Analysis
- max time kernel
130s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 23:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_fee04eda866a28380349d0d8e381cfea_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_fee04eda866a28380349d0d8e381cfea_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-27_fee04eda866a28380349d0d8e381cfea_elex_mafia.exe
- Size 816KB
- Sample260827-3wefca1hlg
- SHA256 b62934a511c3cda862096f0c02d7b72b8274279a7f46a2561f0cb72fe40b0857
- MD5 fee04eda866a28380349d0d8e381cfea
- SHA1 bc10d5eaac329f38581006a55deb142dcac9cee4
- SHA512 1e23113b86baae2e2bae8ec859d46cc76296897548aa15331f7202ab3d3d17f0bcd7b833a5308ec60e6292779171bba34261861694d1c3661ed3d0496e9c7010
- SSDEEP 12288:+mF/W8Dsy3jrL6WEwYLalAJ1k9BSg72CVi4iyR3Z:+m0833/Lf8LSe+9b7V13
- TLSH T17705F121B688C032E59311354F6AEB96087A7D314B27A8C7BB90367E6FB43D1DA75307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5252 371.tmp 5440 48A.tmp 5360 546.tmp 2712 5F2.tmp 3924 68E.tmp 4644 749.tmp 4900 7F5.tmp 4288 90E.tmp 2956 9F9.tmp 3696 B41.tmp 3876 C4B.tmp 5796 D16.tmp 2776 DB2.tmp 4804 EAC.tmp 4128 F29.tmp 5524 1023.tmp 6128 10FE.tmp 5656 11AA.tmp 2876 1294.tmp 4944 1340.tmp 988 13EC.tmp 5640 14A7.tmp 240 1572.tmp 4836 165D.tmp 4316 16F9.tmp 4800 17F3.tmp 3372 1860.tmp 3596 193B.tmp 4480 1A06.tmp 1120 1AB2.tmp 2044 1B5E.tmp 3028 1C19.tmp 3292 1CF4.tmp 4224 1D62.tmp 4560 1DEE.tmp 1132 1E6B.tmp 4328 1EF8.tmp 1284 1F75.tmp 3216 1FF2.tmp 848 205F.tmp 1420 20FB.tmp 3440 2169.tmp 5416 2215.tmp 4216 22A1.tmp 4688 231E.tmp 4892 239B.tmp 2104 2438.tmp 1444 24C4.tmp 4452 2551.tmp 5904 25CE.tmp 4436 265A.tmp 3092 26F7.tmp 2708 2783.tmp 5808 2820.tmp 1144 288D.tmp 3132 290A.tmp 5972 2977.tmp 6008 2A04.tmp 1556 2A71.tmp 5476 2AEE.tmp 3484 2B6B.tmp 1716 2C08.tmp 3920 2CA4.tmp 796 2D30.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F88F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 806C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B15F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 759F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 638E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 301E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ACD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 5252 2548 2026-08-27_fee04eda866a28380349d0d8e381cfea_elex_mafia.exe 89 PID 5252 wrote to memory of 5440 5252 371.tmp 90 PID 5440 wrote to memory of 5360 5440 48A.tmp 91 PID 5360 wrote to memory of 2712 5360 546.tmp 92 PID 2712 wrote to memory of 3924 2712 5F2.tmp 93 PID 3924 wrote to memory of 4644 3924 68E.tmp 94 PID 4644 wrote to memory of 4900 4644 749.tmp 95 PID 4900 wrote to memory of 4288 4900 7F5.tmp 96 PID 4288 wrote to memory of 2956 4288 90E.tmp 97 PID 2956 wrote to memory of 3696 2956 9F9.tmp 98 PID 3696 wrote to memory of 3876 3696 B41.tmp 99 PID 3876 wrote to memory of 5796 3876 C4B.tmp 100 PID 5796 wrote to memory of 2776 5796 D16.tmp 101 PID 2776 wrote to memory of 4804 2776 DB2.tmp 102 PID 4804 wrote to memory of 4128 4804 EAC.tmp 103 PID 4128 wrote to memory of 5524 4128 F29.tmp 104 PID 5524 wrote to memory of 6128 5524 1023.tmp 105 PID 6128 wrote to memory of 5656 6128 10FE.tmp 106 PID 5656 wrote to memory of 2876 5656 11AA.tmp 107 PID 2876 wrote to memory of 4944 2876 1294.tmp 108 PID 4944 wrote to memory of 988 4944 1340.tmp 109 PID 988 wrote to memory of 5640 988 13EC.tmp 110 PID 5640 wrote to memory of 240 5640 14A7.tmp 111 PID 240 wrote to memory of 4836 240 1572.tmp 112 PID 4836 wrote to memory of 4316 4836 165D.tmp 113 PID 4316 wrote to memory of 4800 4316 16F9.tmp 114 PID 4800 wrote to memory of 3372 4800 17F3.tmp 115 PID 3372 wrote to memory of 3596 3372 1860.tmp 116 PID 3596 wrote to memory of 4480 3596 193B.tmp 117 PID 4480 wrote to memory of 1120 4480 1A06.tmp 118 PID 1120 wrote to memory of 2044 1120 1AB2.tmp 119 PID 2044 wrote to memory of 3028 2044 1B5E.tmp 120 PID 3028 wrote to memory of 3292 3028 1C19.tmp 121 PID 3292 wrote to memory of 4224 3292 1CF4.tmp 122 PID 4224 wrote to memory of 4560 4224 1D62.tmp 123 PID 4560 wrote to memory of 1132 4560 1DEE.tmp 124 PID 1132 wrote to memory of 4328 1132 1E6B.tmp 125 PID 4328 wrote to memory of 1284 4328 1EF8.tmp 126 PID 1284 wrote to memory of 3216 1284 1F75.tmp 127 PID 3216 wrote to memory of 848 3216 1FF2.tmp 128 PID 848 wrote to memory of 1420 848 205F.tmp 129 PID 1420 wrote to memory of 3440 1420 20FB.tmp 130 PID 3440 wrote to memory of 5416 3440 2169.tmp 131 PID 5416 wrote to memory of 4216 5416 2215.tmp 132 PID 4216 wrote to memory of 4688 4216 22A1.tmp 133 PID 4688 wrote to memory of 4892 4688 231E.tmp 134 PID 4892 wrote to memory of 2104 4892 239B.tmp 135 PID 2104 wrote to memory of 1444 2104 2438.tmp 136 PID 1444 wrote to memory of 4452 1444 24C4.tmp 137 PID 4452 wrote to memory of 5904 4452 2551.tmp 138 PID 5904 wrote to memory of 4436 5904 25CE.tmp 139 PID 4436 wrote to memory of 3092 4436 265A.tmp 140 PID 3092 wrote to memory of 2708 3092 26F7.tmp 141 PID 2708 wrote to memory of 5808 2708 2783.tmp 142 PID 5808 wrote to memory of 1144 5808 2820.tmp 143 PID 1144 wrote to memory of 3132 1144 288D.tmp 144 PID 3132 wrote to memory of 5972 3132 290A.tmp 145 PID 5972 wrote to memory of 6008 5972 2977.tmp 146 PID 6008 wrote to memory of 1556 6008 2A04.tmp 147 PID 1556 wrote to memory of 5476 1556 2A71.tmp 148 PID 5476 wrote to memory of 3484 5476 2AEE.tmp 149 PID 3484 wrote to memory of 1716 3484 2B6B.tmp 150 PID 1716 wrote to memory of 3920 1716 2C08.tmp 151 PID 3920 wrote to memory of 796 3920 2CA4.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_fee04eda866a28380349d0d8e381cfea_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_fee04eda866a28380349d0d8e381cfea_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\5F2.tmp"C:\Users\Admin\AppData\Local\Temp\5F2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\B41.tmp"C:\Users\Admin\AppData\Local\Temp\B41.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\C4B.tmp"C:\Users\Admin\AppData\Local\Temp\C4B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\D16.tmp"C:\Users\Admin\AppData\Local\Temp\D16.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\DB2.tmp"C:\Users\Admin\AppData\Local\Temp\DB2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\10FE.tmp"C:\Users\Admin\AppData\Local\Temp\10FE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1340.tmp"C:\Users\Admin\AppData\Local\Temp\1340.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\165D.tmp"C:\Users\Admin\AppData\Local\Temp\165D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\16F9.tmp"C:\Users\Admin\AppData\Local\Temp\16F9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1D62.tmp"C:\Users\Admin\AppData\Local\Temp\1D62.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2169.tmp"C:\Users\Admin\AppData\Local\Temp\2169.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\2215.tmp"C:\Users\Admin\AppData\Local\Temp\2215.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\231E.tmp"C:\Users\Admin\AppData\Local\Temp\231E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\239B.tmp"C:\Users\Admin\AppData\Local\Temp\239B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\2438.tmp"C:\Users\Admin\AppData\Local\Temp\2438.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\265A.tmp"C:\Users\Admin\AppData\Local\Temp\265A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\2977.tmp"C:\Users\Admin\AppData\Local\Temp\2977.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\2A71.tmp"C:\Users\Admin\AppData\Local\Temp\2A71.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"65⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"66⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"67⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2E98.tmp"C:\Users\Admin\AppData\Local\Temp\2E98.tmp"68⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"70⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\301E.tmp"C:\Users\Admin\AppData\Local\Temp\301E.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"72⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"73⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"74⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"75⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\329F.tmp"C:\Users\Admin\AppData\Local\Temp\329F.tmp"76⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"77⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\33F7.tmp"C:\Users\Admin\AppData\Local\Temp\33F7.tmp"79⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\3474.tmp"C:\Users\Admin\AppData\Local\Temp\3474.tmp"80⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"81⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"82⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"83⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\3687.tmp"C:\Users\Admin\AppData\Local\Temp\3687.tmp"84⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\36F4.tmp"C:\Users\Admin\AppData\Local\Temp\36F4.tmp"85⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"86⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"87⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"88⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"89⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"90⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"91⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"C:\Users\Admin\AppData\Local\Temp\3ACD.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\3B4A.tmp"C:\Users\Admin\AppData\Local\Temp\3B4A.tmp"94⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"95⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"96⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"97⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"98⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"99⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"101⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"102⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"103⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"104⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"105⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\41F1.tmp"C:\Users\Admin\AppData\Local\Temp\41F1.tmp"107⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"108⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\42CC.tmp"C:\Users\Admin\AppData\Local\Temp\42CC.tmp"109⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"110⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"111⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"112⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"113⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"114⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\45AA.tmp"C:\Users\Admin\AppData\Local\Temp\45AA.tmp"115⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"116⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"117⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\4711.tmp"C:\Users\Admin\AppData\Local\Temp\4711.tmp"118⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"119⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"120⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\48A8.tmp"C:\Users\Admin\AppData\Local\Temp\48A8.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"122⤵PID:472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-