Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_434747bf3ca8a46ff144c8a3745b74bf_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_434747bf3ca8a46ff144c8a3745b74bf_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-25_434747bf3ca8a46ff144c8a3745b74bf_elex_mafia.exe
- Size 524KB
- Sample260629-2qengsh13p
- SHA256 ba8aa8349ac4a91caff5f07cfff7fc77b25ab9164fcb291d7c2ce1c220a58f10
- MD5 434747bf3ca8a46ff144c8a3745b74bf
- SHA1 0b0bcd88ef01e35f30019ea9b0373de0d9fb1277
- SHA512 b5eedf7f7785d548bf79ebc1d1f806d5dc7bfd1d087226be440ff63bb69ce8a8acd4e13dc7046f6317ee92792e9c2431ee77d984d301cd3e98af384659aea7c1
- SSDEEP 12288:TRyZzqyL66T2L68SJ3LNA1v8vM8szP6S6VNZ:TRyQylT2LZS5LGqMJPvAN
- TLSH T1D0B4F116B588C032F2D201354A5AEB92597BBDB5AB27A5C73BC4266E2FF03D19374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6096 9035.tmp 5624 90E1.tmp 5940 919C.tmp 6132 9239.tmp 5344 9296.tmp 6912 9313.tmp 6552 9371.tmp 6792 93FE.tmp 4620 948A.tmp 1056 94F8.tmp 5956 9565.tmp 2648 95E2.tmp 6248 9640.tmp 1424 96AD.tmp 6228 971B.tmp 4540 9778.tmp 5184 97D6.tmp 6688 9834.tmp 6528 98B1.tmp 8 990F.tmp 6036 997C.tmp 3200 99DA.tmp 5640 9A28.tmp 5420 9AD4.tmp 4484 9B31.tmp 6392 9BAE.tmp 1096 9C2B.tmp 4744 9C89.tmp 6956 9D06.tmp 6976 9D64.tmp 988 9DC2.tmp 1152 9E1F.tmp 3388 9E8D.tmp 4220 9EFA.tmp 6152 9F68.tmp 2564 A004.tmp 4444 A071.tmp 4876 A0CF.tmp 6820 A12D.tmp 6592 A19A.tmp 4736 A207.tmp 6188 A275.tmp 4684 A2E2.tmp 3936 A330.tmp 4832 A3AD.tmp 6724 A3FB.tmp 3256 A469.tmp 1072 A4B7.tmp 5164 A515.tmp 296 A592.tmp 6424 A5D0.tmp 1804 A64D.tmp 4300 A69B.tmp 6560 A6F9.tmp 1552 A757.tmp 4584 A7B5.tmp 1884 A803.tmp 6404 A851.tmp 5020 A89F.tmp 6660 A8FD.tmp 2428 A94B.tmp 6600 A999.tmp 4240 A9E7.tmp 3424 AA35.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A88B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3864 wrote to memory of 6096 3864 2026-06-25_434747bf3ca8a46ff144c8a3745b74bf_elex_mafia.exe 88 PID 6096 wrote to memory of 5624 6096 9035.tmp 89 PID 5624 wrote to memory of 5940 5624 90E1.tmp 90 PID 5940 wrote to memory of 6132 5940 919C.tmp 91 PID 6132 wrote to memory of 5344 6132 9239.tmp 92 PID 5344 wrote to memory of 6912 5344 9296.tmp 93 PID 6912 wrote to memory of 6552 6912 9313.tmp 94 PID 6552 wrote to memory of 6792 6552 9371.tmp 95 PID 6792 wrote to memory of 4620 6792 93FE.tmp 96 PID 4620 wrote to memory of 1056 4620 948A.tmp 97 PID 1056 wrote to memory of 5956 1056 94F8.tmp 98 PID 5956 wrote to memory of 2648 5956 9565.tmp 99 PID 2648 wrote to memory of 6248 2648 95E2.tmp 100 PID 6248 wrote to memory of 1424 6248 9640.tmp 101 PID 1424 wrote to memory of 6228 1424 96AD.tmp 102 PID 6228 wrote to memory of 4540 6228 971B.tmp 103 PID 4540 wrote to memory of 5184 4540 9778.tmp 104 PID 5184 wrote to memory of 6688 5184 97D6.tmp 105 PID 6688 wrote to memory of 6528 6688 9834.tmp 106 PID 6528 wrote to memory of 8 6528 98B1.tmp 107 PID 8 wrote to memory of 6036 8 990F.tmp 108 PID 6036 wrote to memory of 3200 6036 997C.tmp 109 PID 3200 wrote to memory of 5640 3200 99DA.tmp 110 PID 5640 wrote to memory of 5420 5640 9A28.tmp 111 PID 5420 wrote to memory of 4484 5420 9AD4.tmp 112 PID 4484 wrote to memory of 6392 4484 9B31.tmp 113 PID 6392 wrote to memory of 1096 6392 9BAE.tmp 114 PID 1096 wrote to memory of 4744 1096 9C2B.tmp 115 PID 4744 wrote to memory of 6956 4744 9C89.tmp 116 PID 6956 wrote to memory of 6976 6956 9D06.tmp 117 PID 6976 wrote to memory of 988 6976 9D64.tmp 118 PID 988 wrote to memory of 1152 988 9DC2.tmp 119 PID 1152 wrote to memory of 3388 1152 9E1F.tmp 120 PID 3388 wrote to memory of 4220 3388 9E8D.tmp 121 PID 4220 wrote to memory of 6152 4220 9EFA.tmp 122 PID 6152 wrote to memory of 2564 6152 9F68.tmp 123 PID 2564 wrote to memory of 4444 2564 A004.tmp 124 PID 4444 wrote to memory of 4876 4444 A071.tmp 125 PID 4876 wrote to memory of 6820 4876 A0CF.tmp 126 PID 6820 wrote to memory of 6592 6820 A12D.tmp 127 PID 6592 wrote to memory of 4736 6592 A19A.tmp 128 PID 4736 wrote to memory of 6188 4736 A207.tmp 129 PID 6188 wrote to memory of 4684 6188 A275.tmp 130 PID 4684 wrote to memory of 3936 4684 A2E2.tmp 131 PID 3936 wrote to memory of 4832 3936 A330.tmp 132 PID 4832 wrote to memory of 6724 4832 A3AD.tmp 133 PID 6724 wrote to memory of 3256 6724 A3FB.tmp 134 PID 3256 wrote to memory of 1072 3256 A469.tmp 135 PID 1072 wrote to memory of 5164 1072 A4B7.tmp 136 PID 5164 wrote to memory of 296 5164 A515.tmp 137 PID 296 wrote to memory of 6424 296 A592.tmp 138 PID 6424 wrote to memory of 1804 6424 A5D0.tmp 139 PID 1804 wrote to memory of 4300 1804 A64D.tmp 140 PID 4300 wrote to memory of 6560 4300 A69B.tmp 141 PID 6560 wrote to memory of 1552 6560 A6F9.tmp 142 PID 1552 wrote to memory of 4584 1552 A757.tmp 143 PID 4584 wrote to memory of 1884 4584 A7B5.tmp 144 PID 1884 wrote to memory of 6404 1884 A803.tmp 145 PID 6404 wrote to memory of 5020 6404 A851.tmp 146 PID 5020 wrote to memory of 6660 5020 A89F.tmp 147 PID 6660 wrote to memory of 2428 6660 A8FD.tmp 148 PID 2428 wrote to memory of 6600 2428 A94B.tmp 149 PID 6600 wrote to memory of 4240 6600 A999.tmp 150 PID 4240 wrote to memory of 3424 4240 A9E7.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_434747bf3ca8a46ff144c8a3745b74bf_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_434747bf3ca8a46ff144c8a3745b74bf_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\9035.tmp"C:\Users\Admin\AppData\Local\Temp\9035.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\9313.tmp"C:\Users\Admin\AppData\Local\Temp\9313.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6912 -
C:\Users\Admin\AppData\Local\Temp\9371.tmp"C:\Users\Admin\AppData\Local\Temp\9371.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6552 -
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6792 -
C:\Users\Admin\AppData\Local\Temp\948A.tmp"C:\Users\Admin\AppData\Local\Temp\948A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\9565.tmp"C:\Users\Admin\AppData\Local\Temp\9565.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\95E2.tmp"C:\Users\Admin\AppData\Local\Temp\95E2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\9640.tmp"C:\Users\Admin\AppData\Local\Temp\9640.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6248 -
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\971B.tmp"C:\Users\Admin\AppData\Local\Temp\971B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6228 -
C:\Users\Admin\AppData\Local\Temp\9778.tmp"C:\Users\Admin\AppData\Local\Temp\9778.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\97D6.tmp"C:\Users\Admin\AppData\Local\Temp\97D6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6688 -
C:\Users\Admin\AppData\Local\Temp\98B1.tmp"C:\Users\Admin\AppData\Local\Temp\98B1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6528 -
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\99DA.tmp"C:\Users\Admin\AppData\Local\Temp\99DA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\9B31.tmp"C:\Users\Admin\AppData\Local\Temp\9B31.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6392 -
C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6956 -
C:\Users\Admin\AppData\Local\Temp\9D64.tmp"C:\Users\Admin\AppData\Local\Temp\9D64.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6976 -
C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6152 -
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6820 -
C:\Users\Admin\AppData\Local\Temp\A19A.tmp"C:\Users\Admin\AppData\Local\Temp\A19A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6592 -
C:\Users\Admin\AppData\Local\Temp\A207.tmp"C:\Users\Admin\AppData\Local\Temp\A207.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6188 -
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6724 -
C:\Users\Admin\AppData\Local\Temp\A469.tmp"C:\Users\Admin\AppData\Local\Temp\A469.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6424 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6560 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\A851.tmp"C:\Users\Admin\AppData\Local\Temp\A851.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6404 -
C:\Users\Admin\AppData\Local\Temp\A89F.tmp"C:\Users\Admin\AppData\Local\Temp\A89F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6660 -
C:\Users\Admin\AppData\Local\Temp\A94B.tmp"C:\Users\Admin\AppData\Local\Temp\A94B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A999.tmp"C:\Users\Admin\AppData\Local\Temp\A999.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6600 -
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\AA35.tmp"C:\Users\Admin\AppData\Local\Temp\AA35.tmp"65⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"66⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"67⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\AB20.tmp"C:\Users\Admin\AppData\Local\Temp\AB20.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"C:\Users\Admin\AppData\Local\Temp\AB6E.tmp"69⤵PID:6860
-
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"70⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\AC0A.tmp"C:\Users\Admin\AppData\Local\Temp\AC0A.tmp"71⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"72⤵PID:7152
-
C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"73⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"74⤵PID:6444
-
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"75⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"76⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"77⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"78⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"79⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\AED9.tmp"C:\Users\Admin\AppData\Local\Temp\AED9.tmp"80⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\AF27.tmp"C:\Users\Admin\AppData\Local\Temp\AF27.tmp"81⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"82⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"83⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"84⤵PID:6300
-
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"85⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\B0AD.tmp"C:\Users\Admin\AppData\Local\Temp\B0AD.tmp"86⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"87⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\B14A.tmp"C:\Users\Admin\AppData\Local\Temp\B14A.tmp"88⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"89⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"90⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\B244.tmp"C:\Users\Admin\AppData\Local\Temp\B244.tmp"91⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B292.tmp"C:\Users\Admin\AppData\Local\Temp\B292.tmp"92⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"93⤵PID:6476
-
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"94⤵PID:6232
-
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"95⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"96⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B447.tmp"C:\Users\Admin\AppData\Local\Temp\B447.tmp"97⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"98⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\B541.tmp"C:\Users\Admin\AppData\Local\Temp\B541.tmp"99⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"100⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\B60C.tmp"C:\Users\Admin\AppData\Local\Temp\B60C.tmp"101⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"102⤵PID:6348
-
C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"103⤵PID:6344
-
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"104⤵PID:6180
-
C:\Users\Admin\AppData\Local\Temp\B7D2.tmp"C:\Users\Admin\AppData\Local\Temp\B7D2.tmp"105⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"106⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"107⤵PID:6192
-
C:\Users\Admin\AppData\Local\Temp\B90A.tmp"C:\Users\Admin\AppData\Local\Temp\B90A.tmp"108⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"109⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"110⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"111⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"113⤵PID:6412
-
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"114⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"115⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"116⤵PID:6648
-
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"117⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"118⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"119⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"120⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"121⤵PID:6628
-
C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"122⤵PID:6968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-