Analysis
- max time kernel
127s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 23:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_3a9f2e1e89940706d6c6dd77eb4b922d_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_3a9f2e1e89940706d6c6dd77eb4b922d_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-18_3a9f2e1e89940706d6c6dd77eb4b922d_elex_mafia.exe
- Size 561KB
- Sample260818-3ynf2aca56
- SHA256 64f8ad40271b285b6c1c10ee52cea7f5fc8e558754e7b1ff480ddcd75149b985
- MD5 3a9f2e1e89940706d6c6dd77eb4b922d
- SHA1 330105ff38a9b9cb88cd91466737a1c2320704ec
- SHA512 baeceec335a8b19cdcd94ee5a6718eab359b8f387661b3a64e4250494ef0cba2143aead756b8b16ae97dc1c1f423db1fab1166734c642af6e87612efcc101100
- SSDEEP 12288:VuelPWET0yhLkd9GRlTmSYXPB+7Vd7srXgCwDZuL:8eEEvhLrTTYZ+52zgCwDoL
- TLSH T188C4DF11B2D8C436F1F31A345AF49B61097B7C619B31D8CF2B88262D6EB12D1EA39717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2600 E942.tmp 4468 E9FD.tmp 3576 EAD8.tmp 3228 EB84.tmp 2088 EC01.tmp 4104 EC6E.tmp 4476 ED68.tmp 4608 EE72.tmp 1228 EEFF.tmp 4640 EF8B.tmp 2196 F047.tmp 3064 F0F3.tmp 2364 F19E.tmp 768 F23B.tmp 956 F2C7.tmp 4620 F344.tmp 5848 F400.tmp 404 F48C.tmp 256 F519.tmp 4908 F5A6.tmp 2984 F661.tmp 3432 F71D.tmp 2844 F7B9.tmp 4292 F874.tmp 1424 F911.tmp 1580 F9CC.tmp 1564 FA49.tmp 1572 FAF5.tmp 4256 FBDF.tmp 3512 FC9B.tmp 856 FD56.tmp 4516 FE41.tmp 4904 FF1C.tmp 932 FF99.tmp 4952 6.tmp 4964 83.tmp 1456 F0.tmp 2916 15E.tmp 1112 1FA.tmp 1060 267.tmp 4132 2F4.tmp 3452 361.tmp 4784 3DE.tmp 3948 44C.tmp 596 4C9.tmp 5384 536.tmp 5944 5A3.tmp 2152 601.tmp 2624 66F.tmp 4880 6CC.tmp 4504 759.tmp 4820 7C6.tmp 3176 843.tmp 2000 8C0.tmp 5972 93D.tmp 2956 9AB.tmp 1472 A28.tmp 1604 A95.tmp 3340 B02.tmp 5644 BBE.tmp 5580 C4B.tmp 4604 CC8.tmp 4988 D35.tmp 5640 DA2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4472.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5395.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E18C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 951D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6306.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3B3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 2600 4648 2026-08-18_3a9f2e1e89940706d6c6dd77eb4b922d_elex_mafia.exe 89 PID 2600 wrote to memory of 4468 2600 E942.tmp 90 PID 4468 wrote to memory of 3576 4468 E9FD.tmp 91 PID 3576 wrote to memory of 3228 3576 EAD8.tmp 92 PID 3228 wrote to memory of 2088 3228 EB84.tmp 93 PID 2088 wrote to memory of 4104 2088 EC01.tmp 94 PID 4104 wrote to memory of 4476 4104 EC6E.tmp 95 PID 4476 wrote to memory of 4608 4476 ED68.tmp 96 PID 4608 wrote to memory of 1228 4608 EE72.tmp 97 PID 1228 wrote to memory of 4640 1228 EEFF.tmp 98 PID 4640 wrote to memory of 2196 4640 EF8B.tmp 99 PID 2196 wrote to memory of 3064 2196 F047.tmp 100 PID 3064 wrote to memory of 2364 3064 F0F3.tmp 101 PID 2364 wrote to memory of 768 2364 F19E.tmp 102 PID 768 wrote to memory of 956 768 F23B.tmp 103 PID 956 wrote to memory of 4620 956 F2C7.tmp 104 PID 4620 wrote to memory of 5848 4620 F344.tmp 105 PID 5848 wrote to memory of 404 5848 F400.tmp 106 PID 404 wrote to memory of 256 404 F48C.tmp 107 PID 256 wrote to memory of 4908 256 F519.tmp 108 PID 4908 wrote to memory of 2984 4908 F5A6.tmp 109 PID 2984 wrote to memory of 3432 2984 F661.tmp 110 PID 3432 wrote to memory of 2844 3432 F71D.tmp 111 PID 2844 wrote to memory of 4292 2844 F7B9.tmp 112 PID 4292 wrote to memory of 1424 4292 F874.tmp 113 PID 1424 wrote to memory of 1580 1424 F911.tmp 114 PID 1580 wrote to memory of 1564 1580 F9CC.tmp 115 PID 1564 wrote to memory of 1572 1564 FA49.tmp 116 PID 1572 wrote to memory of 4256 1572 FAF5.tmp 117 PID 4256 wrote to memory of 3512 4256 FBDF.tmp 118 PID 3512 wrote to memory of 856 3512 FC9B.tmp 119 PID 856 wrote to memory of 4516 856 FD56.tmp 120 PID 4516 wrote to memory of 4904 4516 FE41.tmp 121 PID 4904 wrote to memory of 932 4904 FF1C.tmp 122 PID 932 wrote to memory of 4952 932 FF99.tmp 123 PID 4952 wrote to memory of 4964 4952 6.tmp 124 PID 4964 wrote to memory of 1456 4964 83.tmp 125 PID 1456 wrote to memory of 2916 1456 F0.tmp 126 PID 2916 wrote to memory of 1112 2916 15E.tmp 127 PID 1112 wrote to memory of 1060 1112 1FA.tmp 128 PID 1060 wrote to memory of 4132 1060 267.tmp 129 PID 4132 wrote to memory of 3452 4132 2F4.tmp 130 PID 3452 wrote to memory of 4784 3452 361.tmp 131 PID 4784 wrote to memory of 3948 4784 3DE.tmp 132 PID 3948 wrote to memory of 596 3948 44C.tmp 133 PID 596 wrote to memory of 5384 596 4C9.tmp 134 PID 5384 wrote to memory of 5944 5384 536.tmp 135 PID 5944 wrote to memory of 2152 5944 5A3.tmp 136 PID 2152 wrote to memory of 2624 2152 601.tmp 137 PID 2624 wrote to memory of 4880 2624 66F.tmp 138 PID 4880 wrote to memory of 4504 4880 6CC.tmp 139 PID 4504 wrote to memory of 4820 4504 759.tmp 140 PID 4820 wrote to memory of 3176 4820 7C6.tmp 141 PID 3176 wrote to memory of 2000 3176 843.tmp 142 PID 2000 wrote to memory of 5972 2000 8C0.tmp 143 PID 5972 wrote to memory of 2956 5972 93D.tmp 144 PID 2956 wrote to memory of 1472 2956 9AB.tmp 145 PID 1472 wrote to memory of 1604 1472 A28.tmp 146 PID 1604 wrote to memory of 3340 1604 A95.tmp 147 PID 3340 wrote to memory of 5644 3340 B02.tmp 148 PID 5644 wrote to memory of 5580 5644 BBE.tmp 149 PID 5580 wrote to memory of 4604 5580 C4B.tmp 150 PID 4604 wrote to memory of 4988 4604 CC8.tmp 151 PID 4988 wrote to memory of 5640 4988 D35.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_3a9f2e1e89940706d6c6dd77eb4b922d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_3a9f2e1e89940706d6c6dd77eb4b922d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\E942.tmp"C:\Users\Admin\AppData\Local\Temp\E942.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\EB84.tmp"C:\Users\Admin\AppData\Local\Temp\EB84.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\F047.tmp"C:\Users\Admin\AppData\Local\Temp\F047.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\F0F3.tmp"C:\Users\Admin\AppData\Local\Temp\F0F3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\F19E.tmp"C:\Users\Admin\AppData\Local\Temp\F19E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\F911.tmp"C:\Users\Admin\AppData\Local\Temp\F911.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\FD56.tmp"C:\Users\Admin\AppData\Local\Temp\FD56.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\FE41.tmp"C:\Users\Admin\AppData\Local\Temp\FE41.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\83.tmp"C:\Users\Admin\AppData\Local\Temp\83.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\F0.tmp"C:\Users\Admin\AppData\Local\Temp\F0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\15E.tmp"C:\Users\Admin\AppData\Local\Temp\15E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1FA.tmp"C:\Users\Admin\AppData\Local\Temp\1FA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\267.tmp"C:\Users\Admin\AppData\Local\Temp\267.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2F4.tmp"C:\Users\Admin\AppData\Local\Temp\2F4.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\3DE.tmp"C:\Users\Admin\AppData\Local\Temp\3DE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\44C.tmp"C:\Users\Admin\AppData\Local\Temp\44C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\5A3.tmp"C:\Users\Admin\AppData\Local\Temp\5A3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\66F.tmp"C:\Users\Admin\AppData\Local\Temp\66F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\BBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBE.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\C4B.tmp"C:\Users\Admin\AppData\Local\Temp\C4B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\D35.tmp"C:\Users\Admin\AppData\Local\Temp\D35.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\DA2.tmp"C:\Users\Admin\AppData\Local\Temp\DA2.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"66⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"67⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\F96.tmp"C:\Users\Admin\AppData\Local\Temp\F96.tmp"69⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"70⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"72⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\118A.tmp"C:\Users\Admin\AppData\Local\Temp\118A.tmp"73⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"74⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"75⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"76⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"77⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"78⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"79⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\14F5.tmp"C:\Users\Admin\AppData\Local\Temp\14F5.tmp"80⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"81⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\162E.tmp"C:\Users\Admin\AppData\Local\Temp\162E.tmp"82⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"83⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\1728.tmp"C:\Users\Admin\AppData\Local\Temp\1728.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\17B4.tmp"C:\Users\Admin\AppData\Local\Temp\17B4.tmp"85⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"86⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"87⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"88⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"89⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"90⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"91⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"92⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"93⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"94⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"95⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"96⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"97⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"98⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"C:\Users\Admin\AppData\Local\Temp\1DFE.tmp"99⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"100⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1F27.tmp"C:\Users\Admin\AppData\Local\Temp\1F27.tmp"101⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\1FA4.tmp"C:\Users\Admin\AppData\Local\Temp\1FA4.tmp"102⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"103⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\207E.tmp"C:\Users\Admin\AppData\Local\Temp\207E.tmp"104⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"106⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"107⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"108⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"109⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\232E.tmp"C:\Users\Admin\AppData\Local\Temp\232E.tmp"110⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\238C.tmp"C:\Users\Admin\AppData\Local\Temp\238C.tmp"111⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\2438.tmp"C:\Users\Admin\AppData\Local\Temp\2438.tmp"112⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"113⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2541.tmp"C:\Users\Admin\AppData\Local\Temp\2541.tmp"114⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"115⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\263B.tmp"C:\Users\Admin\AppData\Local\Temp\263B.tmp"116⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"117⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\2735.tmp"C:\Users\Admin\AppData\Local\Temp\2735.tmp"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\27A3.tmp"C:\Users\Admin\AppData\Local\Temp\27A3.tmp"119⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"120⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"121⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-