Analysis
- max time kernel
118s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_025dbb60f7a18b09c5f1d625b125f6a1_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_025dbb60f7a18b09c5f1d625b125f6a1_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_025dbb60f7a18b09c5f1d625b125f6a1_elex_mafia.exe
- Size 560KB
- Sample260802-scbv1abf88
- SHA256 4dabee1cd2c9ca67c2574b9c341a621bf99ede56d6efa357ea52ab6535ab2162
- MD5 025dbb60f7a18b09c5f1d625b125f6a1
- SHA1 a61f5857db6087ddb3daafe4c8d4a2c62429bb82
- SHA512 d60a8844323f4a3a13dd2bb533aa13c64a8e15b5e4c4b68b9cc269f2dd395b8a79f29cff44de5cf2e9eb6814edc16ea927ac95bde3360798156eaeec2def9421
- SSDEEP 12288:MlFXOQUDmrC8SdQeUiZag/WC2dxjT0TIZxV:MlUQbC8SdBL3uDeIR
- TLSH T1CFC4F1227588C073E59311350E62CB622B3F7D255B3AA5C737A4266DAFB53C1DA3834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4892 381D.tmp 4232 3908.tmp 4132 3A21.tmp 5208 3AFC.tmp 4876 3D2E.tmp 1880 3DF9.tmp 5632 3E86.tmp 5540 3F22.tmp 3712 3F9F.tmp 3592 400D.tmp 4960 4116.tmp 5248 425E.tmp 5336 4368.tmp 4576 44B0.tmp 1360 45BA.tmp 1680 4685.tmp 4848 477F.tmp 2792 484A.tmp 5644 4963.tmp 5712 4A6D.tmp 5436 4B38.tmp 5420 4C42.tmp 4764 4D1C.tmp 4288 4DE7.tmp 4596 4EC2.tmp 5444 4F8D.tmp 2416 50A7.tmp 5884 5172.tmp 2884 51FE.tmp 5964 5318.tmp 3680 5402.tmp 972 554A.tmp 808 5654.tmp 3544 56F0.tmp 4572 57AB.tmp 5740 5828.tmp 1240 58C5.tmp 4944 5961.tmp 4204 5A0D.tmp 2556 5A99.tmp 4532 5B55.tmp 2160 5BD2.tmp 3428 5C9D.tmp 3908 5D2A.tmp 2404 5DC6.tmp 5612 5EA1.tmp 3676 5F5C.tmp 3420 6027.tmp 5280 60D3.tmp 2392 6150.tmp 2388 61CD.tmp 5308 625A.tmp 2860 62F6.tmp 412 6392.tmp 52 6400.tmp 4768 649C.tmp 4536 6529.tmp 4604 6596.tmp 5380 6613.tmp 2004 66AF.tmp 1328 674B.tmp 1292 67C8.tmp 5896 6865.tmp 2636 68F1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E03F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 4892 3412 2026-08-02_025dbb60f7a18b09c5f1d625b125f6a1_elex_mafia.exe 89 PID 4892 wrote to memory of 4232 4892 381D.tmp 90 PID 4232 wrote to memory of 4132 4232 3908.tmp 91 PID 4132 wrote to memory of 5208 4132 3A21.tmp 92 PID 5208 wrote to memory of 4876 5208 3AFC.tmp 93 PID 4876 wrote to memory of 1880 4876 3D2E.tmp 94 PID 1880 wrote to memory of 5632 1880 3DF9.tmp 95 PID 5632 wrote to memory of 5540 5632 3E86.tmp 96 PID 5540 wrote to memory of 3712 5540 3F22.tmp 97 PID 3712 wrote to memory of 3592 3712 3F9F.tmp 98 PID 3592 wrote to memory of 4960 3592 400D.tmp 99 PID 4960 wrote to memory of 5248 4960 4116.tmp 100 PID 5248 wrote to memory of 5336 5248 425E.tmp 101 PID 5336 wrote to memory of 4576 5336 4368.tmp 102 PID 4576 wrote to memory of 1360 4576 44B0.tmp 103 PID 1360 wrote to memory of 1680 1360 45BA.tmp 104 PID 1680 wrote to memory of 4848 1680 4685.tmp 105 PID 4848 wrote to memory of 2792 4848 477F.tmp 106 PID 2792 wrote to memory of 5644 2792 484A.tmp 107 PID 5644 wrote to memory of 5712 5644 4963.tmp 108 PID 5712 wrote to memory of 5436 5712 4A6D.tmp 109 PID 5436 wrote to memory of 5420 5436 4B38.tmp 110 PID 5420 wrote to memory of 4764 5420 4C42.tmp 111 PID 4764 wrote to memory of 4288 4764 4D1C.tmp 112 PID 4288 wrote to memory of 4596 4288 4DE7.tmp 113 PID 4596 wrote to memory of 5444 4596 4EC2.tmp 114 PID 5444 wrote to memory of 2416 5444 4F8D.tmp 115 PID 2416 wrote to memory of 5884 2416 50A7.tmp 116 PID 5884 wrote to memory of 2884 5884 5172.tmp 117 PID 2884 wrote to memory of 5964 2884 51FE.tmp 118 PID 5964 wrote to memory of 3680 5964 5318.tmp 119 PID 3680 wrote to memory of 972 3680 5402.tmp 120 PID 972 wrote to memory of 808 972 554A.tmp 121 PID 808 wrote to memory of 3544 808 5654.tmp 122 PID 3544 wrote to memory of 4572 3544 56F0.tmp 123 PID 4572 wrote to memory of 5740 4572 57AB.tmp 124 PID 5740 wrote to memory of 1240 5740 5828.tmp 125 PID 1240 wrote to memory of 4944 1240 58C5.tmp 126 PID 4944 wrote to memory of 4204 4944 5961.tmp 127 PID 4204 wrote to memory of 2556 4204 5A0D.tmp 128 PID 2556 wrote to memory of 4532 2556 5A99.tmp 129 PID 4532 wrote to memory of 2160 4532 5B55.tmp 130 PID 2160 wrote to memory of 3428 2160 5BD2.tmp 131 PID 3428 wrote to memory of 3908 3428 5C9D.tmp 132 PID 3908 wrote to memory of 2404 3908 5D2A.tmp 133 PID 2404 wrote to memory of 5612 2404 5DC6.tmp 134 PID 5612 wrote to memory of 3676 5612 5EA1.tmp 135 PID 3676 wrote to memory of 3420 3676 5F5C.tmp 136 PID 3420 wrote to memory of 5280 3420 6027.tmp 137 PID 5280 wrote to memory of 2392 5280 60D3.tmp 138 PID 2392 wrote to memory of 2388 2392 6150.tmp 139 PID 2388 wrote to memory of 5308 2388 61CD.tmp 140 PID 5308 wrote to memory of 2860 5308 625A.tmp 141 PID 2860 wrote to memory of 412 2860 62F6.tmp 142 PID 412 wrote to memory of 52 412 6392.tmp 143 PID 52 wrote to memory of 4768 52 6400.tmp 144 PID 4768 wrote to memory of 4536 4768 649C.tmp 145 PID 4536 wrote to memory of 4604 4536 6529.tmp 146 PID 4604 wrote to memory of 5380 4604 6596.tmp 147 PID 5380 wrote to memory of 2004 5380 6613.tmp 148 PID 2004 wrote to memory of 1328 2004 66AF.tmp 149 PID 1328 wrote to memory of 1292 1328 674B.tmp 150 PID 1292 wrote to memory of 5896 1292 67C8.tmp 151 PID 5896 wrote to memory of 2636 5896 6865.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_025dbb60f7a18b09c5f1d625b125f6a1_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_025dbb60f7a18b09c5f1d625b125f6a1_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3908.tmp"C:\Users\Admin\AppData\Local\Temp\3908.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\4685.tmp"C:\Users\Admin\AppData\Local\Temp\4685.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\5318.tmp"C:\Users\Admin\AppData\Local\Temp\5318.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\56F0.tmp"C:\Users\Admin\AppData\Local\Temp\56F0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\57AB.tmp"C:\Users\Admin\AppData\Local\Temp\57AB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\5828.tmp"C:\Users\Admin\AppData\Local\Temp\5828.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5961.tmp"C:\Users\Admin\AppData\Local\Temp\5961.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5B55.tmp"C:\Users\Admin\AppData\Local\Temp\5B55.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\61CD.tmp"C:\Users\Admin\AppData\Local\Temp\61CD.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\62F6.tmp"C:\Users\Admin\AppData\Local\Temp\62F6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\6400.tmp"C:\Users\Admin\AppData\Local\Temp\6400.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\68F1.tmp"C:\Users\Admin\AppData\Local\Temp\68F1.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\695F.tmp"C:\Users\Admin\AppData\Local\Temp\695F.tmp"66⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"67⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\6A68.tmp"C:\Users\Admin\AppData\Local\Temp\6A68.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"69⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\6B72.tmp"C:\Users\Admin\AppData\Local\Temp\6B72.tmp"70⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"71⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"72⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"73⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\6D85.tmp"C:\Users\Admin\AppData\Local\Temp\6D85.tmp"74⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"75⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"76⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"77⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"78⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"79⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"80⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\716D.tmp"C:\Users\Admin\AppData\Local\Temp\716D.tmp"81⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\71FA.tmp"C:\Users\Admin\AppData\Local\Temp\71FA.tmp"82⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"83⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\7323.tmp"C:\Users\Admin\AppData\Local\Temp\7323.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\73AF.tmp"C:\Users\Admin\AppData\Local\Temp\73AF.tmp"85⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"86⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"87⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"88⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\75A3.tmp"C:\Users\Admin\AppData\Local\Temp\75A3.tmp"89⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\764F.tmp"C:\Users\Admin\AppData\Local\Temp\764F.tmp"90⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"91⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\7759.tmp"C:\Users\Admin\AppData\Local\Temp\7759.tmp"92⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"93⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"94⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"95⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"96⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"97⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"98⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"99⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\7B70.tmp"C:\Users\Admin\AppData\Local\Temp\7B70.tmp"100⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7BED.tmp"C:\Users\Admin\AppData\Local\Temp\7BED.tmp"101⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"102⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"103⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"104⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"105⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"106⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"107⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"108⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"109⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"110⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"111⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"112⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"113⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\82D2.tmp"C:\Users\Admin\AppData\Local\Temp\82D2.tmp"114⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"115⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"116⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\842A.tmp"C:\Users\Admin\AppData\Local\Temp\842A.tmp"117⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"118⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"119⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"120⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\862E.tmp"C:\Users\Admin\AppData\Local\Temp\862E.tmp"121⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\86AB.tmp"C:\Users\Admin\AppData\Local\Temp\86AB.tmp"122⤵PID:768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-