Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_fca7bebe708b4b9a235aef00240369d7_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_fca7bebe708b4b9a235aef00240369d7_elex_mafia.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-26_fca7bebe708b4b9a235aef00240369d7_elex_mafia.exe
- Size 560KB
- Sample260629-mxa7babs3s
- SHA256 d9f1412cf82063b005805e67a81b34189158418c795edac3d4590aea37b0c11f
- MD5 fca7bebe708b4b9a235aef00240369d7
- SHA1 7a6de57d385151197f98e25a44cfbda128ddecd2
- SHA512 527724765eb9aec315dff9a3c684b40191623fc4a5c2207dcd4507fbe6656bbd81466713d56a45febb555ccdc40ab08d47f1aa27c6a902956e3f91ba24b3d4f5
- SSDEEP 12288:MlFXOQUDmrC8SEcDEXS9sheBKYTEOJlWwMhIZxV:MlUQbC8SnLsheB1T1kfhIR
- TLSH T10DC4F1227544C073E2D202308A26CB621B7F7C259729A5D777D4276DAFB93D0E67838B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4088 3C1A.tmp 6036 3CF4.tmp 5124 3DEE.tmp 1828 3F56.tmp 1960 3FC3.tmp 2064 4031.tmp 5860 40FC.tmp 3836 4198.tmp 3096 4253.tmp 6052 42F0.tmp 5040 43AB.tmp 1188 4438.tmp 2704 44E4.tmp 4112 45FD.tmp 2848 46D8.tmp 4796 4774.tmp 2528 482F.tmp 1728 48EB.tmp 2136 49B6.tmp 6056 4A81.tmp 2564 4B0E.tmp 5484 4C08.tmp 108 4CA4.tmp 1656 4D40.tmp 5716 4E0B.tmp 3220 4ED7.tmp 4740 4F63.tmp 5664 4FF0.tmp 1676 50AB.tmp 2068 5176.tmp 1148 5203.tmp 4752 52BF.tmp 2140 535B.tmp 4920 53D8.tmp 5492 5464.tmp 3896 54D2.tmp 1532 554F.tmp 5388 55EB.tmp 3532 5658.tmp 3664 56D5.tmp 4816 5772.tmp 1764 57DF.tmp 2072 585C.tmp 5952 58C9.tmp 4568 5956.tmp 1064 59E3.tmp 2556 5A50.tmp 3384 5AEC.tmp 2856 5B79.tmp 1980 5BD7.tmp 3724 5C34.tmp 2732 5C92.tmp 5752 5D00.tmp 2284 5D5D.tmp 5592 5DBB.tmp 2384 5E19.tmp 3552 5E96.tmp 2976 5EF4.tmp 2544 5F71.tmp 1944 5FCE.tmp 1936 602C.tmp 4192 608A.tmp 3692 60E8.tmp 1576 6155.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6210.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 4088 3688 2026-06-26_fca7bebe708b4b9a235aef00240369d7_elex_mafia.exe 90 PID 4088 wrote to memory of 6036 4088 3C1A.tmp 91 PID 6036 wrote to memory of 5124 6036 3CF4.tmp 92 PID 5124 wrote to memory of 1828 5124 3DEE.tmp 93 PID 1828 wrote to memory of 1960 1828 3F56.tmp 94 PID 1960 wrote to memory of 2064 1960 3FC3.tmp 95 PID 2064 wrote to memory of 5860 2064 4031.tmp 96 PID 5860 wrote to memory of 3836 5860 40FC.tmp 97 PID 3836 wrote to memory of 3096 3836 4198.tmp 98 PID 3096 wrote to memory of 6052 3096 4253.tmp 99 PID 6052 wrote to memory of 5040 6052 42F0.tmp 100 PID 5040 wrote to memory of 1188 5040 43AB.tmp 101 PID 1188 wrote to memory of 2704 1188 4438.tmp 102 PID 2704 wrote to memory of 4112 2704 44E4.tmp 103 PID 4112 wrote to memory of 2848 4112 45FD.tmp 104 PID 2848 wrote to memory of 4796 2848 46D8.tmp 105 PID 4796 wrote to memory of 2528 4796 4774.tmp 106 PID 2528 wrote to memory of 1728 2528 482F.tmp 107 PID 1728 wrote to memory of 2136 1728 48EB.tmp 108 PID 2136 wrote to memory of 6056 2136 49B6.tmp 109 PID 6056 wrote to memory of 2564 6056 4A81.tmp 110 PID 2564 wrote to memory of 5484 2564 4B0E.tmp 111 PID 5484 wrote to memory of 108 5484 4C08.tmp 112 PID 108 wrote to memory of 1656 108 4CA4.tmp 113 PID 1656 wrote to memory of 5716 1656 4D40.tmp 114 PID 5716 wrote to memory of 3220 5716 4E0B.tmp 115 PID 3220 wrote to memory of 4740 3220 4ED7.tmp 116 PID 4740 wrote to memory of 5664 4740 4F63.tmp 117 PID 5664 wrote to memory of 1676 5664 4FF0.tmp 118 PID 1676 wrote to memory of 2068 1676 50AB.tmp 119 PID 2068 wrote to memory of 1148 2068 5176.tmp 120 PID 1148 wrote to memory of 4752 1148 5203.tmp 121 PID 4752 wrote to memory of 2140 4752 52BF.tmp 122 PID 2140 wrote to memory of 4920 2140 535B.tmp 123 PID 4920 wrote to memory of 5492 4920 53D8.tmp 124 PID 5492 wrote to memory of 3896 5492 5464.tmp 125 PID 3896 wrote to memory of 1532 3896 54D2.tmp 126 PID 1532 wrote to memory of 5388 1532 554F.tmp 127 PID 5388 wrote to memory of 3532 5388 55EB.tmp 128 PID 3532 wrote to memory of 3664 3532 5658.tmp 129 PID 3664 wrote to memory of 4816 3664 56D5.tmp 130 PID 4816 wrote to memory of 1764 4816 5772.tmp 131 PID 1764 wrote to memory of 2072 1764 57DF.tmp 132 PID 2072 wrote to memory of 5952 2072 585C.tmp 133 PID 5952 wrote to memory of 4568 5952 58C9.tmp 134 PID 4568 wrote to memory of 1064 4568 5956.tmp 135 PID 1064 wrote to memory of 2556 1064 59E3.tmp 136 PID 2556 wrote to memory of 3384 2556 5A50.tmp 137 PID 3384 wrote to memory of 2856 3384 5AEC.tmp 138 PID 2856 wrote to memory of 1980 2856 5B79.tmp 139 PID 1980 wrote to memory of 3724 1980 5BD7.tmp 140 PID 3724 wrote to memory of 2732 3724 5C34.tmp 141 PID 2732 wrote to memory of 5752 2732 5C92.tmp 142 PID 5752 wrote to memory of 2284 5752 5D00.tmp 143 PID 2284 wrote to memory of 5592 2284 5D5D.tmp 144 PID 5592 wrote to memory of 2384 5592 5DBB.tmp 145 PID 2384 wrote to memory of 3552 2384 5E19.tmp 146 PID 3552 wrote to memory of 2976 3552 5E96.tmp 147 PID 2976 wrote to memory of 2544 2976 5EF4.tmp 148 PID 2544 wrote to memory of 1944 2544 5F71.tmp 149 PID 1944 wrote to memory of 1936 1944 5FCE.tmp 150 PID 1936 wrote to memory of 4192 1936 602C.tmp 151 PID 4192 wrote to memory of 3692 4192 608A.tmp 152 PID 3692 wrote to memory of 1576 3692 60E8.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_fca7bebe708b4b9a235aef00240369d7_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_fca7bebe708b4b9a235aef00240369d7_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4774.tmp"C:\Users\Admin\AppData\Local\Temp\4774.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\57DF.tmp"C:\Users\Admin\AppData\Local\Temp\57DF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"65⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"66⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6210.tmp"C:\Users\Admin\AppData\Local\Temp\6210.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"68⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"69⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"70⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"71⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"72⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"73⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"74⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"75⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"76⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6618.tmp"C:\Users\Admin\AppData\Local\Temp\6618.tmp"77⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"78⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\66F2.tmp"C:\Users\Admin\AppData\Local\Temp\66F2.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"80⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"81⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"82⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"83⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"84⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"85⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"86⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"87⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"88⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"89⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"90⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"91⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"92⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"93⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"94⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"96⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"97⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6E74.tmp"C:\Users\Admin\AppData\Local\Temp\6E74.tmp"98⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"99⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"100⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"101⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"102⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"103⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"104⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"105⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"106⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"107⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"108⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"109⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"110⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"111⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"112⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"113⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"114⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"115⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"116⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"117⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"118⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\76E1.tmp"C:\Users\Admin\AppData\Local\Temp\76E1.tmp"119⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"120⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"121⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"122⤵PID:3284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-