Analysis
- max time kernel
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe
- Size 816KB
- Sample260718-e6z8ssbw9w
- SHA256 cad2bcc9d85e28db4ff1c06cf9aea21471068380cb047872f590ddc1145086b5
- MD5 24c3b29c6ffc1c83d647d1bc5c0a38ed
- SHA1 f2548f5c9cf98e4b40ac84a76abd1aed8eb72107
- SHA512 29df15254932e6e4a5911f736c05fcc104c887d380a174b0de355f4f0d41a3996c9448d12ff804cbed4a64a94e19e031d5edfe675d814b4ec7362f0dc8df28a8
- SSDEEP 12288:+mF/W8Dsy37qIZtnp83VjyjxpCTePXyfzfFG3Z:+m0833TDpQMAKPofY3
- TLSH T16805F111F684C032E59202354F2EEBA2487A7D715B27A4C77B903ABE6FB52D1DA71307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1620 FA1A.tmp 5104 FAB7.tmp 3432 FB43.tmp 4108 FC2E.tmp 5148 FD08.tmp 3352 FD95.tmp 1016 FE31.tmp 4420 FEDD.tmp 3200 FFB8.tmp 5960 A2.tmp 5544 18D.tmp 5984 267.tmp 2120 361.tmp 680 41D.tmp 6024 4E8.tmp 5968 5A3.tmp 2972 66F.tmp 3188 70B.tmp 4296 805.tmp 3704 8B1.tmp 2572 9BA.tmp 108 AA5.tmp 1976 B60.tmp 1860 C6A.tmp 5516 D25.tmp 4784 E10.tmp 4728 ECB.tmp 1992 FA6.tmp 2616 1071.tmp 3248 114C.tmp 5584 1275.tmp 1580 1330.tmp 2916 143A.tmp 3956 14C6.tmp 1188 1582.tmp 3260 160F.tmp 4896 16AB.tmp 5524 1737.tmp 4888 17C4.tmp 5752 1880.tmp 5652 190C.tmp 764 1999.tmp 1052 1A35.tmp 4516 1AA2.tmp 3268 1B3F.tmp 3676 1BCB.tmp 4776 1C87.tmp 920 1D42.tmp 1204 1DEE.tmp 2440 1E8A.tmp 1616 1F27.tmp 4340 1FC3.tmp 3724 2050.tmp 3276 20EC.tmp 5580 2188.tmp 1160 2234.tmp 4528 22B1.tmp 4624 233E.tmp 4252 23DA.tmp 1312 2476.tmp 1412 2512.tmp 3296 259F.tmp 4800 264B.tmp 3856 26D7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B73B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 285E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A79B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 886B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADD5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1620 2708 2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe 89 PID 1620 wrote to memory of 5104 1620 FA1A.tmp 90 PID 5104 wrote to memory of 3432 5104 FAB7.tmp 91 PID 3432 wrote to memory of 4108 3432 FB43.tmp 92 PID 4108 wrote to memory of 5148 4108 FC2E.tmp 93 PID 5148 wrote to memory of 3352 5148 FD08.tmp 94 PID 3352 wrote to memory of 1016 3352 FD95.tmp 95 PID 1016 wrote to memory of 4420 1016 FE31.tmp 96 PID 4420 wrote to memory of 3200 4420 FEDD.tmp 97 PID 3200 wrote to memory of 5960 3200 FFB8.tmp 98 PID 5960 wrote to memory of 5544 5960 A2.tmp 99 PID 5544 wrote to memory of 5984 5544 18D.tmp 100 PID 5984 wrote to memory of 2120 5984 267.tmp 101 PID 2120 wrote to memory of 680 2120 361.tmp 102 PID 680 wrote to memory of 6024 680 41D.tmp 103 PID 6024 wrote to memory of 5968 6024 4E8.tmp 104 PID 5968 wrote to memory of 2972 5968 5A3.tmp 105 PID 2972 wrote to memory of 3188 2972 66F.tmp 106 PID 3188 wrote to memory of 4296 3188 70B.tmp 107 PID 4296 wrote to memory of 3704 4296 805.tmp 108 PID 3704 wrote to memory of 2572 3704 8B1.tmp 109 PID 2572 wrote to memory of 108 2572 9BA.tmp 110 PID 108 wrote to memory of 1976 108 AA5.tmp 111 PID 1976 wrote to memory of 1860 1976 B60.tmp 112 PID 1860 wrote to memory of 5516 1860 C6A.tmp 113 PID 5516 wrote to memory of 4784 5516 D25.tmp 114 PID 4784 wrote to memory of 4728 4784 E10.tmp 115 PID 4728 wrote to memory of 1992 4728 ECB.tmp 116 PID 1992 wrote to memory of 2616 1992 FA6.tmp 117 PID 2616 wrote to memory of 3248 2616 1071.tmp 118 PID 3248 wrote to memory of 5584 3248 114C.tmp 119 PID 5584 wrote to memory of 1580 5584 1275.tmp 120 PID 1580 wrote to memory of 2916 1580 1330.tmp 121 PID 2916 wrote to memory of 3956 2916 143A.tmp 122 PID 3956 wrote to memory of 1188 3956 14C6.tmp 123 PID 1188 wrote to memory of 3260 1188 1582.tmp 124 PID 3260 wrote to memory of 4896 3260 160F.tmp 125 PID 4896 wrote to memory of 5524 4896 16AB.tmp 126 PID 5524 wrote to memory of 4888 5524 1737.tmp 127 PID 4888 wrote to memory of 5752 4888 17C4.tmp 128 PID 5752 wrote to memory of 5652 5752 1880.tmp 129 PID 5652 wrote to memory of 764 5652 190C.tmp 130 PID 764 wrote to memory of 1052 764 1999.tmp 131 PID 1052 wrote to memory of 4516 1052 1A35.tmp 132 PID 4516 wrote to memory of 3268 4516 1AA2.tmp 133 PID 3268 wrote to memory of 3676 3268 1B3F.tmp 134 PID 3676 wrote to memory of 4776 3676 1BCB.tmp 135 PID 4776 wrote to memory of 920 4776 1C87.tmp 136 PID 920 wrote to memory of 1204 920 1D42.tmp 137 PID 1204 wrote to memory of 2440 1204 1DEE.tmp 138 PID 2440 wrote to memory of 1616 2440 1E8A.tmp 139 PID 1616 wrote to memory of 4340 1616 1F27.tmp 140 PID 4340 wrote to memory of 3724 4340 1FC3.tmp 141 PID 3724 wrote to memory of 3276 3724 2050.tmp 142 PID 3276 wrote to memory of 5580 3276 20EC.tmp 143 PID 5580 wrote to memory of 1160 5580 2188.tmp 144 PID 1160 wrote to memory of 4528 1160 2234.tmp 145 PID 4528 wrote to memory of 4624 4528 22B1.tmp 146 PID 4624 wrote to memory of 4252 4624 233E.tmp 147 PID 4252 wrote to memory of 1312 4252 23DA.tmp 148 PID 1312 wrote to memory of 1412 1312 2476.tmp 149 PID 1412 wrote to memory of 3296 1412 2512.tmp 150 PID 3296 wrote to memory of 4800 3296 259F.tmp 151 PID 4800 wrote to memory of 3856 4800 264B.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\FAB7.tmp"C:\Users\Admin\AppData\Local\Temp\FAB7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\FC2E.tmp"C:\Users\Admin\AppData\Local\Temp\FC2E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\267.tmp"C:\Users\Admin\AppData\Local\Temp\267.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\4E8.tmp"C:\Users\Admin\AppData\Local\Temp\4E8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\5A3.tmp"C:\Users\Admin\AppData\Local\Temp\5A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\66F.tmp"C:\Users\Admin\AppData\Local\Temp\66F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\70B.tmp"C:\Users\Admin\AppData\Local\Temp\70B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\805.tmp"C:\Users\Admin\AppData\Local\Temp\805.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\9BA.tmp"C:\Users\Admin\AppData\Local\Temp\9BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\C6A.tmp"C:\Users\Admin\AppData\Local\Temp\C6A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1071.tmp"C:\Users\Admin\AppData\Local\Temp\1071.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\114C.tmp"C:\Users\Admin\AppData\Local\Temp\114C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\1275.tmp"C:\Users\Admin\AppData\Local\Temp\1275.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\1582.tmp"C:\Users\Admin\AppData\Local\Temp\1582.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\1737.tmp"C:\Users\Admin\AppData\Local\Temp\1737.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1D42.tmp"C:\Users\Admin\AppData\Local\Temp\1D42.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1F27.tmp"C:\Users\Admin\AppData\Local\Temp\1F27.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2050.tmp"C:\Users\Admin\AppData\Local\Temp\2050.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\20EC.tmp"C:\Users\Admin\AppData\Local\Temp\20EC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\2234.tmp"C:\Users\Admin\AppData\Local\Temp\2234.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\22B1.tmp"C:\Users\Admin\AppData\Local\Temp\22B1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\233E.tmp"C:\Users\Admin\AppData\Local\Temp\233E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\23DA.tmp"C:\Users\Admin\AppData\Local\Temp\23DA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\264B.tmp"C:\Users\Admin\AppData\Local\Temp\264B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\26D7.tmp"C:\Users\Admin\AppData\Local\Temp\26D7.tmp"65⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"66⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\285E.tmp"C:\Users\Admin\AppData\Local\Temp\285E.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"68⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\2987.tmp"C:\Users\Admin\AppData\Local\Temp\2987.tmp"69⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\2A33.tmp"C:\Users\Admin\AppData\Local\Temp\2A33.tmp"70⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"71⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"72⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"73⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"74⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"75⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"77⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"78⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"79⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"80⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\308C.tmp"C:\Users\Admin\AppData\Local\Temp\308C.tmp"81⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"82⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"83⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"84⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\32BE.tmp"C:\Users\Admin\AppData\Local\Temp\32BE.tmp"85⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\333B.tmp"C:\Users\Admin\AppData\Local\Temp\333B.tmp"86⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"87⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"88⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\34F1.tmp"C:\Users\Admin\AppData\Local\Temp\34F1.tmp"89⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"90⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"92⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"93⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"94⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\385C.tmp"C:\Users\Admin\AppData\Local\Temp\385C.tmp"95⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:348 -
C:\Users\Admin\AppData\Local\Temp\3975.tmp"C:\Users\Admin\AppData\Local\Temp\3975.tmp"97⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"98⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"99⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"100⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"101⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"102⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"103⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"104⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"105⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"106⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"107⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"108⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"109⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4107.tmp"C:\Users\Admin\AppData\Local\Temp\4107.tmp"110⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\41C2.tmp"C:\Users\Admin\AppData\Local\Temp\41C2.tmp"111⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"112⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\42FB.tmp"C:\Users\Admin\AppData\Local\Temp\42FB.tmp"113⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"114⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"115⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"116⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"117⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"118⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\46A4.tmp"C:\Users\Admin\AppData\Local\Temp\46A4.tmp"119⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"120⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"121⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\4869.tmp"C:\Users\Admin\AppData\Local\Temp\4869.tmp"122⤵PID:4188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-