Analysis
- max time kernel
123s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_6c01214e643257a6ee72ca001149f6a3_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_6c01214e643257a6ee72ca001149f6a3_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_6c01214e643257a6ee72ca001149f6a3_elex_mafia.exe
- Size 518KB
- Sample261002-pynvxasglf
- SHA256 1f2f1f66d5da29a3fe826e44ba3ad0c1def685cdf87ea919a67c78101e67089f
- MD5 6c01214e643257a6ee72ca001149f6a3
- SHA1 718dc30d79bae971b30d1b3bd16f92de53ab8c5c
- SHA512 e7670e356e39799cb0b049854bc02ae22abd714e43fa7923e85f306db49aae25f2d6e0359c33a49a3254a8be760962f8e9e5527b8277ae0bbfccfe6329e92488
- SSDEEP 12288:anTpha1Jvu46gYgvcoeYDmuuDzkUWoD4FvMNZ:any1E4RhvELuwg83N
- TLSH T17AB4F111B945C032F59201394B66EBA6593A7C728735A8CB7B84367E6FF43C2D27831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5880 6DA0.tmp 4100 6EC9.tmp 5472 7001.tmp 2436 711A.tmp 2428 7224.tmp 2876 72B1.tmp 928 733D.tmp 3344 73F9.tmp 4152 74A5.tmp 4608 7541.tmp 4612 75ED.tmp 1740 76C7.tmp 4452 7783.tmp 4552 782F.tmp 4788 78FA.tmp 5668 7987.tmp 6096 7A32.tmp 3668 7ACF.tmp 5340 7B9A.tmp 5544 7C55.tmp 5664 7D11.tmp 4960 7DBD.tmp 4428 7E59.tmp 4824 7F05.tmp 4216 7FFF.tmp 3156 80CA.tmp 5532 8185.tmp 3232 8222.tmp 4064 82ED.tmp 2044 8389.tmp 5820 8435.tmp 5360 84E1.tmp 2640 859C.tmp 4368 8639.tmp 3432 86B6.tmp 5216 8742.tmp 5780 87CF.tmp 2788 887B.tmp 5548 88E8.tmp 2212 89B3.tmp 1368 8A6F.tmp 2100 8B0B.tmp 236 8BC6.tmp 1692 8C53.tmp 5744 8CE0.tmp 708 8D4D.tmp 2104 8DE9.tmp 4340 8E66.tmp 4836 8EF3.tmp 5792 8F8F.tmp 2000 900C.tmp 1184 9099.tmp 936 9145.tmp 2720 91D1.tmp 2864 9646.tmp 5716 96D3.tmp 5784 975F.tmp 2508 97EC.tmp 2836 9869.tmp 5180 98D6.tmp 2348 9972.tmp 4628 99FF.tmp 5108 9ADA.tmp 4248 9BA5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4127.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 947C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E04F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 778E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9007.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F132.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3281.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 5880 2380 2026-10-01_6c01214e643257a6ee72ca001149f6a3_elex_mafia.exe 89 PID 5880 wrote to memory of 4100 5880 6DA0.tmp 90 PID 4100 wrote to memory of 5472 4100 6EC9.tmp 91 PID 5472 wrote to memory of 2436 5472 7001.tmp 92 PID 2436 wrote to memory of 2428 2436 711A.tmp 93 PID 2428 wrote to memory of 2876 2428 7224.tmp 94 PID 2876 wrote to memory of 928 2876 72B1.tmp 95 PID 928 wrote to memory of 3344 928 733D.tmp 96 PID 3344 wrote to memory of 4152 3344 73F9.tmp 97 PID 4152 wrote to memory of 4608 4152 74A5.tmp 98 PID 4608 wrote to memory of 4612 4608 7541.tmp 99 PID 4612 wrote to memory of 1740 4612 75ED.tmp 100 PID 1740 wrote to memory of 4452 1740 76C7.tmp 101 PID 4452 wrote to memory of 4552 4452 7783.tmp 102 PID 4552 wrote to memory of 4788 4552 782F.tmp 103 PID 4788 wrote to memory of 5668 4788 78FA.tmp 104 PID 5668 wrote to memory of 6096 5668 7987.tmp 105 PID 6096 wrote to memory of 3668 6096 7A32.tmp 106 PID 3668 wrote to memory of 5340 3668 7ACF.tmp 107 PID 5340 wrote to memory of 5544 5340 7B9A.tmp 108 PID 5544 wrote to memory of 5664 5544 7C55.tmp 109 PID 5664 wrote to memory of 4960 5664 7D11.tmp 110 PID 4960 wrote to memory of 4428 4960 7DBD.tmp 111 PID 4428 wrote to memory of 4824 4428 7E59.tmp 112 PID 4824 wrote to memory of 4216 4824 7F05.tmp 113 PID 4216 wrote to memory of 3156 4216 7FFF.tmp 114 PID 3156 wrote to memory of 5532 3156 80CA.tmp 115 PID 5532 wrote to memory of 3232 5532 8185.tmp 116 PID 3232 wrote to memory of 4064 3232 8222.tmp 117 PID 4064 wrote to memory of 2044 4064 82ED.tmp 118 PID 2044 wrote to memory of 5820 2044 8389.tmp 119 PID 5820 wrote to memory of 5360 5820 8435.tmp 120 PID 5360 wrote to memory of 2640 5360 84E1.tmp 121 PID 2640 wrote to memory of 4368 2640 859C.tmp 122 PID 4368 wrote to memory of 3432 4368 8639.tmp 123 PID 3432 wrote to memory of 5216 3432 86B6.tmp 124 PID 5216 wrote to memory of 5780 5216 8742.tmp 125 PID 5780 wrote to memory of 2788 5780 87CF.tmp 126 PID 2788 wrote to memory of 5548 2788 887B.tmp 127 PID 5548 wrote to memory of 2212 5548 88E8.tmp 128 PID 2212 wrote to memory of 1368 2212 89B3.tmp 129 PID 1368 wrote to memory of 2100 1368 8A6F.tmp 130 PID 2100 wrote to memory of 236 2100 8B0B.tmp 131 PID 236 wrote to memory of 1692 236 8BC6.tmp 132 PID 1692 wrote to memory of 5744 1692 8C53.tmp 133 PID 5744 wrote to memory of 708 5744 8CE0.tmp 134 PID 708 wrote to memory of 2104 708 8D4D.tmp 135 PID 2104 wrote to memory of 4340 2104 8DE9.tmp 136 PID 4340 wrote to memory of 4836 4340 8E66.tmp 137 PID 4836 wrote to memory of 5792 4836 8EF3.tmp 138 PID 5792 wrote to memory of 2000 5792 8F8F.tmp 139 PID 2000 wrote to memory of 1184 2000 900C.tmp 140 PID 1184 wrote to memory of 936 1184 9099.tmp 141 PID 936 wrote to memory of 2720 936 9145.tmp 142 PID 2720 wrote to memory of 2864 2720 91D1.tmp 143 PID 2864 wrote to memory of 5716 2864 9646.tmp 144 PID 5716 wrote to memory of 5784 5716 96D3.tmp 145 PID 5784 wrote to memory of 2508 5784 975F.tmp 146 PID 2508 wrote to memory of 2836 2508 97EC.tmp 147 PID 2836 wrote to memory of 5180 2836 9869.tmp 148 PID 5180 wrote to memory of 2348 5180 98D6.tmp 149 PID 2348 wrote to memory of 4628 2348 9972.tmp 150 PID 5016 wrote to memory of 5108 5016 9A6C.tmp 152 PID 5108 wrote to memory of 4248 5108 9ADA.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_6c01214e643257a6ee72ca001149f6a3_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6c01214e643257a6ee72ca001149f6a3_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\7001.tmp"C:\Users\Admin\AppData\Local\Temp\7001.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\711A.tmp"C:\Users\Admin\AppData\Local\Temp\711A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\72B1.tmp"C:\Users\Admin\AppData\Local\Temp\72B1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\73F9.tmp"C:\Users\Admin\AppData\Local\Temp\73F9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\74A5.tmp"C:\Users\Admin\AppData\Local\Temp\74A5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7541.tmp"C:\Users\Admin\AppData\Local\Temp\7541.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\75ED.tmp"C:\Users\Admin\AppData\Local\Temp\75ED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\76C7.tmp"C:\Users\Admin\AppData\Local\Temp\76C7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\782F.tmp"C:\Users\Admin\AppData\Local\Temp\782F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\78FA.tmp"C:\Users\Admin\AppData\Local\Temp\78FA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7987.tmp"C:\Users\Admin\AppData\Local\Temp\7987.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\7A32.tmp"C:\Users\Admin\AppData\Local\Temp\7A32.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\7C55.tmp"C:\Users\Admin\AppData\Local\Temp\7C55.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\7D11.tmp"C:\Users\Admin\AppData\Local\Temp\7D11.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\7E59.tmp"C:\Users\Admin\AppData\Local\Temp\7E59.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7F05.tmp"C:\Users\Admin\AppData\Local\Temp\7F05.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\80CA.tmp"C:\Users\Admin\AppData\Local\Temp\80CA.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\82ED.tmp"C:\Users\Admin\AppData\Local\Temp\82ED.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8389.tmp"C:\Users\Admin\AppData\Local\Temp\8389.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\84E1.tmp"C:\Users\Admin\AppData\Local\Temp\84E1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\859C.tmp"C:\Users\Admin\AppData\Local\Temp\859C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\8639.tmp"C:\Users\Admin\AppData\Local\Temp\8639.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\86B6.tmp"C:\Users\Admin\AppData\Local\Temp\86B6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\8742.tmp"C:\Users\Admin\AppData\Local\Temp\8742.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\87CF.tmp"C:\Users\Admin\AppData\Local\Temp\87CF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\887B.tmp"C:\Users\Admin\AppData\Local\Temp\887B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\88E8.tmp"C:\Users\Admin\AppData\Local\Temp\88E8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\89B3.tmp"C:\Users\Admin\AppData\Local\Temp\89B3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\8BC6.tmp"C:\Users\Admin\AppData\Local\Temp\8BC6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\8C53.tmp"C:\Users\Admin\AppData\Local\Temp\8C53.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8E66.tmp"C:\Users\Admin\AppData\Local\Temp\8E66.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8F8F.tmp"C:\Users\Admin\AppData\Local\Temp\8F8F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\900C.tmp"C:\Users\Admin\AppData\Local\Temp\900C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\9099.tmp"C:\Users\Admin\AppData\Local\Temp\9099.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9145.tmp"C:\Users\Admin\AppData\Local\Temp\9145.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\91D1.tmp"C:\Users\Admin\AppData\Local\Temp\91D1.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9646.tmp"C:\Users\Admin\AppData\Local\Temp\9646.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\9972.tmp"C:\Users\Admin\AppData\Local\Temp\9972.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\99FF.tmp"C:\Users\Admin\AppData\Local\Temp\99FF.tmp"63⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"64⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\9C51.tmp"C:\Users\Admin\AppData\Local\Temp\9C51.tmp"67⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"C:\Users\Admin\AppData\Local\Temp\9CDD.tmp"68⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\9D6A.tmp"C:\Users\Admin\AppData\Local\Temp\9D6A.tmp"69⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"70⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\9E74.tmp"C:\Users\Admin\AppData\Local\Temp\9E74.tmp"71⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\9F10.tmp"C:\Users\Admin\AppData\Local\Temp\9F10.tmp"72⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"73⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A01A.tmp"C:\Users\Admin\AppData\Local\Temp\A01A.tmp"74⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\A133.tmp"C:\Users\Admin\AppData\Local\Temp\A133.tmp"76⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\A1BF.tmp"C:\Users\Admin\AppData\Local\Temp\A1BF.tmp"77⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\A25C.tmp"C:\Users\Admin\AppData\Local\Temp\A25C.tmp"78⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\A2E8.tmp"C:\Users\Admin\AppData\Local\Temp\A2E8.tmp"79⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\A356.tmp"C:\Users\Admin\AppData\Local\Temp\A356.tmp"80⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\A3D3.tmp"C:\Users\Admin\AppData\Local\Temp\A3D3.tmp"81⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\A45F.tmp"C:\Users\Admin\AppData\Local\Temp\A45F.tmp"82⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\A4EC.tmp"C:\Users\Admin\AppData\Local\Temp\A4EC.tmp"83⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\A588.tmp"C:\Users\Admin\AppData\Local\Temp\A588.tmp"84⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\A644.tmp"C:\Users\Admin\AppData\Local\Temp\A644.tmp"85⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\A6B1.tmp"C:\Users\Admin\AppData\Local\Temp\A6B1.tmp"86⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\A72E.tmp"C:\Users\Admin\AppData\Local\Temp\A72E.tmp"87⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\A79B.tmp"C:\Users\Admin\AppData\Local\Temp\A79B.tmp"88⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\A838.tmp"C:\Users\Admin\AppData\Local\Temp\A838.tmp"89⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\A8C4.tmp"C:\Users\Admin\AppData\Local\Temp\A8C4.tmp"90⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\A941.tmp"C:\Users\Admin\AppData\Local\Temp\A941.tmp"91⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A9CE.tmp"C:\Users\Admin\AppData\Local\Temp\A9CE.tmp"92⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"93⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\AB06.tmp"C:\Users\Admin\AppData\Local\Temp\AB06.tmp"94⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\AB93.tmp"C:\Users\Admin\AppData\Local\Temp\AB93.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\AC20.tmp"C:\Users\Admin\AppData\Local\Temp\AC20.tmp"96⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\ACDB.tmp"C:\Users\Admin\AppData\Local\Temp\ACDB.tmp"97⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\AD58.tmp"C:\Users\Admin\AppData\Local\Temp\AD58.tmp"98⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\ADF4.tmp"C:\Users\Admin\AppData\Local\Temp\ADF4.tmp"99⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"100⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\AF1D.tmp"C:\Users\Admin\AppData\Local\Temp\AF1D.tmp"101⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\AFAA.tmp"C:\Users\Admin\AppData\Local\Temp\AFAA.tmp"102⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B017.tmp"C:\Users\Admin\AppData\Local\Temp\B017.tmp"103⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B094.tmp"C:\Users\Admin\AppData\Local\Temp\B094.tmp"104⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\B102.tmp"C:\Users\Admin\AppData\Local\Temp\B102.tmp"105⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\B19E.tmp"C:\Users\Admin\AppData\Local\Temp\B19E.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\B22B.tmp"C:\Users\Admin\AppData\Local\Temp\B22B.tmp"107⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\B2A8.tmp"C:\Users\Admin\AppData\Local\Temp\B2A8.tmp"108⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\B325.tmp"C:\Users\Admin\AppData\Local\Temp\B325.tmp"109⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B3A2.tmp"C:\Users\Admin\AppData\Local\Temp\B3A2.tmp"110⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\B41F.tmp"C:\Users\Admin\AppData\Local\Temp\B41F.tmp"111⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\B48C.tmp"C:\Users\Admin\AppData\Local\Temp\B48C.tmp"112⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\B538.tmp"C:\Users\Admin\AppData\Local\Temp\B538.tmp"113⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\B5C4.tmp"C:\Users\Admin\AppData\Local\Temp\B5C4.tmp"114⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B690.tmp"C:\Users\Admin\AppData\Local\Temp\B690.tmp"115⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\B72C.tmp"C:\Users\Admin\AppData\Local\Temp\B72C.tmp"116⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\B7C8.tmp"C:\Users\Admin\AppData\Local\Temp\B7C8.tmp"117⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\B855.tmp"C:\Users\Admin\AppData\Local\Temp\B855.tmp"118⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\B8D2.tmp"C:\Users\Admin\AppData\Local\Temp\B8D2.tmp"119⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B95E.tmp"C:\Users\Admin\AppData\Local\Temp\B95E.tmp"120⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B9EB.tmp"C:\Users\Admin\AppData\Local\Temp\B9EB.tmp"121⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\BA97.tmp"C:\Users\Admin\AppData\Local\Temp\BA97.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:3572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-