Analysis
- max time kernel
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 00:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_3a8690afa3a1cdeb0109f731ca99675b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_3a8690afa3a1cdeb0109f731ca99675b_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-15_3a8690afa3a1cdeb0109f731ca99675b_elex_mafia.exe
- Size 520KB
- Sample260816-a2gtfaae28
- SHA256 c5aa62d19d69ea48d7a0085a6abb0132339e32846468a045cee7d6b26180fac1
- MD5 3a8690afa3a1cdeb0109f731ca99675b
- SHA1 5e29c146334ed2d21e93b690402b02e7a295bda2
- SHA512 fa970849cc87d11a4e8e24ad1f8108a147b49ba63f78cc58852fa6c8795fb2da182eeed5c171ba22d412ac040c298a6b9d7ef16e2bea066b6f19b8033ab5075b
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL/e1WUUv6YZrPVrAtIdrFbcVzPml83wXwZTpuj:roRXOQjmOyG1av7iaeVSl83wA3utcNZE
- TLSH T1CAB4F0227589C032E5D265308B2ACFA14A7E7C779B2652C73784366DAEF02C2E775347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 624 A9E2.tmp 5440 AACD.tmp 4576 ABA7.tmp 3860 AD0F.tmp 824 ADBB.tmp 5076 AE57.tmp 1208 AF32.tmp 3576 AFFD.tmp 5572 B0A9.tmp 5612 B174.tmp 2136 B23F.tmp 5692 B2AC.tmp 2452 B339.tmp 4304 B3F4.tmp 2096 B4A0.tmp 5028 B56B.tmp 796 B637.tmp 4368 B6D3.tmp 3664 B7DC.tmp 1136 B869.tmp 2356 B915.tmp 1740 B9B1.tmp 5684 BAAB.tmp 5864 BB47.tmp 2400 BC03.tmp 3960 BC90.tmp 5664 BD3B.tmp 4440 BDE7.tmp 424 BED2.tmp 1956 BF4F.tmp 2732 BFFB.tmp 5568 C0D5.tmp 5712 C191.tmp 3736 C20E.tmp 480 C27B.tmp 5628 C2F8.tmp 4264 C385.tmp 1792 C411.tmp 996 C49E.tmp 2712 C51B.tmp 1196 C5B7.tmp 4460 C673.tmp 4320 C6E0.tmp 5900 C76D.tmp 4608 C809.tmp 1356 C8B5.tmp 2796 C932.tmp 4776 C9AF.tmp 3700 CA4B.tmp 5880 CAB9.tmp 6040 CB45.tmp 2612 CBC2.tmp 3784 CC4F.tmp 4784 CCDB.tmp 2888 CD87.tmp 1832 CE04.tmp 5576 CEB0.tmp 3132 CF2D.tmp 4100 CFC9.tmp 5320 D066.tmp 4152 D0F2.tmp 3212 D16F.tmp 1872 D1DD.tmp 5944 D25A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 312E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 663D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 601E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 279E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 682C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6492.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3FD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5844 wrote to memory of 624 5844 2026-08-15_3a8690afa3a1cdeb0109f731ca99675b_elex_mafia.exe 88 PID 624 wrote to memory of 5440 624 A9E2.tmp 89 PID 5440 wrote to memory of 4576 5440 AACD.tmp 90 PID 4576 wrote to memory of 3860 4576 ABA7.tmp 91 PID 3860 wrote to memory of 824 3860 AD0F.tmp 92 PID 824 wrote to memory of 5076 824 ADBB.tmp 93 PID 5076 wrote to memory of 1208 5076 AE57.tmp 94 PID 1208 wrote to memory of 3576 1208 AF32.tmp 95 PID 3576 wrote to memory of 5572 3576 AFFD.tmp 96 PID 5572 wrote to memory of 5612 5572 B0A9.tmp 97 PID 5612 wrote to memory of 2136 5612 B174.tmp 98 PID 2136 wrote to memory of 5692 2136 B23F.tmp 99 PID 5692 wrote to memory of 2452 5692 B2AC.tmp 100 PID 2452 wrote to memory of 4304 2452 B339.tmp 101 PID 4304 wrote to memory of 2096 4304 B3F4.tmp 102 PID 2096 wrote to memory of 5028 2096 B4A0.tmp 103 PID 5028 wrote to memory of 796 5028 B56B.tmp 104 PID 796 wrote to memory of 4368 796 B637.tmp 105 PID 4368 wrote to memory of 3664 4368 B6D3.tmp 106 PID 3664 wrote to memory of 1136 3664 B7DC.tmp 107 PID 1136 wrote to memory of 2356 1136 B869.tmp 108 PID 2356 wrote to memory of 1740 2356 B915.tmp 109 PID 1740 wrote to memory of 5684 1740 B9B1.tmp 110 PID 5684 wrote to memory of 5864 5684 BAAB.tmp 111 PID 5864 wrote to memory of 2400 5864 BB47.tmp 112 PID 2400 wrote to memory of 3960 2400 BC03.tmp 113 PID 3960 wrote to memory of 5664 3960 BC90.tmp 114 PID 5664 wrote to memory of 4440 5664 BD3B.tmp 115 PID 4440 wrote to memory of 424 4440 BDE7.tmp 116 PID 424 wrote to memory of 1956 424 BED2.tmp 117 PID 1956 wrote to memory of 2732 1956 BF4F.tmp 118 PID 2732 wrote to memory of 5568 2732 BFFB.tmp 119 PID 5568 wrote to memory of 5712 5568 C0D5.tmp 120 PID 5712 wrote to memory of 3736 5712 C191.tmp 121 PID 3736 wrote to memory of 480 3736 C20E.tmp 122 PID 480 wrote to memory of 5628 480 C27B.tmp 123 PID 5628 wrote to memory of 4264 5628 C2F8.tmp 124 PID 4264 wrote to memory of 1792 4264 C385.tmp 125 PID 1792 wrote to memory of 996 1792 C411.tmp 126 PID 996 wrote to memory of 2712 996 C49E.tmp 127 PID 2712 wrote to memory of 1196 2712 C51B.tmp 128 PID 1196 wrote to memory of 4460 1196 C5B7.tmp 129 PID 4460 wrote to memory of 4320 4460 C673.tmp 130 PID 4320 wrote to memory of 5900 4320 C6E0.tmp 131 PID 5900 wrote to memory of 4608 5900 C76D.tmp 132 PID 4608 wrote to memory of 1356 4608 C809.tmp 133 PID 1356 wrote to memory of 2796 1356 C8B5.tmp 134 PID 2796 wrote to memory of 4776 2796 C932.tmp 135 PID 4776 wrote to memory of 3700 4776 C9AF.tmp 136 PID 3700 wrote to memory of 5880 3700 CA4B.tmp 137 PID 5880 wrote to memory of 6040 5880 CAB9.tmp 138 PID 6040 wrote to memory of 2612 6040 CB45.tmp 139 PID 2612 wrote to memory of 3784 2612 CBC2.tmp 140 PID 3784 wrote to memory of 4784 3784 CC4F.tmp 141 PID 4784 wrote to memory of 2888 4784 CCDB.tmp 142 PID 2888 wrote to memory of 1832 2888 CD87.tmp 143 PID 1832 wrote to memory of 5576 1832 CE04.tmp 144 PID 5576 wrote to memory of 3132 5576 CEB0.tmp 145 PID 3132 wrote to memory of 4100 3132 CF2D.tmp 146 PID 4100 wrote to memory of 5320 4100 CFC9.tmp 147 PID 5320 wrote to memory of 4152 5320 D066.tmp 148 PID 4152 wrote to memory of 3212 4152 D0F2.tmp 149 PID 3212 wrote to memory of 1872 3212 D16F.tmp 150 PID 1872 wrote to memory of 5944 1872 D1DD.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_3a8690afa3a1cdeb0109f731ca99675b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3a8690afa3a1cdeb0109f731ca99675b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\AE57.tmp"C:\Users\Admin\AppData\Local\Temp\AE57.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\AF32.tmp"C:\Users\Admin\AppData\Local\Temp\AF32.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B56B.tmp"C:\Users\Admin\AppData\Local\Temp\B56B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\B637.tmp"C:\Users\Admin\AppData\Local\Temp\B637.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\B915.tmp"C:\Users\Admin\AppData\Local\Temp\B915.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"C:\Users\Admin\AppData\Local\Temp\BAAB.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\BC90.tmp"C:\Users\Admin\AppData\Local\Temp\BC90.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\C385.tmp"C:\Users\Admin\AppData\Local\Temp\C385.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\C411.tmp"C:\Users\Admin\AppData\Local\Temp\C411.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"C:\Users\Admin\AppData\Local\Temp\CCDB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\D066.tmp"C:\Users\Admin\AppData\Local\Temp\D066.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\D25A.tmp"C:\Users\Admin\AppData\Local\Temp\D25A.tmp"65⤵
- Executes dropped EXE
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"66⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"67⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"68⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"69⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"70⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"71⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"72⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\D651.tmp"C:\Users\Admin\AppData\Local\Temp\D651.tmp"73⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"74⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\D74B.tmp"C:\Users\Admin\AppData\Local\Temp\D74B.tmp"75⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"76⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"77⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"78⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"79⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"80⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"81⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"82⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"83⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"84⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"85⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"87⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"88⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"89⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"90⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\E063.tmp"C:\Users\Admin\AppData\Local\Temp\E063.tmp"92⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"93⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"94⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"95⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\E286.tmp"C:\Users\Admin\AppData\Local\Temp\E286.tmp"96⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"97⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"98⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"100⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"102⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"103⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"104⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"105⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\E768.tmp"C:\Users\Admin\AppData\Local\Temp\E768.tmp"106⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"107⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"108⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"109⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\E99B.tmp"C:\Users\Admin\AppData\Local\Temp\E99B.tmp"110⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"111⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"112⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"113⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"114⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"115⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\EC98.tmp"C:\Users\Admin\AppData\Local\Temp\EC98.tmp"116⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"117⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\EDB2.tmp"C:\Users\Admin\AppData\Local\Temp\EDB2.tmp"118⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"119⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"120⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\EF77.tmp"C:\Users\Admin\AppData\Local\Temp\EF77.tmp"121⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"122⤵PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-