Analysis
- max time kernel
108s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_36a535f36db1040589a72d08a023d4c3_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_36a535f36db1040589a72d08a023d4c3_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_36a535f36db1040589a72d08a023d4c3_elex_mafia.exe
- Size 524KB
- Sample261002-t968vazz2k
- SHA256 642789a1ec0245bb6af900da50c8e8300cf9068c9234a4de3d76741c6231f7ce
- MD5 36a535f36db1040589a72d08a023d4c3
- SHA1 64dd74e1bd43be600e65344d641c082248f4a126
- SHA512 b8575c4898e5ed00da33190a4a06fafa2c9c1832e5b241c1b6c03507a77c3bcaa7af7f9db9f3fcd9af3652b18e24991d9cefb3abcde0b8af43845dd214bccf17
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf7ULu6lfxgxNrq03bqlr4ObqsH3dZ:TRyZzqyL66TuFODq03bqlcMbNZ
- TLSH T180B4F115B585C032E68312754E26EB92693ABC769B2365C73BD4267D2EF13D1E374303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6024 F2E2.tmp 6140 F497.tmp 4040 F6D9.tmp 4060 F87F.tmp 4044 FA44.tmp 4928 FBCB.tmp 5640 FD32.tmp 4852 FE9A.tmp 5036 FF94.tmp 4548 FB.tmp 2560 205.tmp 3828 31E.tmp 3364 418.tmp 2232 512.tmp 5056 5FC.tmp 3352 6F6.tmp 832 82F.tmp 4064 987.tmp 3384 ADE.tmp 3512 C46.tmp 4812 D5F.tmp 2780 E78.tmp 3152 F82.tmp 3692 10CA.tmp 4140 1241.tmp 1444 134B.tmp 4872 14A2.tmp 1116 160A.tmp 2904 1704.tmp 1944 181D.tmp 5104 19C3.tmp 3156 1B4A.tmp 2468 1CA1.tmp 4528 1DAB.tmp 988 1E57.tmp 1148 1F12.tmp 2240 1FDD.tmp 1352 20D7.tmp 424 21B2.tmp 4628 226E.tmp 4952 2339.tmp 2888 23D5.tmp 3848 24B0.tmp 2608 254C.tmp 4348 2636.tmp 4616 2721.tmp 5620 27FC.tmp 2080 28D6.tmp 4280 2992.tmp 2708 2A1E.tmp 2784 2AAB.tmp 5344 2B38.tmp 4824 2BF3.tmp 4108 2C80.tmp 1840 2D4B.tmp 3788 2DC8.tmp 1676 2E74.tmp 2868 2F10.tmp 4312 2FEB.tmp 2756 3087.tmp 5676 3114.tmp 4704 3191.tmp 4340 320E.tmp 1988 328B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 979E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7168.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 605C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 134B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8984.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 181D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE6.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 236 wrote to memory of 6024 236 2026-10-01_36a535f36db1040589a72d08a023d4c3_elex_mafia.exe 88 PID 6024 wrote to memory of 6140 6024 F2E2.tmp 89 PID 6140 wrote to memory of 4040 6140 F497.tmp 90 PID 4040 wrote to memory of 4060 4040 F6D9.tmp 91 PID 4060 wrote to memory of 4044 4060 F87F.tmp 92 PID 4044 wrote to memory of 4928 4044 FA44.tmp 93 PID 4928 wrote to memory of 5640 4928 FBCB.tmp 94 PID 5640 wrote to memory of 4852 5640 FD32.tmp 95 PID 4852 wrote to memory of 5036 4852 FE9A.tmp 96 PID 5036 wrote to memory of 4548 5036 FF94.tmp 97 PID 4548 wrote to memory of 2560 4548 FB.tmp 98 PID 2560 wrote to memory of 3828 2560 205.tmp 99 PID 3828 wrote to memory of 3364 3828 31E.tmp 100 PID 3364 wrote to memory of 2232 3364 418.tmp 101 PID 2232 wrote to memory of 5056 2232 512.tmp 102 PID 5056 wrote to memory of 3352 5056 5FC.tmp 103 PID 3352 wrote to memory of 832 3352 6F6.tmp 104 PID 832 wrote to memory of 4064 832 82F.tmp 105 PID 4064 wrote to memory of 3384 4064 987.tmp 106 PID 3384 wrote to memory of 3512 3384 ADE.tmp 107 PID 3512 wrote to memory of 4812 3512 C46.tmp 108 PID 4812 wrote to memory of 2780 4812 D5F.tmp 109 PID 2780 wrote to memory of 3152 2780 E78.tmp 110 PID 3152 wrote to memory of 3692 3152 F82.tmp 111 PID 3692 wrote to memory of 4140 3692 10CA.tmp 112 PID 4140 wrote to memory of 1444 4140 1241.tmp 113 PID 1444 wrote to memory of 4872 1444 134B.tmp 114 PID 4872 wrote to memory of 1116 4872 14A2.tmp 115 PID 1116 wrote to memory of 2904 1116 160A.tmp 116 PID 2904 wrote to memory of 1944 2904 1704.tmp 117 PID 1944 wrote to memory of 5104 1944 181D.tmp 118 PID 5104 wrote to memory of 3156 5104 19C3.tmp 119 PID 3156 wrote to memory of 2468 3156 1B4A.tmp 120 PID 2468 wrote to memory of 4528 2468 1CA1.tmp 121 PID 4528 wrote to memory of 988 4528 1DAB.tmp 122 PID 988 wrote to memory of 1148 988 1E57.tmp 123 PID 1148 wrote to memory of 2240 1148 1F12.tmp 124 PID 2240 wrote to memory of 1352 2240 1FDD.tmp 125 PID 1352 wrote to memory of 424 1352 20D7.tmp 126 PID 424 wrote to memory of 4628 424 21B2.tmp 127 PID 4628 wrote to memory of 4952 4628 226E.tmp 128 PID 4952 wrote to memory of 2888 4952 2339.tmp 129 PID 2888 wrote to memory of 3848 2888 23D5.tmp 130 PID 3848 wrote to memory of 2608 3848 24B0.tmp 131 PID 2608 wrote to memory of 4348 2608 254C.tmp 132 PID 4348 wrote to memory of 4616 4348 2636.tmp 133 PID 4616 wrote to memory of 5620 4616 2721.tmp 134 PID 5620 wrote to memory of 2080 5620 27FC.tmp 135 PID 2080 wrote to memory of 4280 2080 28D6.tmp 136 PID 4280 wrote to memory of 2708 4280 2992.tmp 137 PID 2708 wrote to memory of 2784 2708 2A1E.tmp 138 PID 2784 wrote to memory of 5344 2784 2AAB.tmp 139 PID 5344 wrote to memory of 4824 5344 2B38.tmp 140 PID 4824 wrote to memory of 4108 4824 2BF3.tmp 141 PID 4108 wrote to memory of 1840 4108 2C80.tmp 142 PID 1840 wrote to memory of 3788 1840 2D4B.tmp 143 PID 3788 wrote to memory of 1676 3788 2DC8.tmp 144 PID 1676 wrote to memory of 2868 1676 2E74.tmp 145 PID 2868 wrote to memory of 4312 2868 2F10.tmp 146 PID 4312 wrote to memory of 2756 4312 2FEB.tmp 147 PID 2756 wrote to memory of 5676 2756 3087.tmp 148 PID 5676 wrote to memory of 4704 5676 3114.tmp 149 PID 4704 wrote to memory of 4340 4704 3191.tmp 150 PID 4340 wrote to memory of 1988 4340 320E.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_36a535f36db1040589a72d08a023d4c3_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_36a535f36db1040589a72d08a023d4c3_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\FD32.tmp"C:\Users\Admin\AppData\Local\Temp\FD32.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\FB.tmp"C:\Users\Admin\AppData\Local\Temp\FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\205.tmp"C:\Users\Admin\AppData\Local\Temp\205.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\512.tmp"C:\Users\Admin\AppData\Local\Temp\512.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\6F6.tmp"C:\Users\Admin\AppData\Local\Temp\6F6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\82F.tmp"C:\Users\Admin\AppData\Local\Temp\82F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\D5F.tmp"C:\Users\Admin\AppData\Local\Temp\D5F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\134B.tmp"C:\Users\Admin\AppData\Local\Temp\134B.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\1704.tmp"C:\Users\Admin\AppData\Local\Temp\1704.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\181D.tmp"C:\Users\Admin\AppData\Local\Temp\181D.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\19C3.tmp"C:\Users\Admin\AppData\Local\Temp\19C3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\1B4A.tmp"C:\Users\Admin\AppData\Local\Temp\1B4A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\23D5.tmp"C:\Users\Admin\AppData\Local\Temp\23D5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\2721.tmp"C:\Users\Admin\AppData\Local\Temp\2721.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\27FC.tmp"C:\Users\Admin\AppData\Local\Temp\27FC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\28D6.tmp"C:\Users\Admin\AppData\Local\Temp\28D6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2992.tmp"C:\Users\Admin\AppData\Local\Temp\2992.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\2C80.tmp"C:\Users\Admin\AppData\Local\Temp\2C80.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2E74.tmp"C:\Users\Admin\AppData\Local\Temp\2E74.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3087.tmp"C:\Users\Admin\AppData\Local\Temp\3087.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\320E.tmp"C:\Users\Admin\AppData\Local\Temp\320E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\328B.tmp"C:\Users\Admin\AppData\Local\Temp\328B.tmp"65⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3327.tmp"C:\Users\Admin\AppData\Local\Temp\3327.tmp"66⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\33F2.tmp"C:\Users\Admin\AppData\Local\Temp\33F2.tmp"67⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"68⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\351B.tmp"C:\Users\Admin\AppData\Local\Temp\351B.tmp"69⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\35A8.tmp"C:\Users\Admin\AppData\Local\Temp\35A8.tmp"70⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\3644.tmp"C:\Users\Admin\AppData\Local\Temp\3644.tmp"71⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\36C1.tmp"C:\Users\Admin\AppData\Local\Temp\36C1.tmp"72⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\375D.tmp"C:\Users\Admin\AppData\Local\Temp\375D.tmp"73⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\3819.tmp"C:\Users\Admin\AppData\Local\Temp\3819.tmp"74⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\38B5.tmp"C:\Users\Admin\AppData\Local\Temp\38B5.tmp"75⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\3941.tmp"C:\Users\Admin\AppData\Local\Temp\3941.tmp"76⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\39CE.tmp"C:\Users\Admin\AppData\Local\Temp\39CE.tmp"77⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"78⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\3AF7.tmp"C:\Users\Admin\AppData\Local\Temp\3AF7.tmp"79⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3B74.tmp"C:\Users\Admin\AppData\Local\Temp\3B74.tmp"80⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"81⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"82⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"83⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\3D87.tmp"C:\Users\Admin\AppData\Local\Temp\3D87.tmp"84⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\3E14.tmp"C:\Users\Admin\AppData\Local\Temp\3E14.tmp"85⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"86⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"C:\Users\Admin\AppData\Local\Temp\3F4C.tmp"87⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\3FF8.tmp"C:\Users\Admin\AppData\Local\Temp\3FF8.tmp"88⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\4075.tmp"C:\Users\Admin\AppData\Local\Temp\4075.tmp"89⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\4111.tmp"C:\Users\Admin\AppData\Local\Temp\4111.tmp"90⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\41CD.tmp"C:\Users\Admin\AppData\Local\Temp\41CD.tmp"91⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\424A.tmp"C:\Users\Admin\AppData\Local\Temp\424A.tmp"92⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\42C7.tmp"C:\Users\Admin\AppData\Local\Temp\42C7.tmp"93⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\4344.tmp"C:\Users\Admin\AppData\Local\Temp\4344.tmp"94⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\43E0.tmp"C:\Users\Admin\AppData\Local\Temp\43E0.tmp"95⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\446D.tmp"C:\Users\Admin\AppData\Local\Temp\446D.tmp"96⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\44F9.tmp"C:\Users\Admin\AppData\Local\Temp\44F9.tmp"97⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\45B5.tmp"C:\Users\Admin\AppData\Local\Temp\45B5.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4651.tmp"C:\Users\Admin\AppData\Local\Temp\4651.tmp"99⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\46DE.tmp"C:\Users\Admin\AppData\Local\Temp\46DE.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\475B.tmp"C:\Users\Admin\AppData\Local\Temp\475B.tmp"101⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\47F7.tmp"C:\Users\Admin\AppData\Local\Temp\47F7.tmp"102⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\48A3.tmp"C:\Users\Admin\AppData\Local\Temp\48A3.tmp"103⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"104⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"105⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\4A39.tmp"C:\Users\Admin\AppData\Local\Temp\4A39.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"107⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"108⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"109⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"110⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"C:\Users\Admin\AppData\Local\Temp\4CE9.tmp"111⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4D85.tmp"C:\Users\Admin\AppData\Local\Temp\4D85.tmp"112⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4E12.tmp"C:\Users\Admin\AppData\Local\Temp\4E12.tmp"113⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\4E9E.tmp"C:\Users\Admin\AppData\Local\Temp\4E9E.tmp"114⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"115⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\4F79.tmp"C:\Users\Admin\AppData\Local\Temp\4F79.tmp"116⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"117⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\5073.tmp"C:\Users\Admin\AppData\Local\Temp\5073.tmp"118⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\510F.tmp"C:\Users\Admin\AppData\Local\Temp\510F.tmp"119⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\51AB.tmp"C:\Users\Admin\AppData\Local\Temp\51AB.tmp"120⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\5228.tmp"C:\Users\Admin\AppData\Local\Temp\5228.tmp"121⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\52B5.tmp"C:\Users\Admin\AppData\Local\Temp\52B5.tmp"122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-