Analysis
- max time kernel
121s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 17:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_bd1589b7db05b9490ba18927fb396313_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_bd1589b7db05b9490ba18927fb396313_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_bd1589b7db05b9490ba18927fb396313_elex_mafia.exe
- Size 560KB
- Sample260930-vjprjsshrd
- SHA256 4b0d79f902fdbef8b8c6b0d645bb5b73fb9a085cf219a57dd52b0b1f104abb10
- MD5 bd1589b7db05b9490ba18927fb396313
- SHA1 ef1f75a0492bfe378909ff5664d94595fbe69e13
- SHA512 9f27f8c7a88313e7f2764cf5d5cdb97a8459555a55be83e78bbbd5ed47bbe2c63cbb6c86470ffcd423956634f05ff0cd710257e1ba30d69993fdfa7d27171b6e
- SSDEEP 12288:MlFXOQUDmrC8SEs2xq5ul8F2alsQ2mcKHrcDp8cJIZxV:MlUQbC8Sfc4XqQ2gLctNJIR
- TLSH T189C4F1127584C073E68302318A26DBA11B7B7CB6472695C73BD4366EBFB43D1A67834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4384 FDA5.tmp 4824 FF2B.tmp 3180 64.tmp 2440 14E.tmp 4368 258.tmp 4416 342.tmp 4792 48A.tmp 2044 601.tmp 5892 769.tmp 5304 853.tmp 2632 92E.tmp 3112 A47.tmp 3316 B60.tmp 4648 C2B.tmp 3252 D54.tmp 4876 E8D.tmp 244 F96.tmp 1528 1090.tmp 4336 11C9.tmp 2364 12E2.tmp 3444 13BD.tmp 4496 14E6.tmp 5656 167C.tmp 1468 17A5.tmp 2576 189F.tmp 2336 19C8.tmp 4872 1B1F.tmp 5720 1C87.tmp 1692 1DBF.tmp 3572 1EE8.tmp 1684 1FE2.tmp 3268 20EC.tmp 2508 2253.tmp 4144 22EF.tmp 1068 23CA.tmp 4220 2476.tmp 2196 2580.tmp 2188 262C.tmp 6028 26C8.tmp 1836 2774.tmp 2244 2800.tmp 2172 28CB.tmp 3016 29A6.tmp 5392 2A81.tmp 704 2B4C.tmp 1600 2C27.tmp 5948 2D02.tmp 2132 2DDC.tmp 2892 2E69.tmp 4816 2F05.tmp 5312 2F82.tmp 5604 300F.tmp 3348 309B.tmp 3332 3147.tmp 3152 31C4.tmp 5952 3270.tmp 1332 32ED.tmp 5276 3399.tmp 4136 3426.tmp 4100 34D2.tmp 4980 355E.tmp 4112 35EB.tmp 4844 3677.tmp 4200 3704.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF69.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5320 wrote to memory of 4384 5320 2026-09-29_bd1589b7db05b9490ba18927fb396313_elex_mafia.exe 89 PID 4384 wrote to memory of 4824 4384 FDA5.tmp 90 PID 4824 wrote to memory of 3180 4824 FF2B.tmp 91 PID 3180 wrote to memory of 2440 3180 64.tmp 92 PID 2440 wrote to memory of 4368 2440 14E.tmp 93 PID 4368 wrote to memory of 4416 4368 258.tmp 94 PID 4416 wrote to memory of 4792 4416 342.tmp 95 PID 4792 wrote to memory of 2044 4792 48A.tmp 96 PID 2044 wrote to memory of 5892 2044 601.tmp 97 PID 5892 wrote to memory of 5304 5892 769.tmp 98 PID 5304 wrote to memory of 2632 5304 853.tmp 99 PID 2632 wrote to memory of 3112 2632 92E.tmp 100 PID 3112 wrote to memory of 3316 3112 A47.tmp 101 PID 3316 wrote to memory of 4648 3316 B60.tmp 102 PID 4648 wrote to memory of 3252 4648 C2B.tmp 103 PID 3252 wrote to memory of 4876 3252 D54.tmp 104 PID 4876 wrote to memory of 244 4876 E8D.tmp 105 PID 244 wrote to memory of 1528 244 F96.tmp 106 PID 1528 wrote to memory of 4336 1528 1090.tmp 107 PID 4336 wrote to memory of 2364 4336 11C9.tmp 108 PID 2364 wrote to memory of 3444 2364 12E2.tmp 109 PID 3444 wrote to memory of 4496 3444 13BD.tmp 110 PID 4496 wrote to memory of 5656 4496 14E6.tmp 111 PID 5656 wrote to memory of 1468 5656 167C.tmp 112 PID 1468 wrote to memory of 2576 1468 17A5.tmp 113 PID 2576 wrote to memory of 2336 2576 189F.tmp 114 PID 2336 wrote to memory of 4872 2336 19C8.tmp 115 PID 4872 wrote to memory of 5720 4872 1B1F.tmp 116 PID 5720 wrote to memory of 1692 5720 1C87.tmp 117 PID 1692 wrote to memory of 3572 1692 1DBF.tmp 118 PID 3572 wrote to memory of 1684 3572 1EE8.tmp 119 PID 1684 wrote to memory of 3268 1684 1FE2.tmp 120 PID 3268 wrote to memory of 2508 3268 20EC.tmp 121 PID 2508 wrote to memory of 4144 2508 2253.tmp 122 PID 4144 wrote to memory of 1068 4144 22EF.tmp 123 PID 1068 wrote to memory of 4220 1068 23CA.tmp 124 PID 4220 wrote to memory of 2196 4220 2476.tmp 125 PID 2196 wrote to memory of 2188 2196 2580.tmp 126 PID 2188 wrote to memory of 6028 2188 262C.tmp 127 PID 6028 wrote to memory of 1836 6028 26C8.tmp 128 PID 1836 wrote to memory of 2244 1836 2774.tmp 129 PID 2244 wrote to memory of 2172 2244 2800.tmp 130 PID 2172 wrote to memory of 3016 2172 28CB.tmp 131 PID 3016 wrote to memory of 5392 3016 29A6.tmp 132 PID 5392 wrote to memory of 704 5392 2A81.tmp 133 PID 704 wrote to memory of 1600 704 2B4C.tmp 134 PID 1600 wrote to memory of 5948 1600 2C27.tmp 135 PID 5948 wrote to memory of 2132 5948 2D02.tmp 136 PID 2132 wrote to memory of 2892 2132 2DDC.tmp 137 PID 2892 wrote to memory of 4816 2892 2E69.tmp 138 PID 4816 wrote to memory of 5312 4816 2F05.tmp 139 PID 5312 wrote to memory of 5604 5312 2F82.tmp 140 PID 5604 wrote to memory of 3348 5604 300F.tmp 141 PID 3348 wrote to memory of 3332 3348 309B.tmp 142 PID 3332 wrote to memory of 3152 3332 3147.tmp 143 PID 3152 wrote to memory of 5952 3152 31C4.tmp 144 PID 5952 wrote to memory of 1332 5952 3270.tmp 145 PID 1332 wrote to memory of 5276 1332 32ED.tmp 146 PID 5276 wrote to memory of 4136 5276 3399.tmp 147 PID 4136 wrote to memory of 4100 4136 3426.tmp 148 PID 4100 wrote to memory of 4980 4100 34D2.tmp 149 PID 4980 wrote to memory of 4112 4980 355E.tmp 150 PID 4112 wrote to memory of 4844 4112 35EB.tmp 151 PID 4844 wrote to memory of 4200 4844 3677.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_bd1589b7db05b9490ba18927fb396313_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_bd1589b7db05b9490ba18927fb396313_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\64.tmp"C:\Users\Admin\AppData\Local\Temp\64.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\342.tmp"C:\Users\Admin\AppData\Local\Temp\342.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\769.tmp"C:\Users\Admin\AppData\Local\Temp\769.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\F96.tmp"C:\Users\Admin\AppData\Local\Temp\F96.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\167C.tmp"C:\Users\Admin\AppData\Local\Temp\167C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\1FE2.tmp"C:\Users\Admin\AppData\Local\Temp\1FE2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\20EC.tmp"C:\Users\Admin\AppData\Local\Temp\20EC.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\2774.tmp"C:\Users\Admin\AppData\Local\Temp\2774.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\28CB.tmp"C:\Users\Admin\AppData\Local\Temp\28CB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\29A6.tmp"C:\Users\Admin\AppData\Local\Temp\29A6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2C27.tmp"C:\Users\Admin\AppData\Local\Temp\2C27.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2D02.tmp"C:\Users\Admin\AppData\Local\Temp\2D02.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2F05.tmp"C:\Users\Admin\AppData\Local\Temp\2F05.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\2F82.tmp"C:\Users\Admin\AppData\Local\Temp\2F82.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\300F.tmp"C:\Users\Admin\AppData\Local\Temp\300F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\3426.tmp"C:\Users\Admin\AppData\Local\Temp\3426.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\355E.tmp"C:\Users\Admin\AppData\Local\Temp\355E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\35EB.tmp"C:\Users\Admin\AppData\Local\Temp\35EB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"65⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"66⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"67⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"68⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"69⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"70⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"71⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"72⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"73⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"74⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"75⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"76⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"77⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"78⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"79⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"80⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"81⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"82⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"83⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"84⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"85⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"86⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\4414.tmp"C:\Users\Admin\AppData\Local\Temp\4414.tmp"87⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"88⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"89⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"90⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\4685.tmp"C:\Users\Admin\AppData\Local\Temp\4685.tmp"91⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4711.tmp"C:\Users\Admin\AppData\Local\Temp\4711.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"93⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"94⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\48E6.tmp"C:\Users\Admin\AppData\Local\Temp\48E6.tmp"95⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"96⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"97⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"98⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"99⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"100⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"101⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"102⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"104⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"105⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"106⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"107⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"108⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"109⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"110⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\520E.tmp"C:\Users\Admin\AppData\Local\Temp\520E.tmp"111⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\52BA.tmp"C:\Users\Admin\AppData\Local\Temp\52BA.tmp"112⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\5346.tmp"C:\Users\Admin\AppData\Local\Temp\5346.tmp"113⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\53E3.tmp"C:\Users\Admin\AppData\Local\Temp\53E3.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\548F.tmp"C:\Users\Admin\AppData\Local\Temp\548F.tmp"115⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\553A.tmp"C:\Users\Admin\AppData\Local\Temp\553A.tmp"116⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\55E6.tmp"C:\Users\Admin\AppData\Local\Temp\55E6.tmp"117⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"118⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\571F.tmp"C:\Users\Admin\AppData\Local\Temp\571F.tmp"119⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"120⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\5867.tmp"C:\Users\Admin\AppData\Local\Temp\5867.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:620 -
C:\Users\Admin\AppData\Local\Temp\58F4.tmp"C:\Users\Admin\AppData\Local\Temp\58F4.tmp"122⤵PID:3612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-