Analysis
- max time kernel
134s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/08/2026, 18:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_455eaed836c69b48cde73e479c93c156_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_455eaed836c69b48cde73e479c93c156_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-27_455eaed836c69b48cde73e479c93c156_elex_mafia.exe
- Size 581KB
- Sample260827-xcp5vacq21
- SHA256 426150f937fa4d41648b639f0e3e739639fc24929650d44b09f12e19fde99051
- MD5 455eaed836c69b48cde73e479c93c156
- SHA1 0b4c98650c6049b6226413be76cf33f9f819253e
- SHA512 ff2013273a2ff9cb6502a7bec2853603ad41f8761f8ded089d7292d37c50edaf98b7946849d79e3f5a9bb20a5b2bd5da27725f52aa0c1231909f0a37792ee62d
- SSDEEP 12288:yZ355mztdeUIu+91Cilv7jkGM6d3sgBKhtXx42umeSAqZoXWjdqW:yZ3qzaUIn1llv7jkGPdcnXx+qqGhT
- TLSH T135C4F111B586C036E5E346344A69EBA6587B7C334B3698CF3BD4266E6FB02D09336307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2448 2495.tmp 3548 2551.tmp 2244 260C.tmp 1672 26E7.tmp 2440 2793.tmp 4924 288D.tmp 2156 2929.tmp 2636 29D5.tmp 5820 2ADF.tmp 2404 2BAA.tmp 2596 2C36.tmp 580 2CA4.tmp 4248 2D40.tmp 5784 2DEC.tmp 5460 2E79.tmp 3328 2F53.tmp 1616 303E.tmp 400 3128.tmp 3308 31B5.tmp 4140 3261.tmp 2784 32DE.tmp 4556 33A9.tmp 2408 3455.tmp 5692 3500.tmp 2684 35DB.tmp 1076 36C6.tmp 1496 3762.tmp 5580 382D.tmp 3572 38F8.tmp 596 39D3.tmp 1472 3A8E.tmp 4152 3B2B.tmp 2888 3C05.tmp 1232 3CA2.tmp 5444 3D1F.tmp 3596 3DAB.tmp 1532 3E47.tmp 4184 3EE4.tmp 3768 3F70.tmp 2840 3FED.tmp 4284 408A.tmp 1164 4107.tmp 5496 4193.tmp 4544 4210.tmp 6024 42AC.tmp 5180 4339.tmp 3780 43B6.tmp 5856 4433.tmp 6128 44C0.tmp 2996 453D.tmp 2492 45AA.tmp 2100 4637.tmp 5520 46E3.tmp 3104 4760.tmp 1352 47FC.tmp 4812 4888.tmp 5748 4915.tmp 2928 49B1.tmp 5620 4A2E.tmp 3248 4ABB.tmp 4936 4B67.tmp 1112 4BD4.tmp 1740 4C42.tmp 5700 4CBF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3261.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 382D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 810D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 288D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B50E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 924E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F37E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 900C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9810.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 2448 4588 2026-08-27_455eaed836c69b48cde73e479c93c156_elex_mafia.exe 89 PID 2448 wrote to memory of 3548 2448 2495.tmp 90 PID 3548 wrote to memory of 2244 3548 2551.tmp 91 PID 2244 wrote to memory of 1672 2244 260C.tmp 92 PID 1672 wrote to memory of 2440 1672 26E7.tmp 93 PID 2440 wrote to memory of 4924 2440 2793.tmp 94 PID 4924 wrote to memory of 2156 4924 288D.tmp 95 PID 2156 wrote to memory of 2636 2156 2929.tmp 96 PID 2636 wrote to memory of 5820 2636 29D5.tmp 97 PID 5820 wrote to memory of 2404 5820 2ADF.tmp 98 PID 2404 wrote to memory of 2596 2404 2BAA.tmp 99 PID 2596 wrote to memory of 580 2596 2C36.tmp 100 PID 580 wrote to memory of 4248 580 2CA4.tmp 101 PID 4248 wrote to memory of 5784 4248 2D40.tmp 102 PID 5784 wrote to memory of 5460 5784 2DEC.tmp 103 PID 5460 wrote to memory of 3328 5460 2E79.tmp 104 PID 3328 wrote to memory of 1616 3328 2F53.tmp 105 PID 1616 wrote to memory of 400 1616 303E.tmp 106 PID 400 wrote to memory of 3308 400 3128.tmp 107 PID 3308 wrote to memory of 4140 3308 31B5.tmp 108 PID 4140 wrote to memory of 2784 4140 3261.tmp 109 PID 2784 wrote to memory of 4556 2784 32DE.tmp 110 PID 4556 wrote to memory of 2408 4556 33A9.tmp 111 PID 2408 wrote to memory of 5692 2408 3455.tmp 112 PID 5692 wrote to memory of 2684 5692 3500.tmp 113 PID 2684 wrote to memory of 1076 2684 35DB.tmp 114 PID 1076 wrote to memory of 1496 1076 36C6.tmp 115 PID 1496 wrote to memory of 5580 1496 3762.tmp 116 PID 5580 wrote to memory of 3572 5580 382D.tmp 117 PID 3572 wrote to memory of 596 3572 38F8.tmp 118 PID 596 wrote to memory of 1472 596 39D3.tmp 119 PID 1472 wrote to memory of 4152 1472 3A8E.tmp 120 PID 4152 wrote to memory of 2888 4152 3B2B.tmp 121 PID 2888 wrote to memory of 1232 2888 3C05.tmp 122 PID 1232 wrote to memory of 5444 1232 3CA2.tmp 123 PID 5444 wrote to memory of 3596 5444 3D1F.tmp 124 PID 3596 wrote to memory of 1532 3596 3DAB.tmp 125 PID 1532 wrote to memory of 4184 1532 3E47.tmp 126 PID 4184 wrote to memory of 3768 4184 3EE4.tmp 127 PID 3768 wrote to memory of 2840 3768 3F70.tmp 128 PID 2840 wrote to memory of 4284 2840 3FED.tmp 129 PID 4284 wrote to memory of 1164 4284 408A.tmp 130 PID 1164 wrote to memory of 5496 1164 4107.tmp 131 PID 5496 wrote to memory of 4544 5496 4193.tmp 132 PID 4544 wrote to memory of 6024 4544 4210.tmp 133 PID 6024 wrote to memory of 5180 6024 42AC.tmp 134 PID 5180 wrote to memory of 3780 5180 4339.tmp 135 PID 3780 wrote to memory of 5856 3780 43B6.tmp 136 PID 5856 wrote to memory of 6128 5856 4433.tmp 137 PID 6128 wrote to memory of 2996 6128 44C0.tmp 138 PID 2996 wrote to memory of 2492 2996 453D.tmp 139 PID 2492 wrote to memory of 2100 2492 45AA.tmp 140 PID 2100 wrote to memory of 5520 2100 4637.tmp 141 PID 5520 wrote to memory of 3104 5520 46E3.tmp 142 PID 3104 wrote to memory of 1352 3104 4760.tmp 143 PID 1352 wrote to memory of 4812 1352 47FC.tmp 144 PID 4812 wrote to memory of 5748 4812 4888.tmp 145 PID 5748 wrote to memory of 2928 5748 4915.tmp 146 PID 2928 wrote to memory of 5620 2928 49B1.tmp 147 PID 5620 wrote to memory of 3248 5620 4A2E.tmp 148 PID 3248 wrote to memory of 4936 3248 4ABB.tmp 149 PID 4936 wrote to memory of 1112 4936 4B67.tmp 150 PID 1112 wrote to memory of 1740 1112 4BD4.tmp 151 PID 1740 wrote to memory of 5700 1740 4C42.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_455eaed836c69b48cde73e479c93c156_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_455eaed836c69b48cde73e479c93c156_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2929.tmp"C:\Users\Admin\AppData\Local\Temp\2929.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\29D5.tmp"C:\Users\Admin\AppData\Local\Temp\29D5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2C36.tmp"C:\Users\Admin\AppData\Local\Temp\2C36.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\2E79.tmp"C:\Users\Admin\AppData\Local\Temp\2E79.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\2F53.tmp"C:\Users\Admin\AppData\Local\Temp\2F53.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\33A9.tmp"C:\Users\Admin\AppData\Local\Temp\33A9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3455.tmp"C:\Users\Admin\AppData\Local\Temp\3455.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\38F8.tmp"C:\Users\Admin\AppData\Local\Temp\38F8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\3E47.tmp"C:\Users\Admin\AppData\Local\Temp\3E47.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\4107.tmp"C:\Users\Admin\AppData\Local\Temp\4107.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\4210.tmp"C:\Users\Admin\AppData\Local\Temp\4210.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\45AA.tmp"C:\Users\Admin\AppData\Local\Temp\45AA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\46E3.tmp"C:\Users\Admin\AppData\Local\Temp\46E3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"65⤵
- Executes dropped EXE
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"66⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"67⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"68⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"69⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"71⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"72⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\50F5.tmp"C:\Users\Admin\AppData\Local\Temp\50F5.tmp"73⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\51EF.tmp"C:\Users\Admin\AppData\Local\Temp\51EF.tmp"75⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"76⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"77⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"78⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"79⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\549E.tmp"C:\Users\Admin\AppData\Local\Temp\549E.tmp"80⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\553A.tmp"C:\Users\Admin\AppData\Local\Temp\553A.tmp"81⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"82⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"83⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\56B1.tmp"C:\Users\Admin\AppData\Local\Temp\56B1.tmp"84⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"85⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\57AB.tmp"C:\Users\Admin\AppData\Local\Temp\57AB.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5828.tmp"C:\Users\Admin\AppData\Local\Temp\5828.tmp"87⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\58B5.tmp"C:\Users\Admin\AppData\Local\Temp\58B5.tmp"88⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\5961.tmp"C:\Users\Admin\AppData\Local\Temp\5961.tmp"89⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"90⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"91⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"92⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"93⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\5BB3.tmp"C:\Users\Admin\AppData\Local\Temp\5BB3.tmp"94⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"95⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"96⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\5D49.tmp"C:\Users\Admin\AppData\Local\Temp\5D49.tmp"97⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"98⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\5E53.tmp"C:\Users\Admin\AppData\Local\Temp\5E53.tmp"99⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"100⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"102⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6075.tmp"C:\Users\Admin\AppData\Local\Temp\6075.tmp"103⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"104⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"105⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"106⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"107⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"108⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\63A2.tmp"C:\Users\Admin\AppData\Local\Temp\63A2.tmp"109⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"110⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"111⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"112⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"113⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"114⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"115⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"116⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\67E8.tmp"C:\Users\Admin\AppData\Local\Temp\67E8.tmp"117⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\6884.tmp"C:\Users\Admin\AppData\Local\Temp\6884.tmp"118⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6920.tmp"C:\Users\Admin\AppData\Local\Temp\6920.tmp"119⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"120⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"121⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-