\816B.tmp"C:\Users\Admin\AppData\Local\Temp\816B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\81E8.tmp"C:\Users\Admin\AppData\Local\Temp\81E8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\8449.tmp"C:\Users\Admin\AppData\Local\Temp\8449.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\84C6.tmp"C:\Users\Admin\AppData\Local\Temp\84C6.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"65⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"66⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"67⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\8A06.tmp"C:\Users\Admin\AppData\Local\Temp\8A06.tmp"68⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"69⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"70⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"72⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"73⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"74⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"75⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"76⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"77⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\8F17.tmp"C:\Users\Admin\AppData\Local\Temp\8F17.tmp"78⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\8F84.tmp"C:\Users\Admin\AppData\Local\Temp\8F84.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\906F.tmp"C:\Users\Admin\AppData\Local\Temp\906F.tmp"81⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"82⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\9149.tmp"C:\Users\Admin\AppData\Local\Temp\9149.tmp"83⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"85⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\92C0.tmp"C:\Users\Admin\AppData\Local\Temp\92C0.tmp"86⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"88⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"89⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\9503.tmp"C:\Users\Admin\AppData\Local\Temp\9503.tmp"91⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"92⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\95ED.tmp"C:\Users\Admin\AppData\Local\Temp\95ED.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"94⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"95⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"96⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\97B2.tmp"C:\Users\Admin\AppData\Local\Temp\97B2.tmp"97⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\982F.tmp"C:\Users\Admin\AppData\Local\Temp\982F.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"100⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"101⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\99F4.tmp"C:\Users\Admin\AppData\Local\Temp\99F4.tmp"102⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"103⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"105⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"106⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"107⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"108⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\9D30.tmp"C:\Users\Admin\AppData\Local\Temp\9D30.tmp"109⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"110⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"111⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9F15.tmp"C:\Users\Admin\AppData\Local\Temp\9F15.tmp"113⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"114⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"115⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\A07C.tmp"C:\Users\Admin\AppData\Local\Temp\A07C.tmp"116⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"117⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"118⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"119⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"120⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"121⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"122⤵PID:4176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-