Analysis
- max time kernel
101s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 09:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_ce3850753aa3f5ccf0f892e17257facc_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_ce3850753aa3f5ccf0f892e17257facc_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-20_ce3850753aa3f5ccf0f892e17257facc_elex_mafia.exe
- Size 524KB
- Sample260820-ljsnrstemf
- SHA256 88f53073276cfbc7e9232ef4d8ab73623d1e6b9b98bada0358ce7beac2d5d826
- MD5 ce3850753aa3f5ccf0f892e17257facc
- SHA1 2333bd79b218459c378be91cf474a71aa25a9bf6
- SHA512 9ae514173b96797b82e98ff7512001d40cf988785ddd6da9509e31205c4c44d5e78fc9f524b4210e44a21def89fbf02b5109a2dc6279bd19ff0c25e83dbf979c
- SSDEEP 12288:TRyZzqyL66TE8wXaI4ZmW1a96fe9HppMduYFW8EceYANZ:TRyQylThwXasb9Ke984YXEeAN
- TLSH T1F6B4F116B984C036E5C202364B66D7A2587E7C755B27A4CB7BC42A6D6FF03D1E27830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3236 E72A.tmp 1168 E891.tmp 4100 E96C.tmp 3972 EAB4.tmp 3396 EC0C.tmp 4036 ED25.tmp 2496 EDE1.tmp 4564 EF58.tmp 1532 F071.tmp 6100 F1D8.tmp 3316 F301.tmp 5100 F449.tmp 4800 F553.tmp 2600 F63D.tmp 1220 F7B4.tmp 5640 F89F.tmp 1552 F92B.tmp 4844 FA83.tmp 3564 FB8D.tmp 4828 FCC5.tmp 2388 FDDE.tmp 2860 FF17.tmp 4928 30.tmp 4600 178.tmp 2260 2B1.tmp 2144 3E9.tmp 4168 522.tmp 1416 60C.tmp 3544 725.tmp 3492 86D.tmp 2068 977.tmp 4132 A81.tmp 4144 B8A.tmp 200 C46.tmp 2544 D21.tmp 4716 E1B.tmp 5296 F05.tmp 2964 FD0.tmp 1668 105D.tmp 4796 1147.tmp 2424 1270.tmp 3276 131C.tmp 480 13E7.tmp 5020 14A2.tmp 4496 155E.tmp 4200 15EB.tmp 2476 1696.tmp 2788 1762.tmp 2148 17DF.tmp 5648 186B.tmp 5272 1927.tmp 1480 19B3.tmp 4232 1A40.tmp 4548 1AFB.tmp 5816 1BA7.tmp 3500 1C44.tmp 3968 1CC1.tmp 3996 1D3E.tmp 5552 1DCA.tmp 2432 1E47.tmp 5056 1ED4.tmp 2028 1F70.tmp 5760 200C.tmp 6048 20A9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2595.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7689.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3236 5088 2026-08-20_ce3850753aa3f5ccf0f892e17257facc_elex_mafia.exe 88 PID 3236 wrote to memory of 1168 3236 E72A.tmp 89 PID 1168 wrote to memory of 4100 1168 E891.tmp 90 PID 4100 wrote to memory of 3972 4100 E96C.tmp 91 PID 3972 wrote to memory of 3396 3972 EAB4.tmp 92 PID 3396 wrote to memory of 4036 3396 EC0C.tmp 93 PID 4036 wrote to memory of 2496 4036 ED25.tmp 94 PID 2496 wrote to memory of 4564 2496 EDE1.tmp 95 PID 4564 wrote to memory of 1532 4564 EF58.tmp 96 PID 1532 wrote to memory of 6100 1532 F071.tmp 97 PID 6100 wrote to memory of 3316 6100 F1D8.tmp 98 PID 3316 wrote to memory of 5100 3316 F301.tmp 99 PID 5100 wrote to memory of 4800 5100 F449.tmp 100 PID 4800 wrote to memory of 2600 4800 F553.tmp 101 PID 2600 wrote to memory of 1220 2600 F63D.tmp 102 PID 1220 wrote to memory of 5640 1220 F7B4.tmp 103 PID 5640 wrote to memory of 1552 5640 F89F.tmp 104 PID 1552 wrote to memory of 4844 1552 F92B.tmp 105 PID 4844 wrote to memory of 3564 4844 FA83.tmp 106 PID 3564 wrote to memory of 4828 3564 FB8D.tmp 107 PID 4828 wrote to memory of 2388 4828 FCC5.tmp 108 PID 2388 wrote to memory of 2860 2388 FDDE.tmp 109 PID 2860 wrote to memory of 4928 2860 FF17.tmp 110 PID 4928 wrote to memory of 4600 4928 30.tmp 111 PID 4600 wrote to memory of 2260 4600 178.tmp 112 PID 2260 wrote to memory of 2144 2260 2B1.tmp 113 PID 2144 wrote to memory of 4168 2144 3E9.tmp 114 PID 4168 wrote to memory of 1416 4168 522.tmp 115 PID 1416 wrote to memory of 3544 1416 60C.tmp 116 PID 3544 wrote to memory of 3492 3544 725.tmp 117 PID 3492 wrote to memory of 2068 3492 86D.tmp 118 PID 2068 wrote to memory of 4132 2068 977.tmp 119 PID 4132 wrote to memory of 4144 4132 A81.tmp 120 PID 4144 wrote to memory of 200 4144 B8A.tmp 121 PID 200 wrote to memory of 2544 200 C46.tmp 122 PID 2544 wrote to memory of 4716 2544 D21.tmp 123 PID 4716 wrote to memory of 5296 4716 E1B.tmp 124 PID 5296 wrote to memory of 2964 5296 F05.tmp 125 PID 2964 wrote to memory of 1668 2964 FD0.tmp 126 PID 1668 wrote to memory of 4796 1668 105D.tmp 127 PID 4796 wrote to memory of 2424 4796 1147.tmp 128 PID 2424 wrote to memory of 3276 2424 1270.tmp 129 PID 3276 wrote to memory of 480 3276 131C.tmp 130 PID 480 wrote to memory of 5020 480 13E7.tmp 131 PID 5020 wrote to memory of 4496 5020 14A2.tmp 132 PID 4496 wrote to memory of 4200 4496 155E.tmp 133 PID 4200 wrote to memory of 2476 4200 15EB.tmp 134 PID 2476 wrote to memory of 2788 2476 1696.tmp 135 PID 2788 wrote to memory of 2148 2788 1762.tmp 136 PID 2148 wrote to memory of 5648 2148 17DF.tmp 137 PID 5648 wrote to memory of 5272 5648 186B.tmp 138 PID 5272 wrote to memory of 1480 5272 1927.tmp 139 PID 1480 wrote to memory of 4232 1480 19B3.tmp 140 PID 4232 wrote to memory of 4548 4232 1A40.tmp 141 PID 4548 wrote to memory of 5816 4548 1AFB.tmp 142 PID 5816 wrote to memory of 3500 5816 1BA7.tmp 143 PID 3500 wrote to memory of 3968 3500 1C44.tmp 144 PID 3968 wrote to memory of 3996 3968 1CC1.tmp 145 PID 3996 wrote to memory of 5552 3996 1D3E.tmp 146 PID 5552 wrote to memory of 2432 5552 1DCA.tmp 147 PID 2432 wrote to memory of 5056 2432 1E47.tmp 148 PID 5056 wrote to memory of 2028 5056 1ED4.tmp 149 PID 2028 wrote to memory of 5760 2028 1F70.tmp 150 PID 5760 wrote to memory of 6048 5760 200C.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_ce3850753aa3f5ccf0f892e17257facc_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ce3850753aa3f5ccf0f892e17257facc_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\E96C.tmp"C:\Users\Admin\AppData\Local\Temp\E96C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\F071.tmp"C:\Users\Admin\AppData\Local\Temp\F071.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\F89F.tmp"C:\Users\Admin\AppData\Local\Temp\F89F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"C:\Users\Admin\AppData\Local\Temp\FDDE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\2B1.tmp"C:\Users\Admin\AppData\Local\Temp\2B1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\86D.tmp"C:\Users\Admin\AppData\Local\Temp\86D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A81.tmp"C:\Users\Admin\AppData\Local\Temp\A81.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\1270.tmp"C:\Users\Admin\AppData\Local\Temp\1270.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\13E7.tmp"C:\Users\Admin\AppData\Local\Temp\13E7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\186B.tmp"C:\Users\Admin\AppData\Local\Temp\186B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\1927.tmp"C:\Users\Admin\AppData\Local\Temp\1927.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\1A40.tmp"C:\Users\Admin\AppData\Local\Temp\1A40.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"C:\Users\Admin\AppData\Local\Temp\1BA7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\1C44.tmp"C:\Users\Admin\AppData\Local\Temp\1C44.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"C:\Users\Admin\AppData\Local\Temp\1ED4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\1F70.tmp"C:\Users\Admin\AppData\Local\Temp\1F70.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\200C.tmp"C:\Users\Admin\AppData\Local\Temp\200C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\20A9.tmp"C:\Users\Admin\AppData\Local\Temp\20A9.tmp"65⤵
- Executes dropped EXE
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\2164.tmp"C:\Users\Admin\AppData\Local\Temp\2164.tmp"66⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"67⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"68⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"69⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"70⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\2423.tmp"C:\Users\Admin\AppData\Local\Temp\2423.tmp"71⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\24BF.tmp"C:\Users\Admin\AppData\Local\Temp\24BF.tmp"72⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"73⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"74⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"75⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"76⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"77⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\280B.tmp"C:\Users\Admin\AppData\Local\Temp\280B.tmp"78⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\2888.tmp"C:\Users\Admin\AppData\Local\Temp\2888.tmp"79⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"80⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\29B1.tmp"C:\Users\Admin\AppData\Local\Temp\29B1.tmp"81⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"82⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2B18.tmp"C:\Users\Admin\AppData\Local\Temp\2B18.tmp"83⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"84⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\2C61.tmp"C:\Users\Admin\AppData\Local\Temp\2C61.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\2CED.tmp"C:\Users\Admin\AppData\Local\Temp\2CED.tmp"86⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"87⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"88⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\2E74.tmp"C:\Users\Admin\AppData\Local\Temp\2E74.tmp"89⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\2F00.tmp"C:\Users\Admin\AppData\Local\Temp\2F00.tmp"90⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\2F7D.tmp"C:\Users\Admin\AppData\Local\Temp\2F7D.tmp"91⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\300A.tmp"C:\Users\Admin\AppData\Local\Temp\300A.tmp"92⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"93⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"94⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\3181.tmp"C:\Users\Admin\AppData\Local\Temp\3181.tmp"95⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\31FE.tmp"C:\Users\Admin\AppData\Local\Temp\31FE.tmp"96⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\327B.tmp"C:\Users\Admin\AppData\Local\Temp\327B.tmp"97⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3327.tmp"C:\Users\Admin\AppData\Local\Temp\3327.tmp"98⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\33A4.tmp"C:\Users\Admin\AppData\Local\Temp\33A4.tmp"99⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\3421.tmp"C:\Users\Admin\AppData\Local\Temp\3421.tmp"100⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\348E.tmp"C:\Users\Admin\AppData\Local\Temp\348E.tmp"101⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\350B.tmp"C:\Users\Admin\AppData\Local\Temp\350B.tmp"102⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"103⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\3634.tmp"C:\Users\Admin\AppData\Local\Temp\3634.tmp"104⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"105⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\371F.tmp"C:\Users\Admin\AppData\Local\Temp\371F.tmp"106⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\37AB.tmp"C:\Users\Admin\AppData\Local\Temp\37AB.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\3819.tmp"C:\Users\Admin\AppData\Local\Temp\3819.tmp"108⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\3886.tmp"C:\Users\Admin\AppData\Local\Temp\3886.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3903.tmp"C:\Users\Admin\AppData\Local\Temp\3903.tmp"110⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\39AF.tmp"C:\Users\Admin\AppData\Local\Temp\39AF.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\3A3B.tmp"C:\Users\Admin\AppData\Local\Temp\3A3B.tmp"112⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"113⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\3B64.tmp"C:\Users\Admin\AppData\Local\Temp\3B64.tmp"114⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"115⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3C7E.tmp"C:\Users\Admin\AppData\Local\Temp\3C7E.tmp"116⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3D29.tmp"C:\Users\Admin\AppData\Local\Temp\3D29.tmp"117⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\3D97.tmp"C:\Users\Admin\AppData\Local\Temp\3D97.tmp"118⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\3E14.tmp"C:\Users\Admin\AppData\Local\Temp\3E14.tmp"119⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\3EA0.tmp"C:\Users\Admin\AppData\Local\Temp\3EA0.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"C:\Users\Admin\AppData\Local\Temp\3FBA.tmp"122⤵PID:1448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-