Analysis
- max time kernel
70s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe
- Size 524KB
- Sample261022-vpd71aws5r
- SHA256 fdee62e2d2e90c48185037be9cbdfa0f577870f23521b4767386fca5779293c3
- MD5 9293f71053f0ca2c2e7f492083b9552f
- SHA1 a6a804a899c0aadc58dac6b5b661fec599dd155f
- SHA512 9df3a0efc8087b7d083996c8b4a45be5504183f45454e7c8dda400c8ef37c8eeb6d0d9ed6506468a1d9187bdf9161f6fa6f950bb25ad006775be08f681a8dbc1
- SSDEEP 12288:TRyZzqyL66T+ofcGM44dNyrmyPeG9q0yENZ:TRyQylT+ofcGMndNyLer0yEN
- TLSH T117B4F116B588C432E68215718E2ADBA2593ABC755B27A4CB3BD4367E2FF43C1D274307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3216 37C.tmp 4188 408.tmp 4020 476.tmp 4552 62B.tmp 8 6F6.tmp 3976 7B2.tmp 5676 88D.tmp 2832 977.tmp 1168 A42.tmp 4540 B0D.tmp 3360 B9A.tmp 676 CB3.tmp 5144 D7E.tmp 5020 EC6.tmp 5392 FA1.tmp 1100 10AB.tmp 5568 11C4.tmp 3036 12CE.tmp 1092 1389.tmp 3040 1454.tmp 1580 158D.tmp 5752 16A6.tmp 3324 1771.tmp 3140 182D.tmp 2840 1917.tmp 3992 19E2.tmp 2860 1ABD.tmp 5904 1B78.tmp 3596 1C34.tmp 936 1CFF.tmp 5456 1DBB.tmp 1700 1E86.tmp 1804 1F60.tmp 4832 202C.tmp 2948 20B8.tmp 1420 2135.tmp 5796 2200.tmp 4752 22BC.tmp 908 2339.tmp 5748 23E5.tmp 944 24CF.tmp 4100 259A.tmp 5724 2617.tmp 4924 26A4.tmp 4168 277F.tmp 2612 281B.tmp 3084 28A7.tmp 5368 2953.tmp 3668 29E0.tmp 3892 2A6D.tmp 2180 2ADA.tmp 2392 2B57.tmp 1672 2BE4.tmp 3136 2C70.tmp 4620 2CDE.tmp 3728 2D5B.tmp 4360 2DC8.tmp 368 2E45.tmp 3428 2EC2.tmp 4756 2F5E.tmp 5776 2FEB.tmp 4252 3058.tmp 856 30C6.tmp 3028 3133.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 591E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 613C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A048.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1019.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5257.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F88A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F82C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D90C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 980B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 3216 2640 2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe 90 PID 3216 wrote to memory of 4188 3216 37C.tmp 91 PID 4188 wrote to memory of 4020 4188 408.tmp 92 PID 4020 wrote to memory of 4552 4020 476.tmp 93 PID 4552 wrote to memory of 8 4552 62B.tmp 94 PID 8 wrote to memory of 3976 8 6F6.tmp 95 PID 3976 wrote to memory of 5676 3976 7B2.tmp 96 PID 5676 wrote to memory of 2832 5676 88D.tmp 97 PID 2832 wrote to memory of 1168 2832 977.tmp 98 PID 1168 wrote to memory of 4540 1168 A42.tmp 99 PID 4540 wrote to memory of 3360 4540 B0D.tmp 100 PID 3360 wrote to memory of 676 3360 B9A.tmp 101 PID 676 wrote to memory of 5144 676 CB3.tmp 102 PID 5144 wrote to memory of 5020 5144 D7E.tmp 103 PID 5020 wrote to memory of 5392 5020 EC6.tmp 104 PID 5392 wrote to memory of 1100 5392 FA1.tmp 105 PID 1100 wrote to memory of 5568 1100 10AB.tmp 106 PID 5568 wrote to memory of 3036 5568 11C4.tmp 107 PID 3036 wrote to memory of 1092 3036 12CE.tmp 108 PID 1092 wrote to memory of 3040 1092 1389.tmp 109 PID 3040 wrote to memory of 1580 3040 1454.tmp 110 PID 1580 wrote to memory of 5752 1580 158D.tmp 111 PID 5752 wrote to memory of 3324 5752 16A6.tmp 112 PID 3324 wrote to memory of 3140 3324 1771.tmp 113 PID 3140 wrote to memory of 2840 3140 182D.tmp 114 PID 2840 wrote to memory of 3992 2840 1917.tmp 115 PID 3992 wrote to memory of 2860 3992 19E2.tmp 116 PID 2860 wrote to memory of 5904 2860 1ABD.tmp 117 PID 5904 wrote to memory of 3596 5904 1B78.tmp 118 PID 3596 wrote to memory of 936 3596 1C34.tmp 119 PID 936 wrote to memory of 5456 936 1CFF.tmp 120 PID 5456 wrote to memory of 1700 5456 1DBB.tmp 121 PID 1700 wrote to memory of 1804 1700 1E86.tmp 122 PID 1804 wrote to memory of 4832 1804 1F60.tmp 123 PID 4832 wrote to memory of 2948 4832 202C.tmp 124 PID 2948 wrote to memory of 1420 2948 20B8.tmp 125 PID 1420 wrote to memory of 5796 1420 2135.tmp 126 PID 5796 wrote to memory of 4752 5796 2200.tmp 127 PID 4752 wrote to memory of 908 4752 22BC.tmp 128 PID 908 wrote to memory of 5748 908 2339.tmp 129 PID 5748 wrote to memory of 944 5748 23E5.tmp 130 PID 944 wrote to memory of 4100 944 24CF.tmp 131 PID 4100 wrote to memory of 5724 4100 259A.tmp 132 PID 5724 wrote to memory of 4924 5724 2617.tmp 133 PID 4924 wrote to memory of 4168 4924 26A4.tmp 134 PID 4168 wrote to memory of 2612 4168 277F.tmp 135 PID 2612 wrote to memory of 3084 2612 281B.tmp 136 PID 3084 wrote to memory of 5368 3084 28A7.tmp 137 PID 5368 wrote to memory of 3668 5368 2953.tmp 138 PID 3668 wrote to memory of 3892 3668 29E0.tmp 139 PID 3892 wrote to memory of 2180 3892 2A6D.tmp 140 PID 2180 wrote to memory of 2392 2180 2ADA.tmp 141 PID 2392 wrote to memory of 1672 2392 2B57.tmp 142 PID 1672 wrote to memory of 3136 1672 2BE4.tmp 143 PID 3136 wrote to memory of 4620 3136 2C70.tmp 144 PID 4620 wrote to memory of 3728 4620 2CDE.tmp 145 PID 3728 wrote to memory of 4360 3728 2D5B.tmp 146 PID 4360 wrote to memory of 368 4360 2DC8.tmp 147 PID 368 wrote to memory of 3428 368 2E45.tmp 148 PID 3428 wrote to memory of 4756 3428 2EC2.tmp 149 PID 4756 wrote to memory of 5776 4756 2F5E.tmp 150 PID 5776 wrote to memory of 4252 5776 2FEB.tmp 151 PID 4252 wrote to memory of 856 4252 3058.tmp 152 PID 856 wrote to memory of 3028 856 30C6.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_9293f71053f0ca2c2e7f492083b9552f_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\37C.tmp"C:\Users\Admin\AppData\Local\Temp\37C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\476.tmp"C:\Users\Admin\AppData\Local\Temp\476.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\6F6.tmp"C:\Users\Admin\AppData\Local\Temp\6F6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7B2.tmp"C:\Users\Admin\AppData\Local\Temp\7B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\B9A.tmp"C:\Users\Admin\AppData\Local\Temp\B9A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\CB3.tmp"C:\Users\Admin\AppData\Local\Temp\CB3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\EC6.tmp"C:\Users\Admin\AppData\Local\Temp\EC6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\11C4.tmp"C:\Users\Admin\AppData\Local\Temp\11C4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\1454.tmp"C:\Users\Admin\AppData\Local\Temp\1454.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\158D.tmp"C:\Users\Admin\AppData\Local\Temp\158D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\16A6.tmp"C:\Users\Admin\AppData\Local\Temp\16A6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\1771.tmp"C:\Users\Admin\AppData\Local\Temp\1771.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\1917.tmp"C:\Users\Admin\AppData\Local\Temp\1917.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\19E2.tmp"C:\Users\Admin\AppData\Local\Temp\19E2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1B78.tmp"C:\Users\Admin\AppData\Local\Temp\1B78.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\1C34.tmp"C:\Users\Admin\AppData\Local\Temp\1C34.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\20B8.tmp"C:\Users\Admin\AppData\Local\Temp\20B8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2135.tmp"C:\Users\Admin\AppData\Local\Temp\2135.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\26A4.tmp"C:\Users\Admin\AppData\Local\Temp\26A4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\277F.tmp"C:\Users\Admin\AppData\Local\Temp\277F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\281B.tmp"C:\Users\Admin\AppData\Local\Temp\281B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\28A7.tmp"C:\Users\Admin\AppData\Local\Temp\28A7.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"C:\Users\Admin\AppData\Local\Temp\2A6D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2B57.tmp"C:\Users\Admin\AppData\Local\Temp\2B57.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\2E45.tmp"C:\Users\Admin\AppData\Local\Temp\2E45.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\30C6.tmp"C:\Users\Admin\AppData\Local\Temp\30C6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3133.tmp"C:\Users\Admin\AppData\Local\Temp\3133.tmp"65⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\31B0.tmp"C:\Users\Admin\AppData\Local\Temp\31B0.tmp"66⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\321D.tmp"C:\Users\Admin\AppData\Local\Temp\321D.tmp"67⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\328B.tmp"C:\Users\Admin\AppData\Local\Temp\328B.tmp"68⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\32F8.tmp"C:\Users\Admin\AppData\Local\Temp\32F8.tmp"69⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\3375.tmp"C:\Users\Admin\AppData\Local\Temp\3375.tmp"70⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\33E2.tmp"C:\Users\Admin\AppData\Local\Temp\33E2.tmp"71⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\345F.tmp"C:\Users\Admin\AppData\Local\Temp\345F.tmp"72⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\34CD.tmp"C:\Users\Admin\AppData\Local\Temp\34CD.tmp"73⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\353A.tmp"C:\Users\Admin\AppData\Local\Temp\353A.tmp"74⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3615.tmp"C:\Users\Admin\AppData\Local\Temp\3615.tmp"76⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\3682.tmp"C:\Users\Admin\AppData\Local\Temp\3682.tmp"77⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\36FF.tmp"C:\Users\Admin\AppData\Local\Temp\36FF.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\376D.tmp"C:\Users\Admin\AppData\Local\Temp\376D.tmp"79⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\37EA.tmp"C:\Users\Admin\AppData\Local\Temp\37EA.tmp"80⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3867.tmp"C:\Users\Admin\AppData\Local\Temp\3867.tmp"81⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\38D4.tmp"C:\Users\Admin\AppData\Local\Temp\38D4.tmp"82⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\3961.tmp"C:\Users\Admin\AppData\Local\Temp\3961.tmp"83⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\39ED.tmp"C:\Users\Admin\AppData\Local\Temp\39ED.tmp"84⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"85⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"86⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\3B64.tmp"C:\Users\Admin\AppData\Local\Temp\3B64.tmp"87⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\3BD2.tmp"C:\Users\Admin\AppData\Local\Temp\3BD2.tmp"88⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"89⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\3D49.tmp"C:\Users\Admin\AppData\Local\Temp\3D49.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"92⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3E43.tmp"C:\Users\Admin\AppData\Local\Temp\3E43.tmp"93⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"94⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"95⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\3FC9.tmp"C:\Users\Admin\AppData\Local\Temp\3FC9.tmp"96⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\4056.tmp"C:\Users\Admin\AppData\Local\Temp\4056.tmp"97⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\40C3.tmp"C:\Users\Admin\AppData\Local\Temp\40C3.tmp"98⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\4140.tmp"C:\Users\Admin\AppData\Local\Temp\4140.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\41BD.tmp"C:\Users\Admin\AppData\Local\Temp\41BD.tmp"100⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\423A.tmp"C:\Users\Admin\AppData\Local\Temp\423A.tmp"101⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\42C7.tmp"C:\Users\Admin\AppData\Local\Temp\42C7.tmp"102⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\4334.tmp"C:\Users\Admin\AppData\Local\Temp\4334.tmp"103⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\43B1.tmp"C:\Users\Admin\AppData\Local\Temp\43B1.tmp"104⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\442E.tmp"C:\Users\Admin\AppData\Local\Temp\442E.tmp"105⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\44AB.tmp"C:\Users\Admin\AppData\Local\Temp\44AB.tmp"106⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\4519.tmp"C:\Users\Admin\AppData\Local\Temp\4519.tmp"107⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\4596.tmp"C:\Users\Admin\AppData\Local\Temp\4596.tmp"108⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\4603.tmp"C:\Users\Admin\AppData\Local\Temp\4603.tmp"109⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\4680.tmp"C:\Users\Admin\AppData\Local\Temp\4680.tmp"110⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\46ED.tmp"C:\Users\Admin\AppData\Local\Temp\46ED.tmp"111⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\477A.tmp"C:\Users\Admin\AppData\Local\Temp\477A.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\47E7.tmp"C:\Users\Admin\AppData\Local\Temp\47E7.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\4855.tmp"C:\Users\Admin\AppData\Local\Temp\4855.tmp"114⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\48D2.tmp"C:\Users\Admin\AppData\Local\Temp\48D2.tmp"115⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\494F.tmp"C:\Users\Admin\AppData\Local\Temp\494F.tmp"116⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\49BC.tmp"C:\Users\Admin\AppData\Local\Temp\49BC.tmp"117⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\4A39.tmp"C:\Users\Admin\AppData\Local\Temp\4A39.tmp"118⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"119⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"121⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-