Analysis
- max time kernel
115s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 20:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_a25ac505f2fb984d2124c68fb5ea0f53_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_a25ac505f2fb984d2124c68fb5ea0f53_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_a25ac505f2fb984d2124c68fb5ea0f53_elex_mafia.exe
- Size 524KB
- Sample260801-ythmrsvhmf
- SHA256 fbf5a187aca9345562f42d88694030d6ba5acb04ce21e885cb908baa71e1d352
- MD5 a25ac505f2fb984d2124c68fb5ea0f53
- SHA1 711829a934f5c5e035088bb9741683344c5d9a73
- SHA512 184d8eba2f5b5ddbb2d5d2f3e75525a38ecadba314696ef774b952cb12d4509562153b0f893100b653f847f8d0923b69301e6afe2f0462e6587c2df8e26e7a5b
- SSDEEP 12288:TRyZzqyL66TBIf3Oy8B1LsBjnxUYFLVpf+LNZ:TRyQylTBjy2m3fmN
- TLSH T19CB4F116B684C432F5A205368A66EB92493FBC75A766A4C73B80366D6FF43C0D378307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2260 45B.tmp 3048 5E2.tmp 1304 69D.tmp 4924 814.tmp 4644 8FF.tmp 3300 A37.tmp 5172 B22.tmp 2848 CB8.tmp 2844 D93.tmp 5796 E6D.tmp 5156 F58.tmp 2128 1090.tmp 4548 116B.tmp 3856 1284.tmp 5108 13AD.tmp 4796 14C6.tmp 5744 162E.tmp 5840 1776.tmp 240 18AE.tmp 4600 1A25.tmp 5696 1B5E.tmp 6092 1C96.tmp 1312 1DA0.tmp 1276 1EC9.tmp 5528 1FD3.tmp 4324 20FB.tmp 4616 2224.tmp 1852 22EF.tmp 4860 23CA.tmp 4572 24B5.tmp 5980 260C.tmp 2056 26F7.tmp 5424 27F1.tmp 1988 288D.tmp 1244 2939.tmp 2612 29F4.tmp 1580 2AA0.tmp 1608 2B4C.tmp 1652 2BE8.tmp 2808 2C85.tmp 5124 2D40.tmp 4444 2DEC.tmp 3624 2EC7.tmp 4400 2F73.tmp 1556 303E.tmp 1436 3109.tmp 3708 3195.tmp 6140 3261.tmp 4744 330C.tmp 2148 3399.tmp 1500 3416.tmp 1668 3493.tmp 5576 352F.tmp 5072 35DB.tmp 5348 3677.tmp 3620 3704.tmp 4996 3791.tmp 4984 382D.tmp 4576 38AA.tmp 1268 3917.tmp 3236 3994.tmp 2836 3A21.tmp 5684 3A9E.tmp 4868 3B3A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 330C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 637E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4879.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 667C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 612C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C3F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2260 3332 2026-08-01_a25ac505f2fb984d2124c68fb5ea0f53_elex_mafia.exe 89 PID 2260 wrote to memory of 3048 2260 45B.tmp 90 PID 3048 wrote to memory of 1304 3048 5E2.tmp 91 PID 1304 wrote to memory of 4924 1304 69D.tmp 92 PID 4924 wrote to memory of 4644 4924 814.tmp 93 PID 4644 wrote to memory of 3300 4644 8FF.tmp 94 PID 3300 wrote to memory of 5172 3300 A37.tmp 95 PID 5172 wrote to memory of 2848 5172 B22.tmp 96 PID 2848 wrote to memory of 2844 2848 CB8.tmp 97 PID 2844 wrote to memory of 5796 2844 D93.tmp 98 PID 5796 wrote to memory of 5156 5796 E6D.tmp 99 PID 5156 wrote to memory of 2128 5156 F58.tmp 100 PID 2128 wrote to memory of 4548 2128 1090.tmp 101 PID 4548 wrote to memory of 3856 4548 116B.tmp 102 PID 3856 wrote to memory of 5108 3856 1284.tmp 103 PID 5108 wrote to memory of 4796 5108 13AD.tmp 104 PID 4796 wrote to memory of 5744 4796 14C6.tmp 105 PID 5744 wrote to memory of 5840 5744 162E.tmp 106 PID 5840 wrote to memory of 240 5840 1776.tmp 107 PID 240 wrote to memory of 4600 240 18AE.tmp 108 PID 4600 wrote to memory of 5696 4600 1A25.tmp 109 PID 5696 wrote to memory of 6092 5696 1B5E.tmp 110 PID 6092 wrote to memory of 1312 6092 1C96.tmp 111 PID 1312 wrote to memory of 1276 1312 1DA0.tmp 112 PID 1276 wrote to memory of 5528 1276 1EC9.tmp 113 PID 5528 wrote to memory of 4324 5528 1FD3.tmp 114 PID 4324 wrote to memory of 4616 4324 20FB.tmp 115 PID 4616 wrote to memory of 1852 4616 2224.tmp 116 PID 1852 wrote to memory of 4860 1852 22EF.tmp 117 PID 4860 wrote to memory of 4572 4860 23CA.tmp 118 PID 4572 wrote to memory of 5980 4572 24B5.tmp 119 PID 5980 wrote to memory of 2056 5980 260C.tmp 120 PID 2056 wrote to memory of 5424 2056 26F7.tmp 121 PID 5424 wrote to memory of 1988 5424 27F1.tmp 122 PID 1988 wrote to memory of 1244 1988 288D.tmp 123 PID 1244 wrote to memory of 2612 1244 2939.tmp 124 PID 2612 wrote to memory of 1580 2612 29F4.tmp 125 PID 1580 wrote to memory of 1608 1580 2AA0.tmp 126 PID 1608 wrote to memory of 1652 1608 2B4C.tmp 127 PID 1652 wrote to memory of 2808 1652 2BE8.tmp 128 PID 2808 wrote to memory of 5124 2808 2C85.tmp 129 PID 5124 wrote to memory of 4444 5124 2D40.tmp 130 PID 4444 wrote to memory of 3624 4444 2DEC.tmp 131 PID 3624 wrote to memory of 4400 3624 2EC7.tmp 132 PID 4400 wrote to memory of 1556 4400 2F73.tmp 133 PID 1556 wrote to memory of 1436 1556 303E.tmp 134 PID 1436 wrote to memory of 3708 1436 3109.tmp 135 PID 3708 wrote to memory of 6140 3708 3195.tmp 136 PID 6140 wrote to memory of 4744 6140 3261.tmp 137 PID 4744 wrote to memory of 2148 4744 330C.tmp 138 PID 2148 wrote to memory of 1500 2148 3399.tmp 139 PID 1500 wrote to memory of 1668 1500 3416.tmp 140 PID 1668 wrote to memory of 5576 1668 3493.tmp 141 PID 5576 wrote to memory of 5072 5576 352F.tmp 142 PID 5072 wrote to memory of 5348 5072 35DB.tmp 143 PID 5348 wrote to memory of 3620 5348 3677.tmp 144 PID 3620 wrote to memory of 4996 3620 3704.tmp 145 PID 4996 wrote to memory of 4984 4996 3791.tmp 146 PID 4984 wrote to memory of 4576 4984 382D.tmp 147 PID 4576 wrote to memory of 1268 4576 38AA.tmp 148 PID 1268 wrote to memory of 3236 1268 3917.tmp 149 PID 3236 wrote to memory of 2836 3236 3994.tmp 150 PID 2836 wrote to memory of 5684 2836 3A21.tmp 151 PID 5684 wrote to memory of 4868 5684 3A9E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_a25ac505f2fb984d2124c68fb5ea0f53_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_a25ac505f2fb984d2124c68fb5ea0f53_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\45B.tmp"C:\Users\Admin\AppData\Local\Temp\45B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\69D.tmp"C:\Users\Admin\AppData\Local\Temp\69D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\814.tmp"C:\Users\Admin\AppData\Local\Temp\814.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\A37.tmp"C:\Users\Admin\AppData\Local\Temp\A37.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\CB8.tmp"C:\Users\Admin\AppData\Local\Temp\CB8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\E6D.tmp"C:\Users\Admin\AppData\Local\Temp\E6D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\F58.tmp"C:\Users\Admin\AppData\Local\Temp\F58.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\162E.tmp"C:\Users\Admin\AppData\Local\Temp\162E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\18AE.tmp"C:\Users\Admin\AppData\Local\Temp\18AE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2939.tmp"C:\Users\Admin\AppData\Local\Temp\2939.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"C:\Users\Admin\AppData\Local\Temp\2AA0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\2F73.tmp"C:\Users\Admin\AppData\Local\Temp\2F73.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3109.tmp"C:\Users\Admin\AppData\Local\Temp\3109.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3195.tmp"C:\Users\Admin\AppData\Local\Temp\3195.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\330C.tmp"C:\Users\Admin\AppData\Local\Temp\330C.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\352F.tmp"C:\Users\Admin\AppData\Local\Temp\352F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\38AA.tmp"C:\Users\Admin\AppData\Local\Temp\38AA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3994.tmp"C:\Users\Admin\AppData\Local\Temp\3994.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"65⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"66⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"67⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"68⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"69⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"70⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"71⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"72⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"73⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"74⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"75⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"77⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"78⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"79⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\430A.tmp"C:\Users\Admin\AppData\Local\Temp\430A.tmp"80⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"81⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"82⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"83⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"84⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\45AA.tmp"C:\Users\Admin\AppData\Local\Temp\45AA.tmp"85⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"86⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"87⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"89⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"90⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"92⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"93⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"95⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"96⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"97⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\4C32.tmp"C:\Users\Admin\AppData\Local\Temp\4C32.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"99⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"100⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"101⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"103⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"104⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"105⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"107⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\51EF.tmp"C:\Users\Admin\AppData\Local\Temp\51EF.tmp"108⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"109⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"110⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"111⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"112⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"113⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\54FC.tmp"C:\Users\Admin\AppData\Local\Temp\54FC.tmp"114⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5589.tmp"C:\Users\Admin\AppData\Local\Temp\5589.tmp"115⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"116⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"117⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\571F.tmp"C:\Users\Admin\AppData\Local\Temp\571F.tmp"118⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"119⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"120⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\58D4.tmp"C:\Users\Admin\AppData\Local\Temp\58D4.tmp"121⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-