Analysis
- max time kernel
106s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_f47ce3b918fb9aea9b5be2a6dc93022c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_f47ce3b918fb9aea9b5be2a6dc93022c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_f47ce3b918fb9aea9b5be2a6dc93022c_elex_mafia.exe
- Size 520KB
- Sample260806-pyf53a1dre
- SHA256 5f1265477b54291212916a5a98116d2adf0a3fba080934c8aec1a7234408cabf
- MD5 f47ce3b918fb9aea9b5be2a6dc93022c
- SHA1 22992ba3b1891959e27c1584e6c184c75d36934b
- SHA512 1c50c467c7bebec441780125cbf8af0835338d8f2ac28819a72b0b7affa6257b1a83c065f26761b3a9db3f6b5201ca3df9fbd356d00a0a33295b979ca80a7255
- SSDEEP 12288:gj8fuxR21t5i8fcNiGPzgZE6Xv88LAjOBwj02ht5NZ6:gj8fuK1GYcNl6f8jCD2ht5NI
- TLSH T103B4F112B984C032E5D615314B56DB610BBE7C398B6695CB3BD43A6D2EF52C2DB3830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 864 25AF.tmp 2012 2726.tmp 5228 283F.tmp 4380 28FA.tmp 2808 29F4.tmp 5808 2ACF.tmp 1620 2B4C.tmp 2116 2C56.tmp 2520 2D40.tmp 5428 2DFC.tmp 6024 2F05.tmp 3112 2FFF.tmp 248 30DA.tmp 5152 31E4.tmp 5972 329F.tmp 3400 334B.tmp 4416 3416.tmp 2816 34D2.tmp 3588 356E.tmp 2404 361A.tmp 2852 36D5.tmp 1364 37C0.tmp 4092 389A.tmp 5932 3985.tmp 1176 3A40.tmp 1692 3B0B.tmp 2352 3BE6.tmp 4200 3C92.tmp 2628 3D7C.tmp 800 3E38.tmp 896 3F32.tmp 5440 3FED.tmp 5728 407A.tmp 2880 4135.tmp 984 4210.tmp 4328 42AC.tmp 1932 4378.tmp 3388 4433.tmp 2940 44DF.tmp 4284 458B.tmp 2344 4617.tmp 1220 46C3.tmp 4940 4760.tmp 3896 47FC.tmp 2492 48C7.tmp 4276 4973.tmp 3712 4A3E.tmp 2096 4ADA.tmp 4128 4B48.tmp 4900 4BD4.tmp 5380 4C70.tmp 3900 4CFD.tmp 5552 4DC8.tmp 4816 4E55.tmp 2528 4EF1.tmp 1000 4F8D.tmp 4148 502A.tmp 2376 50A7.tmp 4776 5124.tmp 4372 51CF.tmp 2716 524C.tmp 4828 52C9.tmp 3628 5366.tmp 3700 5402.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 574E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E257.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 669B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F34F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 706E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4920.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 992 wrote to memory of 864 992 2026-08-06_f47ce3b918fb9aea9b5be2a6dc93022c_elex_mafia.exe 89 PID 864 wrote to memory of 2012 864 25AF.tmp 90 PID 2012 wrote to memory of 5228 2012 2726.tmp 91 PID 5228 wrote to memory of 4380 5228 283F.tmp 92 PID 4380 wrote to memory of 2808 4380 28FA.tmp 93 PID 2808 wrote to memory of 5808 2808 29F4.tmp 94 PID 5808 wrote to memory of 1620 5808 2ACF.tmp 95 PID 1620 wrote to memory of 2116 1620 2B4C.tmp 96 PID 2116 wrote to memory of 2520 2116 2C56.tmp 97 PID 2520 wrote to memory of 5428 2520 2D40.tmp 98 PID 5428 wrote to memory of 6024 5428 2DFC.tmp 99 PID 6024 wrote to memory of 3112 6024 2F05.tmp 100 PID 3112 wrote to memory of 248 3112 2FFF.tmp 101 PID 248 wrote to memory of 5152 248 30DA.tmp 102 PID 5152 wrote to memory of 5972 5152 31E4.tmp 103 PID 5972 wrote to memory of 3400 5972 329F.tmp 104 PID 3400 wrote to memory of 4416 3400 334B.tmp 105 PID 4416 wrote to memory of 2816 4416 3416.tmp 106 PID 2816 wrote to memory of 3588 2816 34D2.tmp 107 PID 3588 wrote to memory of 2404 3588 356E.tmp 108 PID 2404 wrote to memory of 2852 2404 361A.tmp 109 PID 2852 wrote to memory of 1364 2852 36D5.tmp 110 PID 1364 wrote to memory of 4092 1364 37C0.tmp 111 PID 4092 wrote to memory of 5932 4092 389A.tmp 112 PID 5932 wrote to memory of 1176 5932 3985.tmp 113 PID 1176 wrote to memory of 1692 1176 3A40.tmp 114 PID 1692 wrote to memory of 2352 1692 3B0B.tmp 115 PID 2352 wrote to memory of 4200 2352 3BE6.tmp 116 PID 4200 wrote to memory of 2628 4200 3C92.tmp 117 PID 2628 wrote to memory of 800 2628 3D7C.tmp 118 PID 800 wrote to memory of 896 800 3E38.tmp 119 PID 896 wrote to memory of 5440 896 3F32.tmp 120 PID 5440 wrote to memory of 5728 5440 3FED.tmp 121 PID 5728 wrote to memory of 2880 5728 407A.tmp 122 PID 2880 wrote to memory of 984 2880 4135.tmp 123 PID 984 wrote to memory of 4328 984 4210.tmp 124 PID 4328 wrote to memory of 1932 4328 42AC.tmp 125 PID 1932 wrote to memory of 3388 1932 4378.tmp 126 PID 3388 wrote to memory of 2940 3388 4433.tmp 127 PID 2940 wrote to memory of 4284 2940 44DF.tmp 128 PID 4284 wrote to memory of 2344 4284 458B.tmp 129 PID 2344 wrote to memory of 1220 2344 4617.tmp 130 PID 1220 wrote to memory of 4940 1220 46C3.tmp 131 PID 4940 wrote to memory of 3896 4940 4760.tmp 132 PID 3896 wrote to memory of 2492 3896 47FC.tmp 133 PID 2492 wrote to memory of 4276 2492 48C7.tmp 134 PID 4276 wrote to memory of 3712 4276 4973.tmp 135 PID 3712 wrote to memory of 2096 3712 4A3E.tmp 136 PID 2096 wrote to memory of 4128 2096 4ADA.tmp 137 PID 4128 wrote to memory of 4900 4128 4B48.tmp 138 PID 4900 wrote to memory of 5380 4900 4BD4.tmp 139 PID 5380 wrote to memory of 3900 5380 4C70.tmp 140 PID 3900 wrote to memory of 5552 3900 4CFD.tmp 141 PID 5552 wrote to memory of 4816 5552 4DC8.tmp 142 PID 4816 wrote to memory of 2528 4816 4E55.tmp 143 PID 2528 wrote to memory of 1000 2528 4EF1.tmp 144 PID 1000 wrote to memory of 4148 1000 4F8D.tmp 145 PID 4148 wrote to memory of 2376 4148 502A.tmp 146 PID 2376 wrote to memory of 4776 2376 50A7.tmp 147 PID 4776 wrote to memory of 4372 4776 5124.tmp 148 PID 4372 wrote to memory of 2716 4372 51CF.tmp 149 PID 2716 wrote to memory of 4828 2716 524C.tmp 150 PID 4828 wrote to memory of 3628 4828 52C9.tmp 151 PID 3628 wrote to memory of 3700 3628 5366.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_f47ce3b918fb9aea9b5be2a6dc93022c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_f47ce3b918fb9aea9b5be2a6dc93022c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\25AF.tmp"C:\Users\Admin\AppData\Local\Temp\25AF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\2726.tmp"C:\Users\Admin\AppData\Local\Temp\2726.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\283F.tmp"C:\Users\Admin\AppData\Local\Temp\283F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2C56.tmp"C:\Users\Admin\AppData\Local\Temp\2C56.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\2F05.tmp"C:\Users\Admin\AppData\Local\Temp\2F05.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\30DA.tmp"C:\Users\Admin\AppData\Local\Temp\30DA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\31E4.tmp"C:\Users\Admin\AppData\Local\Temp\31E4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\329F.tmp"C:\Users\Admin\AppData\Local\Temp\329F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\3985.tmp"C:\Users\Admin\AppData\Local\Temp\3985.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\3A40.tmp"C:\Users\Admin\AppData\Local\Temp\3A40.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\4617.tmp"C:\Users\Admin\AppData\Local\Temp\4617.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\502A.tmp"C:\Users\Admin\AppData\Local\Temp\502A.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\51CF.tmp"C:\Users\Admin\AppData\Local\Temp\51CF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\524C.tmp"C:\Users\Admin\AppData\Local\Temp\524C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"65⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\549E.tmp"C:\Users\Admin\AppData\Local\Temp\549E.tmp"66⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\555A.tmp"C:\Users\Admin\AppData\Local\Temp\555A.tmp"67⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\5615.tmp"C:\Users\Admin\AppData\Local\Temp\5615.tmp"68⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\56C1.tmp"C:\Users\Admin\AppData\Local\Temp\56C1.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\574E.tmp"C:\Users\Admin\AppData\Local\Temp\574E.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"71⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5922.tmp"C:\Users\Admin\AppData\Local\Temp\5922.tmp"73⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\59BF.tmp"C:\Users\Admin\AppData\Local\Temp\59BF.tmp"74⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"75⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5B07.tmp"C:\Users\Admin\AppData\Local\Temp\5B07.tmp"76⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"78⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"79⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5D49.tmp"C:\Users\Admin\AppData\Local\Temp\5D49.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"81⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"82⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"83⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"84⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\6075.tmp"C:\Users\Admin\AppData\Local\Temp\6075.tmp"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\60F2.tmp"C:\Users\Admin\AppData\Local\Temp\60F2.tmp"86⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\619E.tmp"C:\Users\Admin\AppData\Local\Temp\619E.tmp"87⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"88⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\62F6.tmp"C:\Users\Admin\AppData\Local\Temp\62F6.tmp"89⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\6373.tmp"C:\Users\Admin\AppData\Local\Temp\6373.tmp"90⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"91⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"92⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"93⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"94⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"95⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\673C.tmp"C:\Users\Admin\AppData\Local\Temp\673C.tmp"96⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"97⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\6855.tmp"C:\Users\Admin\AppData\Local\Temp\6855.tmp"98⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\68F1.tmp"C:\Users\Admin\AppData\Local\Temp\68F1.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\696E.tmp"C:\Users\Admin\AppData\Local\Temp\696E.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"101⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\6A78.tmp"C:\Users\Admin\AppData\Local\Temp\6A78.tmp"102⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"103⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"104⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"105⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"107⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\6E02.tmp"C:\Users\Admin\AppData\Local\Temp\6E02.tmp"108⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"109⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"110⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"111⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"112⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\710F.tmp"C:\Users\Admin\AppData\Local\Temp\710F.tmp"113⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"114⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\72E4.tmp"C:\Users\Admin\AppData\Local\Temp\72E4.tmp"116⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"117⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\73FD.tmp"C:\Users\Admin\AppData\Local\Temp\73FD.tmp"118⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\74A9.tmp"C:\Users\Admin\AppData\Local\Temp\74A9.tmp"119⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\7536.tmp"C:\Users\Admin\AppData\Local\Temp\7536.tmp"120⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"121⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\769D.tmp"C:\Users\Admin\AppData\Local\Temp\769D.tmp"122⤵PID:5144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-