Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 14:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_44f9a53787fa24874e7dbfeaf1421238_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_44f9a53787fa24874e7dbfeaf1421238_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-31_44f9a53787fa24874e7dbfeaf1421238_elex_mafia.exe
- Size 564KB
- Sample260731-ry7dcswwb1
- SHA256 84b769bf3759b59c59804c88c89c89f46a0474cc4f29855efbf3cc17e2aa82df
- MD5 44f9a53787fa24874e7dbfeaf1421238
- SHA1 ae97d8b1325d2d020ac223d74cec48eb08604348
- SHA512 a10f0ea78cd3bc71ccb49d4db55b1667dafd3ca6983dc551f151e9a20df1898389653f03fab15c12b6bf82e9776bac808f701824d3e3fb9be95b1a57420c1c2a
- SSDEEP 12288:Kdhh2PNZW9BZPsm+byesON9ZQt5tPxXUdnTZulH:KdqPu9BZPsP+esY/0XU9TglH
- TLSH T1C3C4E115B685C03AF2C202314A15EB925A3A7C719B3A95C73F94362E2FB17E1E376347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4660 59FD.tmp 4696 5A99.tmp 5268 5BD2.tmp 4336 5C5F.tmp 3380 5CFB.tmp 5012 5DB6.tmp 5600 5E62.tmp 4792 5F8B.tmp 6084 6141.tmp 800 61CD.tmp 5060 6289.tmp 2024 6363.tmp 3960 643E.tmp 4524 64EA.tmp 5260 65C5.tmp 1644 6680.tmp 2264 676B.tmp 5880 6865.tmp 5152 694F.tmp 2124 6A68.tmp 3048 6B53.tmp 4192 6BFF.tmp 4520 6C9B.tmp 1064 6D37.tmp 2692 6DD3.tmp 2036 6E7F.tmp 432 6F1B.tmp 2336 6FD7.tmp 4112 7083.tmp 4224 717D.tmp 3292 7238.tmp 1140 7303.tmp 5432 73AF.tmp 2200 742C.tmp 1712 74C9.tmp 5828 7555.tmp 3188 75F1.tmp 5040 768E.tmp 6072 773A.tmp 5584 77E5.tmp 1180 7872.tmp 3124 791E.tmp 5248 79BA.tmp 4600 7A56.tmp 4608 7AD3.tmp 1380 7B60.tmp 4316 7C0C.tmp 1728 7CB8.tmp 4332 7D64.tmp 4604 7DF0.tmp 1808 7E8D.tmp 5332 7EEA.tmp 1596 7F77.tmp 3952 8004.tmp 2180 80BF.tmp 5808 816B.tmp 1228 81F8.tmp 1608 8294.tmp 3268 8320.tmp 1400 83BD.tmp 5420 8449.tmp 480 84D6.tmp 5776 8563.tmp 3244 862E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 717D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C94C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4660 4900 2026-07-31_44f9a53787fa24874e7dbfeaf1421238_elex_mafia.exe 89 PID 4660 wrote to memory of 4696 4660 59FD.tmp 90 PID 4696 wrote to memory of 5268 4696 5A99.tmp 91 PID 5268 wrote to memory of 4336 5268 5BD2.tmp 92 PID 4336 wrote to memory of 3380 4336 5C5F.tmp 93 PID 3380 wrote to memory of 5012 3380 5CFB.tmp 94 PID 5012 wrote to memory of 5600 5012 5DB6.tmp 95 PID 5600 wrote to memory of 4792 5600 5E62.tmp 96 PID 4792 wrote to memory of 6084 4792 5F8B.tmp 97 PID 6084 wrote to memory of 800 6084 6141.tmp 98 PID 800 wrote to memory of 5060 800 61CD.tmp 99 PID 5060 wrote to memory of 2024 5060 6289.tmp 100 PID 2024 wrote to memory of 3960 2024 6363.tmp 101 PID 3960 wrote to memory of 4524 3960 643E.tmp 102 PID 4524 wrote to memory of 5260 4524 64EA.tmp 103 PID 5260 wrote to memory of 1644 5260 65C5.tmp 104 PID 1644 wrote to memory of 2264 1644 6680.tmp 105 PID 2264 wrote to memory of 5880 2264 676B.tmp 106 PID 5880 wrote to memory of 5152 5880 6865.tmp 107 PID 5152 wrote to memory of 2124 5152 694F.tmp 108 PID 2124 wrote to memory of 3048 2124 6A68.tmp 109 PID 3048 wrote to memory of 4192 3048 6B53.tmp 110 PID 4192 wrote to memory of 4520 4192 6BFF.tmp 111 PID 4520 wrote to memory of 1064 4520 6C9B.tmp 112 PID 1064 wrote to memory of 2692 1064 6D37.tmp 113 PID 2692 wrote to memory of 2036 2692 6DD3.tmp 114 PID 2036 wrote to memory of 432 2036 6E7F.tmp 115 PID 432 wrote to memory of 2336 432 6F1B.tmp 116 PID 2336 wrote to memory of 4112 2336 6FD7.tmp 117 PID 4112 wrote to memory of 4224 4112 7083.tmp 118 PID 4224 wrote to memory of 3292 4224 717D.tmp 119 PID 3292 wrote to memory of 1140 3292 7238.tmp 120 PID 1140 wrote to memory of 5432 1140 7303.tmp 121 PID 5432 wrote to memory of 2200 5432 73AF.tmp 122 PID 2200 wrote to memory of 1712 2200 742C.tmp 123 PID 1712 wrote to memory of 5828 1712 74C9.tmp 124 PID 5828 wrote to memory of 3188 5828 7555.tmp 125 PID 3188 wrote to memory of 5040 3188 75F1.tmp 126 PID 5040 wrote to memory of 6072 5040 768E.tmp 127 PID 6072 wrote to memory of 5584 6072 773A.tmp 128 PID 5584 wrote to memory of 1180 5584 77E5.tmp 129 PID 1180 wrote to memory of 3124 1180 7872.tmp 130 PID 3124 wrote to memory of 5248 3124 791E.tmp 131 PID 5248 wrote to memory of 4600 5248 79BA.tmp 132 PID 4600 wrote to memory of 4608 4600 7A56.tmp 133 PID 4608 wrote to memory of 1380 4608 7AD3.tmp 134 PID 1380 wrote to memory of 4316 1380 7B60.tmp 135 PID 4316 wrote to memory of 1728 4316 7C0C.tmp 136 PID 1728 wrote to memory of 4332 1728 7CB8.tmp 137 PID 4332 wrote to memory of 4604 4332 7D64.tmp 138 PID 4604 wrote to memory of 1808 4604 7DF0.tmp 139 PID 1808 wrote to memory of 5332 1808 7E8D.tmp 140 PID 5332 wrote to memory of 1596 5332 7EEA.tmp 141 PID 1596 wrote to memory of 3952 1596 7F77.tmp 142 PID 3952 wrote to memory of 2180 3952 8004.tmp 143 PID 2180 wrote to memory of 5808 2180 80BF.tmp 144 PID 5808 wrote to memory of 1228 5808 816B.tmp 145 PID 1228 wrote to memory of 1608 1228 81F8.tmp 146 PID 1608 wrote to memory of 3268 1608 8294.tmp 147 PID 3268 wrote to memory of 1400 3268 8320.tmp 148 PID 1400 wrote to memory of 5420 1400 83BD.tmp 149 PID 5420 wrote to memory of 480 5420 8449.tmp 150 PID 480 wrote to memory of 5776 480 84D6.tmp 151 PID 5776 wrote to memory of 3244 5776 8563.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_44f9a53787fa24874e7dbfeaf1421238_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_44f9a53787fa24874e7dbfeaf1421238_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"C:\Users\Admin\AppData\Local\Temp\5CFB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\5E62.tmp"C:\Users\Admin\AppData\Local\Temp\5E62.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\61CD.tmp"C:\Users\Admin\AppData\Local\Temp\61CD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\6289.tmp"C:\Users\Admin\AppData\Local\Temp\6289.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6363.tmp"C:\Users\Admin\AppData\Local\Temp\6363.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\643E.tmp"C:\Users\Admin\AppData\Local\Temp\643E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\64EA.tmp"C:\Users\Admin\AppData\Local\Temp\64EA.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\694F.tmp"C:\Users\Admin\AppData\Local\Temp\694F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\6A68.tmp"C:\Users\Admin\AppData\Local\Temp\6A68.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\6B53.tmp"C:\Users\Admin\AppData\Local\Temp\6B53.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\7083.tmp"C:\Users\Admin\AppData\Local\Temp\7083.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\7303.tmp"C:\Users\Admin\AppData\Local\Temp\7303.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\73AF.tmp"C:\Users\Admin\AppData\Local\Temp\73AF.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\742C.tmp"C:\Users\Admin\AppData\Local\Temp\742C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\74C9.tmp"C:\Users\Admin\AppData\Local\Temp\74C9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\773A.tmp"C:\Users\Admin\AppData\Local\Temp\773A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\791E.tmp"C:\Users\Admin\AppData\Local\Temp\791E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\816B.tmp"C:\Users\Admin\AppData\Local\Temp\816B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8294.tmp"C:\Users\Admin\AppData\Local\Temp\8294.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8320.tmp"C:\Users\Admin\AppData\Local\Temp\8320.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8449.tmp"C:\Users\Admin\AppData\Local\Temp\8449.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\8563.tmp"C:\Users\Admin\AppData\Local\Temp\8563.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\862E.tmp"C:\Users\Admin\AppData\Local\Temp\862E.tmp"65⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\8708.tmp"C:\Users\Admin\AppData\Local\Temp\8708.tmp"66⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"67⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\8870.tmp"C:\Users\Admin\AppData\Local\Temp\8870.tmp"68⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"69⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\8A06.tmp"C:\Users\Admin\AppData\Local\Temp\8A06.tmp"70⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"71⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"72⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"73⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"74⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"75⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"76⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"77⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"78⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"79⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"80⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\905F.tmp"C:\Users\Admin\AppData\Local\Temp\905F.tmp"81⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"82⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9188.tmp"C:\Users\Admin\AppData\Local\Temp\9188.tmp"83⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"84⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"85⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"86⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"87⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"88⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"89⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"90⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\961C.tmp"C:\Users\Admin\AppData\Local\Temp\961C.tmp"91⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\96B8.tmp"C:\Users\Admin\AppData\Local\Temp\96B8.tmp"92⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\9774.tmp"C:\Users\Admin\AppData\Local\Temp\9774.tmp"93⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"94⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"95⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"96⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"97⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"98⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"99⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"100⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\9C84.tmp"C:\Users\Admin\AppData\Local\Temp\9C84.tmp"101⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"102⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"103⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"104⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"105⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"106⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"107⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"108⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"109⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"110⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"111⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"112⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\A426.tmp"C:\Users\Admin\AppData\Local\Temp\A426.tmp"113⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"C:\Users\Admin\AppData\Local\Temp\A4D1.tmp"114⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"115⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\A60A.tmp"C:\Users\Admin\AppData\Local\Temp\A60A.tmp"116⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A687.tmp"C:\Users\Admin\AppData\Local\Temp\A687.tmp"117⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"118⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"119⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\A84C.tmp"C:\Users\Admin\AppData\Local\Temp\A84C.tmp"120⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"121⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"122⤵PID:4468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-