Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_6b447a5c8dcd857b2e0e349862aa028c_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_6b447a5c8dcd857b2e0e349862aa028c_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-26_6b447a5c8dcd857b2e0e349862aa028c_elex_mafia.exe
- Size 561KB
- Sample261027-sl4mdavvav
- SHA256 3e4841b15d3900d7f48c516365fafe20947dc5813b2f417d0cb06681fafe7a5c
- MD5 6b447a5c8dcd857b2e0e349862aa028c
- SHA1 6c5529a7d2c4ba8b2c7db694574226664efc7de3
- SHA512 173f6f2194c26bcb8e5633af9cca4298dbb94fe0c59465f8ba1c41268eff7c9aed78afa95cae52ee8c3a33723cdca3cddd88760a7fdb0ac0ac1340302e03fc15
- SSDEEP 12288:URJ5mbNleTR01Mlb2dC/u4yQBdi3I+y8ar2IzoztDZuL:URqbCT+16eC/u+ed9UaDoL
- TLSH T170C4DF10B6D98432F2B31A354AF196614A3B7D215B32D8CF238423AE6EF17D0DA75B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5896 FA88.tmp 5356 FB34.tmp 4188 FBFF.tmp 1820 FCE9.tmp 5876 FDB4.tmp 2544 FECD.tmp 5212 FF99.tmp 2900 25.tmp 1108 C1.tmp 5456 19C.tmp 4840 258.tmp 4640 304.tmp 4248 3BF.tmp 3364 4B9.tmp 2432 575.tmp 5736 630.tmp 6020 6DC.tmp 1472 7C6.tmp 5664 843.tmp 5780 91E.tmp 2912 9BA.tmp 5560 A47.tmp 1796 AB4.tmp 2088 B60.tmp 1756 BDD.tmp 5568 C79.tmp 768 D06.tmp 4736 DC2.tmp 4256 E5E.tmp 6104 F19.tmp 5944 F87.tmp 4284 1013.tmp 4920 10B0.tmp 3656 113C.tmp 1736 11AA.tmp 5520 1236.tmp 5636 12B3.tmp 804 1330.tmp 3876 13AD.tmp 3196 142A.tmp 2768 14A7.tmp 4852 1524.tmp 3904 1592.tmp 4320 160F.tmp 4796 166C.tmp 2400 16F9.tmp 2328 1757.tmp 6044 17E3.tmp 3916 1860.tmp 4160 18DD.tmp 6004 195A.tmp 4232 19E7.tmp 2092 1A54.tmp 2112 1AE1.tmp 3336 1B5E.tmp 4536 1BCB.tmp 4384 1C48.tmp 1500 1CE5.tmp 4272 1D62.tmp 4336 1DCF.tmp 5688 1E5C.tmp 4672 1EC9.tmp 4456 1F36.tmp 2764 1FC3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 886B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 890C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E427.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B93F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1592.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2879.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C67E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B210.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 5896 2636 2026-10-26_6b447a5c8dcd857b2e0e349862aa028c_elex_mafia.exe 89 PID 5896 wrote to memory of 5356 5896 FA88.tmp 90 PID 5356 wrote to memory of 4188 5356 FB34.tmp 91 PID 4188 wrote to memory of 1820 4188 FBFF.tmp 92 PID 1820 wrote to memory of 5876 1820 FCE9.tmp 93 PID 5876 wrote to memory of 2544 5876 FDB4.tmp 94 PID 2544 wrote to memory of 5212 2544 FECD.tmp 95 PID 5212 wrote to memory of 2900 5212 FF99.tmp 96 PID 2900 wrote to memory of 1108 2900 25.tmp 97 PID 1108 wrote to memory of 5456 1108 C1.tmp 98 PID 5456 wrote to memory of 4840 5456 19C.tmp 99 PID 4840 wrote to memory of 4640 4840 258.tmp 100 PID 4640 wrote to memory of 4248 4640 304.tmp 101 PID 4248 wrote to memory of 3364 4248 3BF.tmp 102 PID 3364 wrote to memory of 2432 3364 4B9.tmp 103 PID 2432 wrote to memory of 5736 2432 575.tmp 104 PID 5736 wrote to memory of 6020 5736 630.tmp 105 PID 6020 wrote to memory of 1472 6020 6DC.tmp 106 PID 1472 wrote to memory of 5664 1472 7C6.tmp 107 PID 5664 wrote to memory of 5780 5664 843.tmp 108 PID 5780 wrote to memory of 2912 5780 91E.tmp 109 PID 2912 wrote to memory of 5560 2912 9BA.tmp 110 PID 5560 wrote to memory of 1796 5560 A47.tmp 111 PID 1796 wrote to memory of 2088 1796 AB4.tmp 112 PID 2088 wrote to memory of 1756 2088 B60.tmp 113 PID 1756 wrote to memory of 5568 1756 BDD.tmp 114 PID 5568 wrote to memory of 768 5568 C79.tmp 115 PID 768 wrote to memory of 4736 768 D06.tmp 116 PID 4736 wrote to memory of 4256 4736 DC2.tmp 117 PID 4256 wrote to memory of 6104 4256 E5E.tmp 118 PID 6104 wrote to memory of 5944 6104 F19.tmp 119 PID 5944 wrote to memory of 4284 5944 F87.tmp 120 PID 4284 wrote to memory of 4920 4284 1013.tmp 121 PID 4920 wrote to memory of 3656 4920 10B0.tmp 122 PID 3656 wrote to memory of 1736 3656 113C.tmp 123 PID 1736 wrote to memory of 5520 1736 11AA.tmp 124 PID 5520 wrote to memory of 5636 5520 1236.tmp 125 PID 5636 wrote to memory of 804 5636 12B3.tmp 126 PID 804 wrote to memory of 3876 804 1330.tmp 127 PID 3876 wrote to memory of 3196 3876 13AD.tmp 128 PID 3196 wrote to memory of 2768 3196 142A.tmp 129 PID 2768 wrote to memory of 4852 2768 14A7.tmp 130 PID 4852 wrote to memory of 3904 4852 1524.tmp 131 PID 3904 wrote to memory of 4320 3904 1592.tmp 132 PID 4320 wrote to memory of 4796 4320 160F.tmp 133 PID 4796 wrote to memory of 2400 4796 166C.tmp 134 PID 2400 wrote to memory of 2328 2400 16F9.tmp 135 PID 2328 wrote to memory of 6044 2328 1757.tmp 136 PID 6044 wrote to memory of 3916 6044 17E3.tmp 137 PID 3916 wrote to memory of 4160 3916 1860.tmp 138 PID 4160 wrote to memory of 6004 4160 18DD.tmp 139 PID 6004 wrote to memory of 4232 6004 195A.tmp 140 PID 4232 wrote to memory of 2092 4232 19E7.tmp 141 PID 2092 wrote to memory of 2112 2092 1A54.tmp 142 PID 2112 wrote to memory of 3336 2112 1AE1.tmp 143 PID 3336 wrote to memory of 4536 3336 1B5E.tmp 144 PID 4536 wrote to memory of 4384 4536 1BCB.tmp 145 PID 4384 wrote to memory of 1500 4384 1C48.tmp 146 PID 1500 wrote to memory of 4272 1500 1CE5.tmp 147 PID 4272 wrote to memory of 4336 4272 1D62.tmp 148 PID 4336 wrote to memory of 5688 4336 1DCF.tmp 149 PID 5688 wrote to memory of 4672 5688 1E5C.tmp 150 PID 4672 wrote to memory of 4456 4672 1EC9.tmp 151 PID 4456 wrote to memory of 2764 4456 1F36.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_6b447a5c8dcd857b2e0e349862aa028c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_6b447a5c8dcd857b2e0e349862aa028c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\FA88.tmp"C:\Users\Admin\AppData\Local\Temp\FA88.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\FB34.tmp"C:\Users\Admin\AppData\Local\Temp\FB34.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\FCE9.tmp"C:\Users\Admin\AppData\Local\Temp\FCE9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4B9.tmp"C:\Users\Admin\AppData\Local\Temp\4B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\6DC.tmp"C:\Users\Admin\AppData\Local\Temp\6DC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\91E.tmp"C:\Users\Admin\AppData\Local\Temp\91E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\9BA.tmp"C:\Users\Admin\AppData\Local\Temp\9BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\AB4.tmp"C:\Users\Admin\AppData\Local\Temp\AB4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\C79.tmp"C:\Users\Admin\AppData\Local\Temp\C79.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\113C.tmp"C:\Users\Admin\AppData\Local\Temp\113C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\142A.tmp"C:\Users\Admin\AppData\Local\Temp\142A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\16F9.tmp"C:\Users\Admin\AppData\Local\Temp\16F9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\18DD.tmp"C:\Users\Admin\AppData\Local\Temp\18DD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"C:\Users\Admin\AppData\Local\Temp\1AE1.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1D62.tmp"C:\Users\Admin\AppData\Local\Temp\1D62.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\1F36.tmp"C:\Users\Admin\AppData\Local\Temp\1F36.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"65⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\2040.tmp"C:\Users\Admin\AppData\Local\Temp\2040.tmp"66⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"67⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\213A.tmp"C:\Users\Admin\AppData\Local\Temp\213A.tmp"68⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\21A7.tmp"C:\Users\Admin\AppData\Local\Temp\21A7.tmp"69⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"70⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"71⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\231E.tmp"C:\Users\Admin\AppData\Local\Temp\231E.tmp"72⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\239B.tmp"C:\Users\Admin\AppData\Local\Temp\239B.tmp"73⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\2409.tmp"C:\Users\Admin\AppData\Local\Temp\2409.tmp"74⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"75⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"76⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"77⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"78⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"79⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"80⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"81⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"82⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"83⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2929.tmp"C:\Users\Admin\AppData\Local\Temp\2929.tmp"84⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\29A6.tmp"C:\Users\Admin\AppData\Local\Temp\29A6.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:428 -
C:\Users\Admin\AppData\Local\Temp\2A14.tmp"C:\Users\Admin\AppData\Local\Temp\2A14.tmp"86⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"87⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"C:\Users\Admin\AppData\Local\Temp\2AFE.tmp"88⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"C:\Users\Admin\AppData\Local\Temp\2B8B.tmp"89⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"90⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"91⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"92⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"93⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"94⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2E59.tmp"C:\Users\Admin\AppData\Local\Temp\2E59.tmp"95⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"96⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"97⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"98⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"99⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"100⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"101⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"102⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\3222.tmp"C:\Users\Admin\AppData\Local\Temp\3222.tmp"103⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"104⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"105⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"106⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"107⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"108⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"109⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"110⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\35EB.tmp"C:\Users\Admin\AppData\Local\Temp\35EB.tmp"111⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"112⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\36F4.tmp"C:\Users\Admin\AppData\Local\Temp\36F4.tmp"113⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"114⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"115⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\386B.tmp"C:\Users\Admin\AppData\Local\Temp\386B.tmp"116⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"117⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"118⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"119⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"120⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"121⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"122⤵PID:1860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-