Analysis
- max time kernel
122s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 16:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_9ad9fcf05856f2787f874bad85fa9e40_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_9ad9fcf05856f2787f874bad85fa9e40_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-25_9ad9fcf05856f2787f874bad85fa9e40_elex_mafia.exe
- Size 520KB
- Sample260826-th885azset
- SHA256 6047e464394b9a47bbc545efea87d939f11d3a1290e26066a86cd94b91e8ca9d
- MD5 9ad9fcf05856f2787f874bad85fa9e40
- SHA1 422de5d1b4ac35279f9d061e7cde7ba63c657f85
- SHA512 94e8a3245cfb15eca1b61776921ab50cd8d89f317ce862ffbfd654d42b8ebbaa252bcead1530c1904b2b7555c1b18ded5cfaf60a9589c03db238b9d2145db584
- SSDEEP 12288:gj8fuxR21t5i8fBOe+wb1VHFlls5HxuBRi9TtNZ6:gj8fuK1GYEwbfD+zuji3NI
- TLSH T1B3B4F1127589C033E9E215314B66DBA10ABE7D399B3695C73BC03A7E6FB52D0963430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2192 4B14.tmp 4260 4BCF.tmp 4048 4C8B.tmp 4012 4D66.tmp 4040 4E7F.tmp 4708 4FA8.tmp 5820 5054.tmp 2208 513E.tmp 5392 5219.tmp 3344 5313.tmp 4116 53EE.tmp 4480 54A9.tmp 3364 5593.tmp 3576 5630.tmp 2496 570A.tmp 1120 57F5.tmp 5848 58DF.tmp 4588 59CA.tmp 6040 5A85.tmp 5576 5B6F.tmp 4856 5C1B.tmp 4576 5CF6.tmp 5356 5D83.tmp 2988 5E1F.tmp 3700 5EDA.tmp 460 5F86.tmp 5420 6051.tmp 5780 611D.tmp 2460 61E8.tmp 2424 62B3.tmp 4064 637E.tmp 4740 6459.tmp 5620 64F5.tmp 5632 6582.tmp 3204 661E.tmp 3304 669B.tmp 3580 6718.tmp 4968 67B4.tmp 1872 6841.tmp 1272 68BE.tmp 1124 693B.tmp 6140 69C7.tmp 3148 6A64.tmp 4128 6AF0.tmp 2044 6B8C.tmp 2844 6C09.tmp 5772 6C96.tmp 1396 6D42.tmp 2068 6DBF.tmp 2324 6E4C.tmp 2488 6ED8.tmp 4316 6F36.tmp 2380 6FD2.tmp 5268 704F.tmp 3892 70FB.tmp 4368 7188.tmp 4180 7205.tmp 1956 7282.tmp 1288 72FF.tmp 5220 738B.tmp 3848 7418.tmp 5520 74A5.tmp 5832 7522.tmp 4964 759F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 947C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 659C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D487.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E192.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D31B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E55B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 211C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 929C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6984.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6E4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2192 2800 2026-08-25_9ad9fcf05856f2787f874bad85fa9e40_elex_mafia.exe 88 PID 2192 wrote to memory of 4260 2192 4B14.tmp 89 PID 4260 wrote to memory of 4048 4260 4BCF.tmp 90 PID 4048 wrote to memory of 4012 4048 4C8B.tmp 91 PID 4012 wrote to memory of 4040 4012 4D66.tmp 92 PID 4040 wrote to memory of 4708 4040 4E7F.tmp 93 PID 4708 wrote to memory of 5820 4708 4FA8.tmp 94 PID 5820 wrote to memory of 2208 5820 5054.tmp 95 PID 2208 wrote to memory of 5392 2208 513E.tmp 96 PID 5392 wrote to memory of 3344 5392 5219.tmp 97 PID 3344 wrote to memory of 4116 3344 5313.tmp 98 PID 4116 wrote to memory of 4480 4116 53EE.tmp 99 PID 4480 wrote to memory of 3364 4480 54A9.tmp 100 PID 3364 wrote to memory of 3576 3364 5593.tmp 101 PID 3576 wrote to memory of 2496 3576 5630.tmp 102 PID 2496 wrote to memory of 1120 2496 570A.tmp 103 PID 1120 wrote to memory of 5848 1120 57F5.tmp 104 PID 5848 wrote to memory of 4588 5848 58DF.tmp 105 PID 4588 wrote to memory of 6040 4588 59CA.tmp 106 PID 6040 wrote to memory of 5576 6040 5A85.tmp 107 PID 5576 wrote to memory of 4856 5576 5B6F.tmp 108 PID 4856 wrote to memory of 4576 4856 5C1B.tmp 109 PID 4576 wrote to memory of 5356 4576 5CF6.tmp 110 PID 5356 wrote to memory of 2988 5356 5D83.tmp 111 PID 2988 wrote to memory of 3700 2988 5E1F.tmp 112 PID 3700 wrote to memory of 460 3700 5EDA.tmp 113 PID 460 wrote to memory of 5420 460 5F86.tmp 114 PID 5420 wrote to memory of 5780 5420 6051.tmp 115 PID 5780 wrote to memory of 2460 5780 611D.tmp 116 PID 2460 wrote to memory of 2424 2460 61E8.tmp 117 PID 2424 wrote to memory of 4064 2424 62B3.tmp 118 PID 4064 wrote to memory of 4740 4064 637E.tmp 119 PID 4740 wrote to memory of 5620 4740 6459.tmp 120 PID 5620 wrote to memory of 5632 5620 64F5.tmp 121 PID 5632 wrote to memory of 3204 5632 6582.tmp 122 PID 3204 wrote to memory of 3304 3204 661E.tmp 123 PID 3304 wrote to memory of 3580 3304 669B.tmp 124 PID 3580 wrote to memory of 4968 3580 6718.tmp 125 PID 4968 wrote to memory of 1872 4968 67B4.tmp 126 PID 1872 wrote to memory of 1272 1872 6841.tmp 127 PID 1272 wrote to memory of 1124 1272 68BE.tmp 128 PID 1124 wrote to memory of 6140 1124 693B.tmp 129 PID 6140 wrote to memory of 3148 6140 69C7.tmp 130 PID 3148 wrote to memory of 4128 3148 6A64.tmp 131 PID 4128 wrote to memory of 2044 4128 6AF0.tmp 132 PID 2044 wrote to memory of 2844 2044 6B8C.tmp 133 PID 2844 wrote to memory of 5772 2844 6C09.tmp 134 PID 5772 wrote to memory of 1396 5772 6C96.tmp 135 PID 1396 wrote to memory of 2068 1396 6D42.tmp 136 PID 2068 wrote to memory of 2324 2068 6DBF.tmp 137 PID 2324 wrote to memory of 2488 2324 6E4C.tmp 138 PID 2488 wrote to memory of 4316 2488 6ED8.tmp 139 PID 4316 wrote to memory of 2380 4316 6F36.tmp 140 PID 2380 wrote to memory of 5268 2380 6FD2.tmp 141 PID 5268 wrote to memory of 3892 5268 704F.tmp 142 PID 3892 wrote to memory of 4368 3892 70FB.tmp 143 PID 4368 wrote to memory of 4180 4368 7188.tmp 144 PID 4180 wrote to memory of 1956 4180 7205.tmp 145 PID 1956 wrote to memory of 1288 1956 7282.tmp 146 PID 1288 wrote to memory of 5220 1288 72FF.tmp 147 PID 5220 wrote to memory of 3848 5220 738B.tmp 148 PID 3848 wrote to memory of 5520 3848 7418.tmp 149 PID 5520 wrote to memory of 5832 5520 74A5.tmp 150 PID 5832 wrote to memory of 4964 5832 7522.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_9ad9fcf05856f2787f874bad85fa9e40_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_9ad9fcf05856f2787f874bad85fa9e40_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4C8B.tmp"C:\Users\Admin\AppData\Local\Temp\4C8B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"C:\Users\Admin\AppData\Local\Temp\4FA8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5054.tmp"C:\Users\Admin\AppData\Local\Temp\5054.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\513E.tmp"C:\Users\Admin\AppData\Local\Temp\513E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\5219.tmp"C:\Users\Admin\AppData\Local\Temp\5219.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\5313.tmp"C:\Users\Admin\AppData\Local\Temp\5313.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\53EE.tmp"C:\Users\Admin\AppData\Local\Temp\53EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\54A9.tmp"C:\Users\Admin\AppData\Local\Temp\54A9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5593.tmp"C:\Users\Admin\AppData\Local\Temp\5593.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\5630.tmp"C:\Users\Admin\AppData\Local\Temp\5630.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\570A.tmp"C:\Users\Admin\AppData\Local\Temp\570A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\57F5.tmp"C:\Users\Admin\AppData\Local\Temp\57F5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\58DF.tmp"C:\Users\Admin\AppData\Local\Temp\58DF.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\59CA.tmp"C:\Users\Admin\AppData\Local\Temp\59CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5A85.tmp"C:\Users\Admin\AppData\Local\Temp\5A85.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\5B6F.tmp"C:\Users\Admin\AppData\Local\Temp\5B6F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5D83.tmp"C:\Users\Admin\AppData\Local\Temp\5D83.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\5E1F.tmp"C:\Users\Admin\AppData\Local\Temp\5E1F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5EDA.tmp"C:\Users\Admin\AppData\Local\Temp\5EDA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5F86.tmp"C:\Users\Admin\AppData\Local\Temp\5F86.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\6051.tmp"C:\Users\Admin\AppData\Local\Temp\6051.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\61E8.tmp"C:\Users\Admin\AppData\Local\Temp\61E8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\62B3.tmp"C:\Users\Admin\AppData\Local\Temp\62B3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\637E.tmp"C:\Users\Admin\AppData\Local\Temp\637E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\6459.tmp"C:\Users\Admin\AppData\Local\Temp\6459.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\64F5.tmp"C:\Users\Admin\AppData\Local\Temp\64F5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\6582.tmp"C:\Users\Admin\AppData\Local\Temp\6582.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\661E.tmp"C:\Users\Admin\AppData\Local\Temp\661E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\669B.tmp"C:\Users\Admin\AppData\Local\Temp\669B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\6718.tmp"C:\Users\Admin\AppData\Local\Temp\6718.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\67B4.tmp"C:\Users\Admin\AppData\Local\Temp\67B4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6841.tmp"C:\Users\Admin\AppData\Local\Temp\6841.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\68BE.tmp"C:\Users\Admin\AppData\Local\Temp\68BE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\693B.tmp"C:\Users\Admin\AppData\Local\Temp\693B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\69C7.tmp"C:\Users\Admin\AppData\Local\Temp\69C7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\6A64.tmp"C:\Users\Admin\AppData\Local\Temp\6A64.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\6B8C.tmp"C:\Users\Admin\AppData\Local\Temp\6B8C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\6C09.tmp"C:\Users\Admin\AppData\Local\Temp\6C09.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6C96.tmp"C:\Users\Admin\AppData\Local\Temp\6C96.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\6D42.tmp"C:\Users\Admin\AppData\Local\Temp\6D42.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6F36.tmp"C:\Users\Admin\AppData\Local\Temp\6F36.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\704F.tmp"C:\Users\Admin\AppData\Local\Temp\704F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7282.tmp"C:\Users\Admin\AppData\Local\Temp\7282.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\72FF.tmp"C:\Users\Admin\AppData\Local\Temp\72FF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\7418.tmp"C:\Users\Admin\AppData\Local\Temp\7418.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\74A5.tmp"C:\Users\Admin\AppData\Local\Temp\74A5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\7522.tmp"C:\Users\Admin\AppData\Local\Temp\7522.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\759F.tmp"C:\Users\Admin\AppData\Local\Temp\759F.tmp"65⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\760C.tmp"C:\Users\Admin\AppData\Local\Temp\760C.tmp"66⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7689.tmp"C:\Users\Admin\AppData\Local\Temp\7689.tmp"67⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\7725.tmp"C:\Users\Admin\AppData\Local\Temp\7725.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\77A2.tmp"C:\Users\Admin\AppData\Local\Temp\77A2.tmp"69⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\7810.tmp"C:\Users\Admin\AppData\Local\Temp\7810.tmp"70⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\787D.tmp"C:\Users\Admin\AppData\Local\Temp\787D.tmp"71⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\78FA.tmp"C:\Users\Admin\AppData\Local\Temp\78FA.tmp"72⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\7987.tmp"C:\Users\Admin\AppData\Local\Temp\7987.tmp"73⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\79F4.tmp"C:\Users\Admin\AppData\Local\Temp\79F4.tmp"74⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\7A90.tmp"C:\Users\Admin\AppData\Local\Temp\7A90.tmp"75⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"76⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\7BD8.tmp"C:\Users\Admin\AppData\Local\Temp\7BD8.tmp"77⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\7C55.tmp"C:\Users\Admin\AppData\Local\Temp\7C55.tmp"78⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"79⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"81⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"82⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"83⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"84⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\806C.tmp"C:\Users\Admin\AppData\Local\Temp\806C.tmp"85⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\80F9.tmp"C:\Users\Admin\AppData\Local\Temp\80F9.tmp"86⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\8176.tmp"C:\Users\Admin\AppData\Local\Temp\8176.tmp"87⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\8231.tmp"C:\Users\Admin\AppData\Local\Temp\8231.tmp"88⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\82ED.tmp"C:\Users\Admin\AppData\Local\Temp\82ED.tmp"89⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\8379.tmp"C:\Users\Admin\AppData\Local\Temp\8379.tmp"90⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\8416.tmp"C:\Users\Admin\AppData\Local\Temp\8416.tmp"91⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\8483.tmp"C:\Users\Admin\AppData\Local\Temp\8483.tmp"92⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"93⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\856D.tmp"C:\Users\Admin\AppData\Local\Temp\856D.tmp"94⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\85EA.tmp"C:\Users\Admin\AppData\Local\Temp\85EA.tmp"95⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\8677.tmp"C:\Users\Admin\AppData\Local\Temp\8677.tmp"96⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"97⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\8781.tmp"C:\Users\Admin\AppData\Local\Temp\8781.tmp"98⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\881D.tmp"C:\Users\Admin\AppData\Local\Temp\881D.tmp"99⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\88C9.tmp"C:\Users\Admin\AppData\Local\Temp\88C9.tmp"100⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\8965.tmp"C:\Users\Admin\AppData\Local\Temp\8965.tmp"101⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\8A01.tmp"C:\Users\Admin\AppData\Local\Temp\8A01.tmp"102⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"103⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\8B69.tmp"C:\Users\Admin\AppData\Local\Temp\8B69.tmp"104⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\8C24.tmp"C:\Users\Admin\AppData\Local\Temp\8C24.tmp"105⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\8CEF.tmp"C:\Users\Admin\AppData\Local\Temp\8CEF.tmp"106⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"107⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\8E09.tmp"C:\Users\Admin\AppData\Local\Temp\8E09.tmp"108⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"109⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8F80.tmp"C:\Users\Admin\AppData\Local\Temp\8F80.tmp"110⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\903B.tmp"C:\Users\Admin\AppData\Local\Temp\903B.tmp"111⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\90E7.tmp"C:\Users\Admin\AppData\Local\Temp\90E7.tmp"112⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\9193.tmp"C:\Users\Admin\AppData\Local\Temp\9193.tmp"113⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\922F.tmp"C:\Users\Admin\AppData\Local\Temp\922F.tmp"114⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\929C.tmp"C:\Users\Admin\AppData\Local\Temp\929C.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\9339.tmp"C:\Users\Admin\AppData\Local\Temp\9339.tmp"116⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\93E5.tmp"C:\Users\Admin\AppData\Local\Temp\93E5.tmp"117⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\9462.tmp"C:\Users\Admin\AppData\Local\Temp\9462.tmp"118⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\952D.tmp"C:\Users\Admin\AppData\Local\Temp\952D.tmp"119⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\958A.tmp"C:\Users\Admin\AppData\Local\Temp\958A.tmp"120⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\9617.tmp"C:\Users\Admin\AppData\Local\Temp\9617.tmp"121⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\9694.tmp"C:\Users\Admin\AppData\Local\Temp\9694.tmp"122⤵PID:5148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-