Analysis
- max time kernel
123s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe
- Size 520KB
- Sample261017-1dbkmady2s
- SHA256 7525c890a52570cace7e2be4d812b48c4cbdb4597d0c659db170b50f738e5fce
- MD5 265b8ddb5ee945f3311d5875a0f2e05b
- SHA1 9ed5d31ca41f38796d84e7e2cd6c9fbcd6a19376
- SHA512 d690aa2af2a3f2e5a34ddd92e585c13f4c61ab5f3d45c0319c61616e6d579f858da49328062d9329bb6568d707fe65c114dcf78f606372e23fe7b8ed285e4dc3
- SSDEEP 12288:gj8fuxR21t5i8fFhYAhaEqqjRrRJoE4xuIu3pNZ6:gj8fuK1GYFhYAhjjh2E5NI
- TLSH T11EB4F1027994C036E8D615310B56DBA21B7EBD399B3695C737C536AE6FB02C1E63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4656 79AB.tmp 5592 7A76.tmp 2412 7B9F.tmp 4732 7CA8.tmp 4308 7D44.tmp 5464 7DC1.tmp 468 7E8D.tmp 1932 7F38.tmp 3960 7FB5.tmp 3484 8032.tmp 248 80CF.tmp 1724 817B.tmp 3464 8217.tmp 996 82B3.tmp 6048 834F.tmp 3668 83EC.tmp 1632 8478.tmp 3596 8524.tmp 2724 85B1.tmp 5760 865D.tmp 4756 86DA.tmp 5516 8766.tmp 2032 87F3.tmp 4192 88BE.tmp 5652 8989.tmp 4716 8A54.tmp 1908 8AD1.tmp 4532 8B4E.tmp 2276 8BDB.tmp 3004 8C58.tmp 1324 8CE4.tmp 5152 8D90.tmp 2484 8E0D.tmp 4248 8E7B.tmp 5960 8EE8.tmp 5680 8F84.tmp 4384 9001.tmp 1212 907E.tmp 4900 910B.tmp 1268 9178.tmp 1076 9205.tmp 3364 9272.tmp 5252 92FF.tmp 2880 936C.tmp 5768 93F9.tmp 5720 9476.tmp 4280 94E3.tmp 4936 9551.tmp 4368 95DD.tmp 3808 967A.tmp 2732 9725.tmp 3096 97A2.tmp 252 9800.tmp 1544 988D.tmp 3188 98FA.tmp 3152 9987.tmp 4244 9A13.tmp 4608 9A81.tmp 5756 9AEE.tmp 5332 9B5C.tmp 4888 9BE8.tmp 5084 9C75.tmp 1520 9CE2.tmp 1088 9D50.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 802E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A00F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E611.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B57B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B80B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D075.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 4656 1440 2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe 89 PID 4656 wrote to memory of 5592 4656 79AB.tmp 90 PID 5592 wrote to memory of 2412 5592 7A76.tmp 91 PID 2412 wrote to memory of 4732 2412 7B9F.tmp 92 PID 4732 wrote to memory of 4308 4732 7CA8.tmp 93 PID 4308 wrote to memory of 5464 4308 7D44.tmp 94 PID 5464 wrote to memory of 468 5464 7DC1.tmp 95 PID 468 wrote to memory of 1932 468 7E8D.tmp 96 PID 1932 wrote to memory of 3960 1932 7F38.tmp 97 PID 3960 wrote to memory of 3484 3960 7FB5.tmp 98 PID 3484 wrote to memory of 248 3484 8032.tmp 99 PID 248 wrote to memory of 1724 248 80CF.tmp 100 PID 1724 wrote to memory of 3464 1724 817B.tmp 101 PID 3464 wrote to memory of 996 3464 8217.tmp 102 PID 996 wrote to memory of 6048 996 82B3.tmp 103 PID 6048 wrote to memory of 3668 6048 834F.tmp 104 PID 3668 wrote to memory of 1632 3668 83EC.tmp 105 PID 1632 wrote to memory of 3596 1632 8478.tmp 106 PID 3596 wrote to memory of 2724 3596 8524.tmp 107 PID 2724 wrote to memory of 5760 2724 85B1.tmp 108 PID 5760 wrote to memory of 4756 5760 865D.tmp 109 PID 4756 wrote to memory of 5516 4756 86DA.tmp 110 PID 5516 wrote to memory of 2032 5516 8766.tmp 111 PID 2032 wrote to memory of 4192 2032 87F3.tmp 112 PID 4192 wrote to memory of 5652 4192 88BE.tmp 113 PID 5652 wrote to memory of 4716 5652 8989.tmp 114 PID 4716 wrote to memory of 1908 4716 8A54.tmp 115 PID 1908 wrote to memory of 4532 1908 8AD1.tmp 116 PID 4532 wrote to memory of 2276 4532 8B4E.tmp 117 PID 2276 wrote to memory of 3004 2276 8BDB.tmp 118 PID 3004 wrote to memory of 1324 3004 8C58.tmp 119 PID 1324 wrote to memory of 5152 1324 8CE4.tmp 120 PID 5152 wrote to memory of 2484 5152 8D90.tmp 121 PID 2484 wrote to memory of 4248 2484 8E0D.tmp 122 PID 4248 wrote to memory of 5960 4248 8E7B.tmp 123 PID 5960 wrote to memory of 5680 5960 8EE8.tmp 124 PID 5680 wrote to memory of 4384 5680 8F84.tmp 125 PID 4384 wrote to memory of 1212 4384 9001.tmp 126 PID 1212 wrote to memory of 4900 1212 907E.tmp 127 PID 4900 wrote to memory of 1268 4900 910B.tmp 128 PID 1268 wrote to memory of 1076 1268 9178.tmp 129 PID 1076 wrote to memory of 3364 1076 9205.tmp 130 PID 3364 wrote to memory of 5252 3364 9272.tmp 131 PID 5252 wrote to memory of 2880 5252 92FF.tmp 132 PID 2880 wrote to memory of 5768 2880 936C.tmp 133 PID 5768 wrote to memory of 5720 5768 93F9.tmp 134 PID 5720 wrote to memory of 4280 5720 9476.tmp 135 PID 4280 wrote to memory of 4936 4280 94E3.tmp 136 PID 4936 wrote to memory of 4368 4936 9551.tmp 137 PID 4368 wrote to memory of 3808 4368 95DD.tmp 138 PID 3808 wrote to memory of 2732 3808 967A.tmp 139 PID 2732 wrote to memory of 3096 2732 9725.tmp 140 PID 3096 wrote to memory of 252 3096 97A2.tmp 141 PID 252 wrote to memory of 1544 252 9800.tmp 142 PID 1544 wrote to memory of 3188 1544 988D.tmp 143 PID 3188 wrote to memory of 3152 3188 98FA.tmp 144 PID 3152 wrote to memory of 4244 3152 9987.tmp 145 PID 4244 wrote to memory of 4608 4244 9A13.tmp 146 PID 4608 wrote to memory of 5756 4608 9A81.tmp 147 PID 5756 wrote to memory of 5332 5756 9AEE.tmp 148 PID 5332 wrote to memory of 4888 5332 9B5C.tmp 149 PID 4888 wrote to memory of 5084 4888 9BE8.tmp 150 PID 5084 wrote to memory of 1520 5084 9C75.tmp 151 PID 1520 wrote to memory of 1088 1520 9CE2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\7D44.tmp"C:\Users\Admin\AppData\Local\Temp\7D44.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\7F38.tmp"C:\Users\Admin\AppData\Local\Temp\7F38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\8032.tmp"C:\Users\Admin\AppData\Local\Temp\8032.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\80CF.tmp"C:\Users\Admin\AppData\Local\Temp\80CF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\82B3.tmp"C:\Users\Admin\AppData\Local\Temp\82B3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\86DA.tmp"C:\Users\Admin\AppData\Local\Temp\86DA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\88BE.tmp"C:\Users\Admin\AppData\Local\Temp\88BE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"C:\Users\Admin\AppData\Local\Temp\8B4E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\8F84.tmp"C:\Users\Admin\AppData\Local\Temp\8F84.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\907E.tmp"C:\Users\Admin\AppData\Local\Temp\907E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\9178.tmp"C:\Users\Admin\AppData\Local\Temp\9178.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\92FF.tmp"C:\Users\Admin\AppData\Local\Temp\92FF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\9476.tmp"C:\Users\Admin\AppData\Local\Temp\9476.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\97A2.tmp"C:\Users\Admin\AppData\Local\Temp\97A2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\9800.tmp"C:\Users\Admin\AppData\Local\Temp\9800.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\988D.tmp"C:\Users\Admin\AppData\Local\Temp\988D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"65⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"66⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"67⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"C:\Users\Admin\AppData\Local\Temp\9EA7.tmp"68⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"69⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"C:\Users\Admin\AppData\Local\Temp\9FB1.tmp"70⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\A00F.tmp"C:\Users\Admin\AppData\Local\Temp\A00F.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"72⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"73⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"74⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"75⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\A260.tmp"C:\Users\Admin\AppData\Local\Temp\A260.tmp"76⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"77⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\A35A.tmp"C:\Users\Admin\AppData\Local\Temp\A35A.tmp"78⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"79⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"80⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"81⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"82⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"C:\Users\Admin\AppData\Local\Temp\A5CB.tmp"83⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\A648.tmp"C:\Users\Admin\AppData\Local\Temp\A648.tmp"84⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"86⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"87⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\A87B.tmp"C:\Users\Admin\AppData\Local\Temp\A87B.tmp"88⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"89⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\A965.tmp"C:\Users\Admin\AppData\Local\Temp\A965.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"91⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"92⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"93⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"94⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"95⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\AC44.tmp"C:\Users\Admin\AppData\Local\Temp\AC44.tmp"96⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\ACC1.tmp"C:\Users\Admin\AppData\Local\Temp\ACC1.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"C:\Users\Admin\AppData\Local\Temp\AD5D.tmp"98⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"99⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"100⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"101⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"102⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"103⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"104⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"105⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"106⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"107⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"109⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"110⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"111⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\B481.tmp"C:\Users\Admin\AppData\Local\Temp\B481.tmp"112⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"113⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B57B.tmp"C:\Users\Admin\AppData\Local\Temp\B57B.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"115⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B675.tmp"C:\Users\Admin\AppData\Local\Temp\B675.tmp"116⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"117⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B77F.tmp"C:\Users\Admin\AppData\Local\Temp\B77F.tmp"118⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"120⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\B925.tmp"C:\Users\Admin\AppData\Local\Temp\B925.tmp"121⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B992.tmp"C:\Users\Admin\AppData\Local\Temp\B992.tmp"122⤵PID:3696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-