Analysis
- max time kernel
118s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_78599c8822692eb4c5b1ffdc822edf02_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_78599c8822692eb4c5b1ffdc822edf02_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_78599c8822692eb4c5b1ffdc822edf02_elex_mafia.exe
- Size 520KB
- Sample260802-rjsxesbb83
- SHA256 aa99f9c243943e8012d2e14ff97094fa82d2fc37f27afc5464086a21f33e9e66
- MD5 78599c8822692eb4c5b1ffdc822edf02
- SHA1 3e2d53c41eda93eb9749ea985c8d63edb89aed63
- SHA512 f0b8b0e878b1aff729c61939072913525cb4eb5395b7c3347bdf30ffb6173bcae245e49d4949ec4a7e2ab3effa4953a7e645f8efb05b924497e917e85cea3eea
- SSDEEP 12288:gj8fuxR21t5i8fdg87Bwp7O1ZIPUeBvu5XHsPNZ6:gj8fuK1GYdgyBoScPUTXHyNI
- TLSH T16BB4F111B588C033E9D215314A62DB710BBE7D354B2295C73BD43ABE6EBA2D1D67830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2500 EAF3.tmp 5980 EC1B.tmp 3192 ECF6.tmp 4036 EDF0.tmp 2280 EEBB.tmp 5308 EFC5.tmp 3020 F0EE.tmp 4360 F18A.tmp 1532 F255.tmp 5076 F35F.tmp 2588 F3EB.tmp 4892 F497.tmp 5788 F572.tmp 3512 F60E.tmp 824 F6CA.tmp 1488 F776.tmp 4968 F87F.tmp 2592 F94A.tmp 4800 FA44.tmp 5560 FB4E.tmp 1776 FC38.tmp 1724 FCE4.tmp 2848 FDDE.tmp 4748 FE6B.tmp 5740 FF55.tmp 3160 40.tmp 4708 DC.tmp 3760 188.tmp 3048 234.tmp 576 2EF.tmp 2492 3BA.tmp 4872 466.tmp 2796 531.tmp 2716 5CE.tmp 1840 679.tmp 2116 764.tmp 5048 810.tmp 2876 8DB.tmp 4916 977.tmp 5724 9F4.tmp 2176 A61.tmp 3152 ADE.tmp 5940 B5B.tmp 844 BE8.tmp 1232 C65.tmp 200 CE2.tmp 2380 DBD.tmp 6072 E59.tmp 4340 ED6.tmp 4640 F72.tmp 5168 100F.tmp 1444 108C.tmp 1660 1137.tmp 1704 11C4.tmp 4436 1251.tmp 5528 12ED.tmp 5516 1399.tmp 2628 1425.tmp 964 14A2.tmp 2992 151F.tmp 5792 15AC.tmp 1192 1619.tmp 6064 16A6.tmp 5072 1762.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 492B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 599B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A024.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A79B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 439D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 324C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 704F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 228D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4352 wrote to memory of 2500 4352 2026-08-02_78599c8822692eb4c5b1ffdc822edf02_elex_mafia.exe 88 PID 2500 wrote to memory of 5980 2500 EAF3.tmp 89 PID 5980 wrote to memory of 3192 5980 EC1B.tmp 90 PID 3192 wrote to memory of 4036 3192 ECF6.tmp 91 PID 4036 wrote to memory of 2280 4036 EDF0.tmp 92 PID 2280 wrote to memory of 5308 2280 EEBB.tmp 93 PID 5308 wrote to memory of 3020 5308 EFC5.tmp 94 PID 3020 wrote to memory of 4360 3020 F0EE.tmp 95 PID 4360 wrote to memory of 1532 4360 F18A.tmp 96 PID 1532 wrote to memory of 5076 1532 F255.tmp 97 PID 5076 wrote to memory of 2588 5076 F35F.tmp 98 PID 2588 wrote to memory of 4892 2588 F3EB.tmp 99 PID 4892 wrote to memory of 5788 4892 F497.tmp 100 PID 5788 wrote to memory of 3512 5788 F572.tmp 101 PID 3512 wrote to memory of 824 3512 F60E.tmp 102 PID 824 wrote to memory of 1488 824 F6CA.tmp 103 PID 1488 wrote to memory of 4968 1488 F776.tmp 104 PID 4968 wrote to memory of 2592 4968 F87F.tmp 105 PID 2592 wrote to memory of 4800 2592 F94A.tmp 106 PID 4800 wrote to memory of 5560 4800 FA44.tmp 107 PID 5560 wrote to memory of 1776 5560 FB4E.tmp 108 PID 1776 wrote to memory of 1724 1776 FC38.tmp 109 PID 1724 wrote to memory of 2848 1724 FCE4.tmp 110 PID 2848 wrote to memory of 4748 2848 FDDE.tmp 111 PID 4748 wrote to memory of 5740 4748 FE6B.tmp 112 PID 5740 wrote to memory of 3160 5740 FF55.tmp 113 PID 3160 wrote to memory of 4708 3160 40.tmp 114 PID 4708 wrote to memory of 3760 4708 DC.tmp 115 PID 3760 wrote to memory of 3048 3760 188.tmp 116 PID 3048 wrote to memory of 576 3048 234.tmp 117 PID 576 wrote to memory of 2492 576 2EF.tmp 118 PID 2492 wrote to memory of 4872 2492 3BA.tmp 119 PID 4872 wrote to memory of 2796 4872 466.tmp 120 PID 2796 wrote to memory of 2716 2796 531.tmp 121 PID 2716 wrote to memory of 1840 2716 5CE.tmp 122 PID 1840 wrote to memory of 2116 1840 679.tmp 123 PID 2116 wrote to memory of 5048 2116 764.tmp 124 PID 5048 wrote to memory of 2876 5048 810.tmp 125 PID 2876 wrote to memory of 4916 2876 8DB.tmp 126 PID 4916 wrote to memory of 5724 4916 977.tmp 127 PID 5724 wrote to memory of 2176 5724 9F4.tmp 128 PID 2176 wrote to memory of 3152 2176 A61.tmp 129 PID 3152 wrote to memory of 5940 3152 ADE.tmp 130 PID 5940 wrote to memory of 844 5940 B5B.tmp 131 PID 844 wrote to memory of 1232 844 BE8.tmp 132 PID 1232 wrote to memory of 200 1232 C65.tmp 133 PID 200 wrote to memory of 2380 200 CE2.tmp 134 PID 2380 wrote to memory of 6072 2380 DBD.tmp 135 PID 6072 wrote to memory of 4340 6072 E59.tmp 136 PID 4340 wrote to memory of 4640 4340 ED6.tmp 137 PID 4640 wrote to memory of 5168 4640 F72.tmp 138 PID 5168 wrote to memory of 1444 5168 100F.tmp 139 PID 1444 wrote to memory of 1660 1444 108C.tmp 140 PID 1660 wrote to memory of 1704 1660 1137.tmp 141 PID 1704 wrote to memory of 4436 1704 11C4.tmp 142 PID 4436 wrote to memory of 5528 4436 1251.tmp 143 PID 5528 wrote to memory of 5516 5528 12ED.tmp 144 PID 5516 wrote to memory of 2628 5516 1399.tmp 145 PID 2628 wrote to memory of 964 2628 1425.tmp 146 PID 964 wrote to memory of 2992 964 14A2.tmp 147 PID 2992 wrote to memory of 5792 2992 151F.tmp 148 PID 5792 wrote to memory of 1192 5792 15AC.tmp 149 PID 1192 wrote to memory of 6064 1192 1619.tmp 150 PID 6064 wrote to memory of 5072 6064 16A6.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_78599c8822692eb4c5b1ffdc822edf02_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_78599c8822692eb4c5b1ffdc822edf02_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\F18A.tmp"C:\Users\Admin\AppData\Local\Temp\F18A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\F255.tmp"C:\Users\Admin\AppData\Local\Temp\F255.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\DC.tmp"C:\Users\Admin\AppData\Local\Temp\DC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\188.tmp"C:\Users\Admin\AppData\Local\Temp\188.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\234.tmp"C:\Users\Admin\AppData\Local\Temp\234.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2EF.tmp"C:\Users\Admin\AppData\Local\Temp\2EF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\679.tmp"C:\Users\Admin\AppData\Local\Temp\679.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8DB.tmp"C:\Users\Admin\AppData\Local\Temp\8DB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9F4.tmp"C:\Users\Admin\AppData\Local\Temp\9F4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\A61.tmp"C:\Users\Admin\AppData\Local\Temp\A61.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\B5B.tmp"C:\Users\Admin\AppData\Local\Temp\B5B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\BE8.tmp"C:\Users\Admin\AppData\Local\Temp\BE8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\E59.tmp"C:\Users\Admin\AppData\Local\Temp\E59.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\ED6.tmp"C:\Users\Admin\AppData\Local\Temp\ED6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\F72.tmp"C:\Users\Admin\AppData\Local\Temp\F72.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1137.tmp"C:\Users\Admin\AppData\Local\Temp\1137.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\11C4.tmp"C:\Users\Admin\AppData\Local\Temp\11C4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1251.tmp"C:\Users\Admin\AppData\Local\Temp\1251.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\12ED.tmp"C:\Users\Admin\AppData\Local\Temp\12ED.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\1399.tmp"C:\Users\Admin\AppData\Local\Temp\1399.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\1425.tmp"C:\Users\Admin\AppData\Local\Temp\1425.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\151F.tmp"C:\Users\Admin\AppData\Local\Temp\151F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\15AC.tmp"C:\Users\Admin\AppData\Local\Temp\15AC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\16A6.tmp"C:\Users\Admin\AppData\Local\Temp\16A6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"65⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"66⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\188A.tmp"C:\Users\Admin\AppData\Local\Temp\188A.tmp"67⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\1917.tmp"C:\Users\Admin\AppData\Local\Temp\1917.tmp"68⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"69⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"70⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"71⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\1B78.tmp"C:\Users\Admin\AppData\Local\Temp\1B78.tmp"72⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"73⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"74⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"75⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"77⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"78⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"81⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"82⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\2174.tmp"C:\Users\Admin\AppData\Local\Temp\2174.tmp"83⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\21F1.tmp"C:\Users\Admin\AppData\Local\Temp\21F1.tmp"84⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"87⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"88⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"89⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"90⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"91⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"92⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"93⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"94⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\27CD.tmp"C:\Users\Admin\AppData\Local\Temp\27CD.tmp"95⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"96⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"97⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\29B1.tmp"C:\Users\Admin\AppData\Local\Temp\29B1.tmp"98⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"99⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"100⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\2B47.tmp"C:\Users\Admin\AppData\Local\Temp\2B47.tmp"101⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"102⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2C80.tmp"C:\Users\Admin\AppData\Local\Temp\2C80.tmp"103⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"104⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2D99.tmp"C:\Users\Admin\AppData\Local\Temp\2D99.tmp"105⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\2E06.tmp"C:\Users\Admin\AppData\Local\Temp\2E06.tmp"106⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"107⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"108⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"109⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\3077.tmp"C:\Users\Admin\AppData\Local\Temp\3077.tmp"110⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"111⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"112⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\324C.tmp"C:\Users\Admin\AppData\Local\Temp\324C.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"114⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\3365.tmp"C:\Users\Admin\AppData\Local\Temp\3365.tmp"115⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\33F2.tmp"C:\Users\Admin\AppData\Local\Temp\33F2.tmp"116⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\348E.tmp"C:\Users\Admin\AppData\Local\Temp\348E.tmp"117⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\350B.tmp"C:\Users\Admin\AppData\Local\Temp\350B.tmp"118⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\3579.tmp"C:\Users\Admin\AppData\Local\Temp\3579.tmp"119⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\3605.tmp"C:\Users\Admin\AppData\Local\Temp\3605.tmp"120⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\3682.tmp"C:\Users\Admin\AppData\Local\Temp\3682.tmp"121⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\36F0.tmp"C:\Users\Admin\AppData\Local\Temp\36F0.tmp"122⤵PID:6104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-