Analysis
- max time kernel
121s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-20_f4bbe83db9cf8298c7bd88219b0a7496_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-20_f4bbe83db9cf8298c7bd88219b0a7496_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-20_f4bbe83db9cf8298c7bd88219b0a7496_elex_mafia.exe
- Size 560KB
- Sample260920-2dcclafj2v
- SHA256 a0261b9bbe0d406e5db75c547b467d55e7003a6f97577053a28408fdf4f9f5dc
- MD5 f4bbe83db9cf8298c7bd88219b0a7496
- SHA1 05054ed633255fabcf66bb1e0951e19be898e04c
- SHA512 0adec0c0e673358530d51d2460ee135271c9f0e4a3a7f8f819ef0e830767b924d27e867f51d1d3f66093c832373cc7062bbaea0251e3dd8df909cae324d130dd
- SSDEEP 12288:MlFXOQUDmrC8SHmke34Pg2E3M6JidVwXDAEKqopIZxV:MlUQbC8SGku8O3+DwXU77pIR
- TLSH T170C4F0223648C073E29211348A12DBA15B7F7C355B2AA5D737D0366EAFB52D1DB3834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4852 1DCA.tmp 3100 1EF3.tmp 3696 201C.tmp 3244 20E7.tmp 4908 222F.tmp 1888 229D.tmp 5964 22FA.tmp 3976 2423.tmp 5400 24FE.tmp 4776 25C9.tmp 5032 26B3.tmp 5836 278E.tmp 4276 284A.tmp 4300 2905.tmp 5696 29E0.tmp 4244 2AEA.tmp 4672 2BD4.tmp 5988 2C9F.tmp 5780 2D7A.tmp 1216 2E64.tmp 3308 2F20.tmp 2736 2FEB.tmp 5592 30B6.tmp 6140 3171.tmp 752 326B.tmp 4088 3375.tmp 1680 347F.tmp 1468 3588.tmp 3484 36B1.tmp 3416 378C.tmp 4368 3867.tmp 4512 3961.tmp 468 3A8A.tmp 5028 3B55.tmp 5004 3BF1.tmp 2708 3CBC.tmp 2468 3D49.tmp 5372 3DC6.tmp 2348 3E81.tmp 5952 3F2D.tmp 4200 3FD9.tmp 4324 4094.tmp 3312 416F.tmp 3392 420B.tmp 3620 42E6.tmp 4552 43B1.tmp 5672 445D.tmp 4080 44F9.tmp 4580 4596.tmp 844 45F3.tmp 4256 4670.tmp 5364 46DE.tmp 5924 474B.tmp 5692 47C8.tmp 4888 4845.tmp 2828 48D2.tmp 4084 494F.tmp 4196 49DB.tmp 3056 4A68.tmp 5792 4AD5.tmp 924 4B43.tmp 5216 4BA1.tmp 4448 4C0E.tmp 2200 4C8B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E87D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 581F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 294F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 326B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 201C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42E6.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4668 wrote to memory of 4852 4668 2026-09-20_f4bbe83db9cf8298c7bd88219b0a7496_elex_mafia.exe 90 PID 4852 wrote to memory of 3100 4852 1DCA.tmp 91 PID 3100 wrote to memory of 3696 3100 1EF3.tmp 92 PID 3696 wrote to memory of 3244 3696 201C.tmp 93 PID 3244 wrote to memory of 4908 3244 20E7.tmp 94 PID 4908 wrote to memory of 1888 4908 222F.tmp 95 PID 1888 wrote to memory of 5964 1888 229D.tmp 96 PID 5964 wrote to memory of 3976 5964 22FA.tmp 97 PID 3976 wrote to memory of 5400 3976 2423.tmp 98 PID 5400 wrote to memory of 4776 5400 24FE.tmp 99 PID 4776 wrote to memory of 5032 4776 25C9.tmp 100 PID 5032 wrote to memory of 5836 5032 26B3.tmp 101 PID 5836 wrote to memory of 4276 5836 278E.tmp 102 PID 4276 wrote to memory of 4300 4276 284A.tmp 103 PID 4300 wrote to memory of 5696 4300 2905.tmp 104 PID 5696 wrote to memory of 4244 5696 29E0.tmp 105 PID 4244 wrote to memory of 4672 4244 2AEA.tmp 106 PID 4672 wrote to memory of 5988 4672 2BD4.tmp 107 PID 5988 wrote to memory of 5780 5988 2C9F.tmp 108 PID 5780 wrote to memory of 1216 5780 2D7A.tmp 109 PID 1216 wrote to memory of 3308 1216 2E64.tmp 110 PID 3308 wrote to memory of 2736 3308 2F20.tmp 111 PID 2736 wrote to memory of 5592 2736 2FEB.tmp 112 PID 5592 wrote to memory of 6140 5592 30B6.tmp 113 PID 6140 wrote to memory of 752 6140 3171.tmp 114 PID 752 wrote to memory of 4088 752 326B.tmp 115 PID 4088 wrote to memory of 1680 4088 3375.tmp 116 PID 1680 wrote to memory of 1468 1680 347F.tmp 117 PID 1468 wrote to memory of 3484 1468 3588.tmp 118 PID 3484 wrote to memory of 3416 3484 36B1.tmp 119 PID 3416 wrote to memory of 4368 3416 378C.tmp 120 PID 4368 wrote to memory of 4512 4368 3867.tmp 121 PID 4512 wrote to memory of 468 4512 3961.tmp 123 PID 468 wrote to memory of 5028 468 3A8A.tmp 124 PID 5028 wrote to memory of 5004 5028 3B55.tmp 125 PID 5004 wrote to memory of 2708 5004 3BF1.tmp 126 PID 2708 wrote to memory of 2468 2708 3CBC.tmp 127 PID 2468 wrote to memory of 5372 2468 3D49.tmp 128 PID 5372 wrote to memory of 2348 5372 3DC6.tmp 129 PID 2348 wrote to memory of 5952 2348 3E81.tmp 130 PID 5952 wrote to memory of 4200 5952 3F2D.tmp 131 PID 4200 wrote to memory of 4324 4200 3FD9.tmp 132 PID 4324 wrote to memory of 3312 4324 4094.tmp 133 PID 3312 wrote to memory of 3392 3312 416F.tmp 134 PID 3392 wrote to memory of 3620 3392 420B.tmp 135 PID 3620 wrote to memory of 4552 3620 42E6.tmp 136 PID 4552 wrote to memory of 5672 4552 43B1.tmp 137 PID 5672 wrote to memory of 4080 5672 445D.tmp 138 PID 4080 wrote to memory of 4580 4080 44F9.tmp 139 PID 4580 wrote to memory of 844 4580 4596.tmp 140 PID 844 wrote to memory of 4256 844 45F3.tmp 141 PID 4256 wrote to memory of 5364 4256 4670.tmp 142 PID 5364 wrote to memory of 5924 5364 46DE.tmp 143 PID 5924 wrote to memory of 5692 5924 474B.tmp 144 PID 5692 wrote to memory of 4888 5692 47C8.tmp 145 PID 4888 wrote to memory of 2828 4888 4845.tmp 146 PID 2828 wrote to memory of 4084 2828 48D2.tmp 147 PID 4084 wrote to memory of 4196 4084 494F.tmp 148 PID 4196 wrote to memory of 3056 4196 49DB.tmp 149 PID 3056 wrote to memory of 5792 3056 4A68.tmp 150 PID 5792 wrote to memory of 924 5792 4AD5.tmp 151 PID 924 wrote to memory of 5216 924 4B43.tmp 152 PID 5216 wrote to memory of 4448 5216 4BA1.tmp 153 PID 4448 wrote to memory of 2200 4448 4C0E.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-20_f4bbe83db9cf8298c7bd88219b0a7496_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-20_f4bbe83db9cf8298c7bd88219b0a7496_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\201C.tmp"C:\Users\Admin\AppData\Local\Temp\201C.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\222F.tmp"C:\Users\Admin\AppData\Local\Temp\222F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\229D.tmp"C:\Users\Admin\AppData\Local\Temp\229D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\2423.tmp"C:\Users\Admin\AppData\Local\Temp\2423.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\278E.tmp"C:\Users\Admin\AppData\Local\Temp\278E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\284A.tmp"C:\Users\Admin\AppData\Local\Temp\284A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2905.tmp"C:\Users\Admin\AppData\Local\Temp\2905.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"C:\Users\Admin\AppData\Local\Temp\2C9F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\30B6.tmp"C:\Users\Admin\AppData\Local\Temp\30B6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\3171.tmp"C:\Users\Admin\AppData\Local\Temp\3171.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\326B.tmp"C:\Users\Admin\AppData\Local\Temp\326B.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3375.tmp"C:\Users\Admin\AppData\Local\Temp\3375.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3588.tmp"C:\Users\Admin\AppData\Local\Temp\3588.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\378C.tmp"C:\Users\Admin\AppData\Local\Temp\378C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3867.tmp"C:\Users\Admin\AppData\Local\Temp\3867.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\3961.tmp"C:\Users\Admin\AppData\Local\Temp\3961.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3B55.tmp"C:\Users\Admin\AppData\Local\Temp\3B55.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"C:\Users\Admin\AppData\Local\Temp\3CBC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3D49.tmp"C:\Users\Admin\AppData\Local\Temp\3D49.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\3DC6.tmp"C:\Users\Admin\AppData\Local\Temp\3DC6.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\3E81.tmp"C:\Users\Admin\AppData\Local\Temp\3E81.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3F2D.tmp"C:\Users\Admin\AppData\Local\Temp\3F2D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\3FD9.tmp"C:\Users\Admin\AppData\Local\Temp\3FD9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4094.tmp"C:\Users\Admin\AppData\Local\Temp\4094.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\416F.tmp"C:\Users\Admin\AppData\Local\Temp\416F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\420B.tmp"C:\Users\Admin\AppData\Local\Temp\420B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\43B1.tmp"C:\Users\Admin\AppData\Local\Temp\43B1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\445D.tmp"C:\Users\Admin\AppData\Local\Temp\445D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\44F9.tmp"C:\Users\Admin\AppData\Local\Temp\44F9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\4596.tmp"C:\Users\Admin\AppData\Local\Temp\4596.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\45F3.tmp"C:\Users\Admin\AppData\Local\Temp\45F3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\4670.tmp"C:\Users\Admin\AppData\Local\Temp\4670.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\46DE.tmp"C:\Users\Admin\AppData\Local\Temp\46DE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\474B.tmp"C:\Users\Admin\AppData\Local\Temp\474B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\47C8.tmp"C:\Users\Admin\AppData\Local\Temp\47C8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\4845.tmp"C:\Users\Admin\AppData\Local\Temp\4845.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\48D2.tmp"C:\Users\Admin\AppData\Local\Temp\48D2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\494F.tmp"C:\Users\Admin\AppData\Local\Temp\494F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\49DB.tmp"C:\Users\Admin\AppData\Local\Temp\49DB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4C8B.tmp"C:\Users\Admin\AppData\Local\Temp\4C8B.tmp"65⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"67⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\4E02.tmp"C:\Users\Admin\AppData\Local\Temp\4E02.tmp"68⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\4E6F.tmp"C:\Users\Admin\AppData\Local\Temp\4E6F.tmp"69⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"70⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\4F79.tmp"C:\Users\Admin\AppData\Local\Temp\4F79.tmp"71⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"72⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\5054.tmp"C:\Users\Admin\AppData\Local\Temp\5054.tmp"73⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\50E0.tmp"C:\Users\Admin\AppData\Local\Temp\50E0.tmp"74⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\514E.tmp"C:\Users\Admin\AppData\Local\Temp\514E.tmp"75⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\51BB.tmp"C:\Users\Admin\AppData\Local\Temp\51BB.tmp"76⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\5238.tmp"C:\Users\Admin\AppData\Local\Temp\5238.tmp"77⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\52C5.tmp"C:\Users\Admin\AppData\Local\Temp\52C5.tmp"78⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\5332.tmp"C:\Users\Admin\AppData\Local\Temp\5332.tmp"79⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\53BF.tmp"C:\Users\Admin\AppData\Local\Temp\53BF.tmp"80⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\543C.tmp"C:\Users\Admin\AppData\Local\Temp\543C.tmp"81⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\54B9.tmp"C:\Users\Admin\AppData\Local\Temp\54B9.tmp"82⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\5536.tmp"C:\Users\Admin\AppData\Local\Temp\5536.tmp"83⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\55A3.tmp"C:\Users\Admin\AppData\Local\Temp\55A3.tmp"84⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\5620.tmp"C:\Users\Admin\AppData\Local\Temp\5620.tmp"85⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\567E.tmp"C:\Users\Admin\AppData\Local\Temp\567E.tmp"86⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\570A.tmp"C:\Users\Admin\AppData\Local\Temp\570A.tmp"87⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\5797.tmp"C:\Users\Admin\AppData\Local\Temp\5797.tmp"88⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\5824.tmp"C:\Users\Admin\AppData\Local\Temp\5824.tmp"89⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\5891.tmp"C:\Users\Admin\AppData\Local\Temp\5891.tmp"90⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\591E.tmp"C:\Users\Admin\AppData\Local\Temp\591E.tmp"91⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\599B.tmp"C:\Users\Admin\AppData\Local\Temp\599B.tmp"92⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\5A08.tmp"C:\Users\Admin\AppData\Local\Temp\5A08.tmp"93⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\5A75.tmp"C:\Users\Admin\AppData\Local\Temp\5A75.tmp"94⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\5AF2.tmp"C:\Users\Admin\AppData\Local\Temp\5AF2.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:400 -
C:\Users\Admin\AppData\Local\Temp\5B8F.tmp"C:\Users\Admin\AppData\Local\Temp\5B8F.tmp"96⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"97⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\5C79.tmp"C:\Users\Admin\AppData\Local\Temp\5C79.tmp"98⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"99⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\5D73.tmp"C:\Users\Admin\AppData\Local\Temp\5D73.tmp"100⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\5DF0.tmp"C:\Users\Admin\AppData\Local\Temp\5DF0.tmp"101⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5E6D.tmp"C:\Users\Admin\AppData\Local\Temp\5E6D.tmp"102⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5F86.tmp"C:\Users\Admin\AppData\Local\Temp\5F86.tmp"104⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6003.tmp"C:\Users\Admin\AppData\Local\Temp\6003.tmp"105⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6071.tmp"C:\Users\Admin\AppData\Local\Temp\6071.tmp"106⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\60FD.tmp"C:\Users\Admin\AppData\Local\Temp\60FD.tmp"107⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\616B.tmp"C:\Users\Admin\AppData\Local\Temp\616B.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\61D8.tmp"C:\Users\Admin\AppData\Local\Temp\61D8.tmp"109⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\6236.tmp"C:\Users\Admin\AppData\Local\Temp\6236.tmp"110⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\62A3.tmp"C:\Users\Admin\AppData\Local\Temp\62A3.tmp"111⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\6320.tmp"C:\Users\Admin\AppData\Local\Temp\6320.tmp"112⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\639D.tmp"C:\Users\Admin\AppData\Local\Temp\639D.tmp"113⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\641A.tmp"C:\Users\Admin\AppData\Local\Temp\641A.tmp"114⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\6497.tmp"C:\Users\Admin\AppData\Local\Temp\6497.tmp"115⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\6505.tmp"C:\Users\Admin\AppData\Local\Temp\6505.tmp"116⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\6591.tmp"C:\Users\Admin\AppData\Local\Temp\6591.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\65FF.tmp"C:\Users\Admin\AppData\Local\Temp\65FF.tmp"118⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\667C.tmp"C:\Users\Admin\AppData\Local\Temp\667C.tmp"119⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\66F9.tmp"C:\Users\Admin\AppData\Local\Temp\66F9.tmp"120⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6766.tmp"C:\Users\Admin\AppData\Local\Temp\6766.tmp"121⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\67F3.tmp"C:\Users\Admin\AppData\Local\Temp\67F3.tmp"122⤵PID:3368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-