Analysis
- max time kernel
124s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_87a2015f289223526e5ac8002b3f46f1_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_87a2015f289223526e5ac8002b3f46f1_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-19_87a2015f289223526e5ac8002b3f46f1_elex_mafia.exe
- Size 518KB
- Sample261020-rl1eaaex7p
- SHA256 7c67a08165b128229125107a4e42d6f963b1352bf3f215d3808348f21a2d794c
- MD5 87a2015f289223526e5ac8002b3f46f1
- SHA1 bee5161bd596f5fefeb3625c3547ffa895445051
- SHA512 407bbc0deb194147d560635daebc8f63ad4b979126857d6519823093c98e735eed912b6be44584b37d6dd4641da323dc2a1074691fc339b2e7a81820b812fe05
- SSDEEP 12288:anTpha1Jvu4evUXHVpWPrV7CkPOKGIaqf9L8aAlMhMNZ:any1E4qUFOtCknGLq98awjN
- TLSH T16DB4F112B985C133F5D215384A36EBA6593ABC718726A4C77BC4327EAFB02D1D27530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 248 6C09.tmp 4232 6C86.tmp 468 6D42.tmp 4856 6DEE.tmp 5972 6E5B.tmp 3504 6F07.tmp 4640 6FE2.tmp 3892 70DC.tmp 3736 7178.tmp 4608 7214.tmp 1852 72A1.tmp 428 736C.tmp 4872 73E9.tmp 52 74B4.tmp 5248 7570.tmp 3128 75FC.tmp 4820 76C7.tmp 1496 7773.tmp 2868 7800.tmp 1996 78BB.tmp 5664 7967.tmp 4960 7A04.tmp 4428 7A81.tmp 4824 7B1D.tmp 5936 7BD8.tmp 6048 7C84.tmp 5924 7D20.tmp 3016 7D9D.tmp 5988 7E49.tmp 4220 7EF5.tmp 2440 7FB1.tmp 5012 809B.tmp 5560 8185.tmp 752 8231.tmp 5100 829F.tmp 200 832B.tmp 3712 83B8.tmp 1472 8435.tmp 4604 84D1.tmp 2496 856D.tmp 5484 85DB.tmp 5572 8648.tmp 904 86D5.tmp 1056 8752.tmp 1600 87DE.tmp 3064 883C.tmp 4980 88C9.tmp 4908 8927.tmp 2804 89A4.tmp 772 8A01.tmp 3364 8A8E.tmp 3092 8B0B.tmp 4572 8B78.tmp 5996 8BF5.tmp 2592 8C92.tmp 3572 8D1E.tmp 1388 8DAB.tmp 5584 8E28.tmp 5648 8EC4.tmp 5540 8F51.tmp 2348 8FED.tmp 4628 907A.tmp 2696 91A2.tmp 4800 923F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5144.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B523.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 171E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C909.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8067.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2189.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 722F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 117C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 832B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1758.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C64F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 940F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBB7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 248 2616 2026-10-19_87a2015f289223526e5ac8002b3f46f1_elex_mafia.exe 89 PID 248 wrote to memory of 4232 248 6C09.tmp 90 PID 4232 wrote to memory of 468 4232 6C86.tmp 91 PID 468 wrote to memory of 4856 468 6D42.tmp 92 PID 4856 wrote to memory of 5972 4856 6DEE.tmp 93 PID 5972 wrote to memory of 3504 5972 6E5B.tmp 94 PID 3504 wrote to memory of 4640 3504 6F07.tmp 95 PID 4640 wrote to memory of 3892 4640 6FE2.tmp 96 PID 3892 wrote to memory of 3736 3892 70DC.tmp 97 PID 3736 wrote to memory of 4608 3736 7178.tmp 98 PID 4608 wrote to memory of 1852 4608 7214.tmp 99 PID 1852 wrote to memory of 428 1852 72A1.tmp 100 PID 428 wrote to memory of 4872 428 736C.tmp 101 PID 4872 wrote to memory of 52 4872 73E9.tmp 102 PID 52 wrote to memory of 5248 52 74B4.tmp 103 PID 5248 wrote to memory of 3128 5248 7570.tmp 104 PID 3128 wrote to memory of 4820 3128 75FC.tmp 105 PID 4820 wrote to memory of 1496 4820 76C7.tmp 106 PID 1496 wrote to memory of 2868 1496 7773.tmp 107 PID 2868 wrote to memory of 1996 2868 7800.tmp 108 PID 1996 wrote to memory of 5664 1996 78BB.tmp 109 PID 5664 wrote to memory of 4960 5664 7967.tmp 110 PID 4960 wrote to memory of 4428 4960 7A04.tmp 111 PID 4428 wrote to memory of 4824 4428 7A81.tmp 112 PID 4824 wrote to memory of 5936 4824 7B1D.tmp 113 PID 5936 wrote to memory of 6048 5936 7BD8.tmp 114 PID 6048 wrote to memory of 5924 6048 7C84.tmp 115 PID 5924 wrote to memory of 3016 5924 7D20.tmp 116 PID 3016 wrote to memory of 5988 3016 7D9D.tmp 117 PID 5988 wrote to memory of 4220 5988 7E49.tmp 118 PID 4220 wrote to memory of 2440 4220 7EF5.tmp 119 PID 2440 wrote to memory of 5012 2440 7FB1.tmp 120 PID 5012 wrote to memory of 5560 5012 809B.tmp 121 PID 5560 wrote to memory of 752 5560 8185.tmp 122 PID 752 wrote to memory of 5100 752 8231.tmp 123 PID 5100 wrote to memory of 200 5100 829F.tmp 124 PID 200 wrote to memory of 3712 200 832B.tmp 125 PID 3712 wrote to memory of 1472 3712 83B8.tmp 126 PID 1472 wrote to memory of 4604 1472 8435.tmp 127 PID 4604 wrote to memory of 2496 4604 84D1.tmp 128 PID 2496 wrote to memory of 5484 2496 856D.tmp 129 PID 5484 wrote to memory of 5572 5484 85DB.tmp 130 PID 5572 wrote to memory of 904 5572 8648.tmp 131 PID 904 wrote to memory of 1056 904 86D5.tmp 132 PID 1056 wrote to memory of 1600 1056 8752.tmp 133 PID 1600 wrote to memory of 3064 1600 87DE.tmp 134 PID 3064 wrote to memory of 4980 3064 883C.tmp 135 PID 4980 wrote to memory of 4908 4980 88C9.tmp 136 PID 4908 wrote to memory of 2804 4908 8927.tmp 137 PID 2804 wrote to memory of 772 2804 89A4.tmp 138 PID 772 wrote to memory of 3364 772 8A01.tmp 139 PID 3364 wrote to memory of 3092 3364 8A8E.tmp 140 PID 3092 wrote to memory of 4572 3092 8B0B.tmp 141 PID 4572 wrote to memory of 5996 4572 8B78.tmp 142 PID 5996 wrote to memory of 2592 5996 8BF5.tmp 143 PID 2592 wrote to memory of 3572 2592 8C92.tmp 144 PID 3572 wrote to memory of 1388 3572 8D1E.tmp 145 PID 1388 wrote to memory of 5584 1388 8DAB.tmp 146 PID 5584 wrote to memory of 5648 5584 8E28.tmp 147 PID 5648 wrote to memory of 5540 5648 8EC4.tmp 148 PID 5540 wrote to memory of 2348 5540 8F51.tmp 149 PID 2348 wrote to memory of 4628 2348 8FED.tmp 150 PID 5016 wrote to memory of 2696 5016 9106.tmp 152 PID 2696 wrote to memory of 4800 2696 91A2.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_87a2015f289223526e5ac8002b3f46f1_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_87a2015f289223526e5ac8002b3f46f1_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6C09.tmp"C:\Users\Admin\AppData\Local\Temp\6C09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\6C86.tmp"C:\Users\Admin\AppData\Local\Temp\6C86.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\6D42.tmp"C:\Users\Admin\AppData\Local\Temp\6D42.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\6F07.tmp"C:\Users\Admin\AppData\Local\Temp\6F07.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\736C.tmp"C:\Users\Admin\AppData\Local\Temp\736C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\73E9.tmp"C:\Users\Admin\AppData\Local\Temp\73E9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\74B4.tmp"C:\Users\Admin\AppData\Local\Temp\74B4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\7570.tmp"C:\Users\Admin\AppData\Local\Temp\7570.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\75FC.tmp"C:\Users\Admin\AppData\Local\Temp\75FC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\76C7.tmp"C:\Users\Admin\AppData\Local\Temp\76C7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\7773.tmp"C:\Users\Admin\AppData\Local\Temp\7773.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\7800.tmp"C:\Users\Admin\AppData\Local\Temp\7800.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\78BB.tmp"C:\Users\Admin\AppData\Local\Temp\78BB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7967.tmp"C:\Users\Admin\AppData\Local\Temp\7967.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\7A04.tmp"C:\Users\Admin\AppData\Local\Temp\7A04.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7A81.tmp"C:\Users\Admin\AppData\Local\Temp\7A81.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7BD8.tmp"C:\Users\Admin\AppData\Local\Temp\7BD8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\7C84.tmp"C:\Users\Admin\AppData\Local\Temp\7C84.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\7E49.tmp"C:\Users\Admin\AppData\Local\Temp\7E49.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\809B.tmp"C:\Users\Admin\AppData\Local\Temp\809B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\8231.tmp"C:\Users\Admin\AppData\Local\Temp\8231.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\829F.tmp"C:\Users\Admin\AppData\Local\Temp\829F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\832B.tmp"C:\Users\Admin\AppData\Local\Temp\832B.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\83B8.tmp"C:\Users\Admin\AppData\Local\Temp\83B8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\84D1.tmp"C:\Users\Admin\AppData\Local\Temp\84D1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\856D.tmp"C:\Users\Admin\AppData\Local\Temp\856D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\85DB.tmp"C:\Users\Admin\AppData\Local\Temp\85DB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\8648.tmp"C:\Users\Admin\AppData\Local\Temp\8648.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\86D5.tmp"C:\Users\Admin\AppData\Local\Temp\86D5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8752.tmp"C:\Users\Admin\AppData\Local\Temp\8752.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\87DE.tmp"C:\Users\Admin\AppData\Local\Temp\87DE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\883C.tmp"C:\Users\Admin\AppData\Local\Temp\883C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\88C9.tmp"C:\Users\Admin\AppData\Local\Temp\88C9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8927.tmp"C:\Users\Admin\AppData\Local\Temp\8927.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\89A4.tmp"C:\Users\Admin\AppData\Local\Temp\89A4.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\8A01.tmp"C:\Users\Admin\AppData\Local\Temp\8A01.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\8B78.tmp"C:\Users\Admin\AppData\Local\Temp\8B78.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8BF5.tmp"C:\Users\Admin\AppData\Local\Temp\8BF5.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\8C92.tmp"C:\Users\Admin\AppData\Local\Temp\8C92.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\8E28.tmp"C:\Users\Admin\AppData\Local\Temp\8E28.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\8FED.tmp"C:\Users\Admin\AppData\Local\Temp\8FED.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\907A.tmp"C:\Users\Admin\AppData\Local\Temp\907A.tmp"63⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9106.tmp"C:\Users\Admin\AppData\Local\Temp\9106.tmp"64⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\91A2.tmp"C:\Users\Admin\AppData\Local\Temp\91A2.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\923F.tmp"C:\Users\Admin\AppData\Local\Temp\923F.tmp"66⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"67⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"69⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"70⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"71⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\9944.tmp"C:\Users\Admin\AppData\Local\Temp\9944.tmp"72⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\99B1.tmp"C:\Users\Admin\AppData\Local\Temp\99B1.tmp"73⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"74⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"75⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\9B38.tmp"C:\Users\Admin\AppData\Local\Temp\9B38.tmp"76⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"77⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\9C41.tmp"C:\Users\Admin\AppData\Local\Temp\9C41.tmp"78⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"79⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"80⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\9DB8.tmp"C:\Users\Admin\AppData\Local\Temp\9DB8.tmp"81⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\9E45.tmp"C:\Users\Admin\AppData\Local\Temp\9E45.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\9ED1.tmp"C:\Users\Admin\AppData\Local\Temp\9ED1.tmp"83⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\9F5E.tmp"C:\Users\Admin\AppData\Local\Temp\9F5E.tmp"84⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\9FEB.tmp"C:\Users\Admin\AppData\Local\Temp\9FEB.tmp"85⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\A048.tmp"C:\Users\Admin\AppData\Local\Temp\A048.tmp"86⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A0E5.tmp"C:\Users\Admin\AppData\Local\Temp\A0E5.tmp"87⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\A171.tmp"C:\Users\Admin\AppData\Local\Temp\A171.tmp"88⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"89⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\A26B.tmp"C:\Users\Admin\AppData\Local\Temp\A26B.tmp"90⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\A2C9.tmp"C:\Users\Admin\AppData\Local\Temp\A2C9.tmp"91⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\A365.tmp"C:\Users\Admin\AppData\Local\Temp\A365.tmp"92⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\A411.tmp"C:\Users\Admin\AppData\Local\Temp\A411.tmp"93⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\A4BD.tmp"C:\Users\Admin\AppData\Local\Temp\A4BD.tmp"94⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\A51B.tmp"C:\Users\Admin\AppData\Local\Temp\A51B.tmp"95⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\A598.tmp"C:\Users\Admin\AppData\Local\Temp\A598.tmp"96⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\A605.tmp"C:\Users\Admin\AppData\Local\Temp\A605.tmp"97⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A682.tmp"C:\Users\Admin\AppData\Local\Temp\A682.tmp"98⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A6F0.tmp"C:\Users\Admin\AppData\Local\Temp\A6F0.tmp"99⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\A75D.tmp"C:\Users\Admin\AppData\Local\Temp\A75D.tmp"100⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A7BB.tmp"C:\Users\Admin\AppData\Local\Temp\A7BB.tmp"101⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\A838.tmp"C:\Users\Admin\AppData\Local\Temp\A838.tmp"102⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"103⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A951.tmp"C:\Users\Admin\AppData\Local\Temp\A951.tmp"104⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"105⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"106⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\AAC8.tmp"C:\Users\Admin\AppData\Local\Temp\AAC8.tmp"107⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\AB35.tmp"C:\Users\Admin\AppData\Local\Temp\AB35.tmp"108⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"109⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\AC2F.tmp"C:\Users\Admin\AppData\Local\Temp\AC2F.tmp"110⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\ACAC.tmp"C:\Users\Admin\AppData\Local\Temp\ACAC.tmp"111⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"112⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\AD97.tmp"C:\Users\Admin\AppData\Local\Temp\AD97.tmp"113⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\AE04.tmp"C:\Users\Admin\AppData\Local\Temp\AE04.tmp"114⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\AE81.tmp"C:\Users\Admin\AppData\Local\Temp\AE81.tmp"115⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\AF8B.tmp"C:\Users\Admin\AppData\Local\Temp\AF8B.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\AFF8.tmp"C:\Users\Admin\AppData\Local\Temp\AFF8.tmp"118⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\B075.tmp"C:\Users\Admin\AppData\Local\Temp\B075.tmp"119⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B0E2.tmp"C:\Users\Admin\AppData\Local\Temp\B0E2.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\B16F.tmp"C:\Users\Admin\AppData\Local\Temp\B16F.tmp"121⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B1FC.tmp"C:\Users\Admin\AppData\Local\Temp\B1FC.tmp"122⤵PID:1372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-