Analysis
- max time kernel
106s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 12:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe
- Size 564KB
- Sample261027-pcbcpacy9w
- SHA256 530150414daee54572c156381f41ebb9d78aafd4f9135b1234c89bea5723776e
- MD5 8d5a1d6d917d5d5e5c842dfd5a6bb5cc
- SHA1 c091e1236caccf36213806c8dbf73de3f86c61f6
- SHA512 bb35232462428f087ab2852a8bd9d67d197109767d441766c7e12fb440f4fa3ca91bbbc27ffaa7cb6aa20091fa21af11a3c441df2fba22fadbe1679835cf8b86
- SSDEEP 12288:qthBmvfNpW9QkOIQXwBIKQJc5PAGuwCSfnLt/vTZulH:qtKfe9QkruRKQCx5HCSf5/vTglH
- TLSH T1BAC4F122B544C532E6C202395E15EB925A3EBC750B3A94C33BD425BF2FB52E09376357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4184 C1E4.tmp 3332 C2AF.tmp 1872 C35B.tmp 2160 C3F7.tmp 2552 C4A3.tmp 5620 C52F.tmp 2768 C5BC.tmp 5960 C639.tmp 4548 C762.tmp 2532 C81D.tmp 3500 C8BA.tmp 4964 C937.tmp 3264 C9B4.tmp 4832 CA21.tmp 3824 CAAE.tmp 364 CB3A.tmp 3428 CBB7.tmp 940 CC54.tmp 3800 CCD1.tmp 4892 CD4E.tmp 4016 CDBB.tmp 2088 CE19.tmp 2564 CE86.tmp 1592 CF03.tmp 1284 CF80.tmp 3032 CFED.tmp 2192 D06A.tmp 5088 D107.tmp 1312 D193.tmp 4780 D210.tmp 4356 D27E.tmp 2208 D2EB.tmp 2840 D368.tmp 5736 D3D5.tmp 1288 D452.tmp 6040 D4C0.tmp 1152 D52D.tmp 3044 D59B.tmp 4916 D5F8.tmp 1596 D666.tmp 2112 D6D3.tmp 5788 D731.tmp 4824 D79E.tmp 2860 D80C.tmp 1908 D879.tmp 4972 D8E6.tmp 1528 D954.tmp 1884 D9C1.tmp 5044 DA2E.tmp 4620 DA9C.tmp 5596 DB09.tmp 3036 DB77.tmp 2444 DBE4.tmp 2896 DC51.tmp 1276 DCBF.tmp 4432 DD2C.tmp 2104 DD8A.tmp 1820 DDE8.tmp 2772 DE45.tmp 1432 DEA3.tmp 4204 DF01.tmp 6128 DF6E.tmp 3724 DFCC.tmp 4188 E02A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B26E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F98E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 390.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C35B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6335.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E29B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A56E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 351B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2EB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4184 4520 2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe 89 PID 4184 wrote to memory of 3332 4184 C1E4.tmp 90 PID 3332 wrote to memory of 1872 3332 C2AF.tmp 91 PID 1872 wrote to memory of 2160 1872 C35B.tmp 92 PID 2160 wrote to memory of 2552 2160 C3F7.tmp 93 PID 2552 wrote to memory of 5620 2552 C4A3.tmp 94 PID 5620 wrote to memory of 2768 5620 C52F.tmp 95 PID 2768 wrote to memory of 5960 2768 C5BC.tmp 96 PID 5960 wrote to memory of 4548 5960 C639.tmp 97 PID 4548 wrote to memory of 2532 4548 C762.tmp 98 PID 2532 wrote to memory of 3500 2532 C81D.tmp 99 PID 3500 wrote to memory of 4964 3500 C8BA.tmp 100 PID 4964 wrote to memory of 3264 4964 C937.tmp 101 PID 3264 wrote to memory of 4832 3264 C9B4.tmp 102 PID 4832 wrote to memory of 3824 4832 CA21.tmp 103 PID 3824 wrote to memory of 364 3824 CAAE.tmp 104 PID 364 wrote to memory of 3428 364 CB3A.tmp 105 PID 3428 wrote to memory of 940 3428 CBB7.tmp 106 PID 940 wrote to memory of 3800 940 CC54.tmp 107 PID 3800 wrote to memory of 4892 3800 CCD1.tmp 108 PID 4892 wrote to memory of 4016 4892 CD4E.tmp 109 PID 4016 wrote to memory of 2088 4016 CDBB.tmp 110 PID 2088 wrote to memory of 2564 2088 CE19.tmp 111 PID 2564 wrote to memory of 1592 2564 CE86.tmp 112 PID 1592 wrote to memory of 1284 1592 CF03.tmp 113 PID 1284 wrote to memory of 3032 1284 CF80.tmp 114 PID 3032 wrote to memory of 2192 3032 CFED.tmp 115 PID 2192 wrote to memory of 5088 2192 D06A.tmp 116 PID 5088 wrote to memory of 1312 5088 D107.tmp 117 PID 1312 wrote to memory of 4780 1312 D193.tmp 118 PID 4780 wrote to memory of 4356 4780 D210.tmp 119 PID 4356 wrote to memory of 2208 4356 D27E.tmp 120 PID 2208 wrote to memory of 2840 2208 D2EB.tmp 121 PID 2840 wrote to memory of 5736 2840 D368.tmp 122 PID 5736 wrote to memory of 1288 5736 D3D5.tmp 123 PID 1288 wrote to memory of 6040 1288 D452.tmp 124 PID 6040 wrote to memory of 1152 6040 D4C0.tmp 125 PID 1152 wrote to memory of 3044 1152 D52D.tmp 126 PID 3044 wrote to memory of 4916 3044 D59B.tmp 127 PID 4916 wrote to memory of 1596 4916 D5F8.tmp 128 PID 1596 wrote to memory of 2112 1596 D666.tmp 129 PID 2112 wrote to memory of 5788 2112 D6D3.tmp 130 PID 5788 wrote to memory of 4824 5788 D731.tmp 131 PID 4824 wrote to memory of 2860 4824 D79E.tmp 132 PID 2860 wrote to memory of 1908 2860 D80C.tmp 133 PID 1908 wrote to memory of 4972 1908 D879.tmp 134 PID 4972 wrote to memory of 1528 4972 D8E6.tmp 135 PID 1528 wrote to memory of 1884 1528 D954.tmp 136 PID 1884 wrote to memory of 5044 1884 D9C1.tmp 137 PID 5044 wrote to memory of 4620 5044 DA2E.tmp 138 PID 4620 wrote to memory of 5596 4620 DA9C.tmp 139 PID 5596 wrote to memory of 3036 5596 DB09.tmp 140 PID 3036 wrote to memory of 2444 3036 DB77.tmp 141 PID 2444 wrote to memory of 2896 2444 DBE4.tmp 142 PID 2896 wrote to memory of 1276 2896 DC51.tmp 143 PID 1276 wrote to memory of 4432 1276 DCBF.tmp 144 PID 4432 wrote to memory of 2104 4432 DD2C.tmp 145 PID 2104 wrote to memory of 1820 2104 DD8A.tmp 146 PID 1820 wrote to memory of 2772 1820 DDE8.tmp 147 PID 2772 wrote to memory of 1432 2772 DE45.tmp 148 PID 1432 wrote to memory of 4204 1432 DEA3.tmp 149 PID 4204 wrote to memory of 6128 4204 DF01.tmp 150 PID 6128 wrote to memory of 3724 6128 DF6E.tmp 151 PID 3724 wrote to memory of 4188 3724 DFCC.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_8d5a1d6d917d5d5e5c842dfd5a6bb5cc_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\C52F.tmp"C:\Users\Admin\AppData\Local\Temp\C52F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\C937.tmp"C:\Users\Admin\AppData\Local\Temp\C937.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\CF80.tmp"C:\Users\Admin\AppData\Local\Temp\CF80.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\D193.tmp"C:\Users\Admin\AppData\Local\Temp\D193.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\D210.tmp"C:\Users\Admin\AppData\Local\Temp\D210.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\D27E.tmp"C:\Users\Admin\AppData\Local\Temp\D27E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D731.tmp"C:\Users\Admin\AppData\Local\Temp\D731.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\D79E.tmp"C:\Users\Admin\AppData\Local\Temp\D79E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\DB09.tmp"C:\Users\Admin\AppData\Local\Temp\DB09.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\DB77.tmp"C:\Users\Admin\AppData\Local\Temp\DB77.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\DC51.tmp"C:\Users\Admin\AppData\Local\Temp\DC51.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"65⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\E087.tmp"C:\Users\Admin\AppData\Local\Temp\E087.tmp"66⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"67⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"68⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"69⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"70⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\E29B.tmp"C:\Users\Admin\AppData\Local\Temp\E29B.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\E308.tmp"C:\Users\Admin\AppData\Local\Temp\E308.tmp"72⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"73⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"74⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"76⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"77⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\E615.tmp"C:\Users\Admin\AppData\Local\Temp\E615.tmp"79⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"80⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"81⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"82⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"83⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\E819.tmp"C:\Users\Admin\AppData\Local\Temp\E819.tmp"84⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\E886.tmp"C:\Users\Admin\AppData\Local\Temp\E886.tmp"85⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\E8E4.tmp"C:\Users\Admin\AppData\Local\Temp\E8E4.tmp"86⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"87⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"88⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"89⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"90⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"91⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"92⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"93⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"94⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\Users\Admin\AppData\Local\Temp\ED0B.tmp"C:\Users\Admin\AppData\Local\Temp\ED0B.tmp"96⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"98⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"99⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"100⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"101⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"102⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"103⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\F047.tmp"C:\Users\Admin\AppData\Local\Temp\F047.tmp"104⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"105⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"106⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"107⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"108⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\F22B.tmp"C:\Users\Admin\AppData\Local\Temp\F22B.tmp"109⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"110⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"111⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"112⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"113⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"114⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"115⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"116⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\F529.tmp"C:\Users\Admin\AppData\Local\Temp\F529.tmp"117⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"118⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"119⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\F642.tmp"C:\Users\Admin\AppData\Local\Temp\F642.tmp"120⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"121⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-