Analysis
- max time kernel
100s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-30_c223064968a6cb9c899bb5fc8681c0c5_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-30_c223064968a6cb9c899bb5fc8681c0c5_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-30_c223064968a6cb9c899bb5fc8681c0c5_elex_mafia.exe
- Size 520KB
- Sample261030-wfb7qazzht
- SHA256 61fdfcbcc18f9ee51a1a1f4d6171a317c402e262726af247876147e7cb98005d
- MD5 c223064968a6cb9c899bb5fc8681c0c5
- SHA1 c7830884f2ad2d8fbbcd6a11bd2a943689a1f703
- SHA512 dc58a655f79346384e170679867a642c68b28e6c3c7f96aad9909239f34a07edf98c76a6a917977c8049850841c24a59d2af5571981589c0371216aafd8182d7
- SSDEEP 12288:roRXOQjmOy1m4UIl4Ujhl5PGextXyLBNZ:rogQ9y44VthbGgtXoN
- TLSH T103B4F0227184C032E5D256304F2ACFA24B3A7D675B3A52C73B843A6D6EF42D1E6B5347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3860 250E.tmp 4540 25C9.tmp 260 26A4.tmp 2068 276F.tmp 3424 2869.tmp 4732 2953.tmp 5376 29FF.tmp 5476 2A9B.tmp 2220 2B67.tmp 4660 2BE4.tmp 4224 2C61.tmp 1076 2CED.tmp 6028 2DA9.tmp 5764 2E45.tmp 1976 2EE1.tmp 3956 2F5E.tmp 5976 2FCC.tmp 480 3068.tmp 5328 30D5.tmp 2416 3143.tmp 6096 31B0.tmp 1484 321D.tmp 5076 327B.tmp 1556 3308.tmp 4872 3365.tmp 1444 33E2.tmp 5964 345F.tmp 2400 34EC.tmp 4152 3559.tmp 1500 35E6.tmp 4244 3653.tmp 3900 36D0.tmp 1108 374D.tmp 5664 37BB.tmp 4068 3828.tmp 4896 3896.tmp 3980 38E4.tmp 5284 3951.tmp 1224 39AF.tmp 3312 3A0D.tmp 4372 3A6A.tmp 2724 3AC8.tmp 1924 3B35.tmp 1192 3BC2.tmp 4444 3C6E.tmp 5760 3CDB.tmp 4584 3D68.tmp 4612 3DE5.tmp 812 3E62.tmp 3788 3EEF.tmp 4048 3F7B.tmp 4300 3FF8.tmp 3396 4085.tmp 3816 4131.tmp 1300 41BD.tmp 2036 424A.tmp 2968 42F6.tmp 1396 4373.tmp 1044 43F0.tmp 5656 447C.tmp 2672 44DA.tmp 3120 4548.tmp 4072 45C5.tmp 4620 4642.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9660.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 923A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9701.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7991.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 276F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 171E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9789.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D05.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5796 wrote to memory of 3860 5796 2026-10-30_c223064968a6cb9c899bb5fc8681c0c5_elex_mafia.exe 88 PID 3860 wrote to memory of 4540 3860 250E.tmp 89 PID 4540 wrote to memory of 260 4540 25C9.tmp 90 PID 260 wrote to memory of 2068 260 26A4.tmp 91 PID 2068 wrote to memory of 3424 2068 276F.tmp 92 PID 3424 wrote to memory of 4732 3424 2869.tmp 93 PID 4732 wrote to memory of 5376 4732 2953.tmp 94 PID 5376 wrote to memory of 5476 5376 29FF.tmp 95 PID 5476 wrote to memory of 2220 5476 2A9B.tmp 96 PID 2220 wrote to memory of 4660 2220 2B67.tmp 97 PID 4660 wrote to memory of 4224 4660 2BE4.tmp 98 PID 4224 wrote to memory of 1076 4224 2C61.tmp 99 PID 1076 wrote to memory of 6028 1076 2CED.tmp 100 PID 6028 wrote to memory of 5764 6028 2DA9.tmp 101 PID 5764 wrote to memory of 1976 5764 2E45.tmp 102 PID 1976 wrote to memory of 3956 1976 2EE1.tmp 103 PID 3956 wrote to memory of 5976 3956 2F5E.tmp 104 PID 5976 wrote to memory of 480 5976 2FCC.tmp 105 PID 480 wrote to memory of 5328 480 3068.tmp 106 PID 5328 wrote to memory of 2416 5328 30D5.tmp 107 PID 2416 wrote to memory of 6096 2416 3143.tmp 108 PID 6096 wrote to memory of 1484 6096 31B0.tmp 109 PID 1484 wrote to memory of 5076 1484 321D.tmp 110 PID 5076 wrote to memory of 1556 5076 327B.tmp 111 PID 1556 wrote to memory of 4872 1556 3308.tmp 112 PID 4872 wrote to memory of 1444 4872 3365.tmp 113 PID 1444 wrote to memory of 5964 1444 33E2.tmp 114 PID 5964 wrote to memory of 2400 5964 345F.tmp 115 PID 2400 wrote to memory of 4152 2400 34EC.tmp 116 PID 4152 wrote to memory of 1500 4152 3559.tmp 117 PID 1500 wrote to memory of 4244 1500 35E6.tmp 118 PID 4244 wrote to memory of 3900 4244 3653.tmp 119 PID 3900 wrote to memory of 1108 3900 36D0.tmp 120 PID 1108 wrote to memory of 5664 1108 374D.tmp 121 PID 5664 wrote to memory of 4068 5664 37BB.tmp 122 PID 4068 wrote to memory of 4896 4068 3828.tmp 123 PID 4896 wrote to memory of 3980 4896 3896.tmp 124 PID 3980 wrote to memory of 5284 3980 38E4.tmp 125 PID 5284 wrote to memory of 1224 5284 3951.tmp 126 PID 1224 wrote to memory of 3312 1224 39AF.tmp 127 PID 3312 wrote to memory of 4372 3312 3A0D.tmp 128 PID 4372 wrote to memory of 2724 4372 3A6A.tmp 129 PID 2724 wrote to memory of 1924 2724 3AC8.tmp 130 PID 1924 wrote to memory of 1192 1924 3B35.tmp 131 PID 1192 wrote to memory of 4444 1192 3BC2.tmp 132 PID 4444 wrote to memory of 5760 4444 3C6E.tmp 133 PID 5760 wrote to memory of 4584 5760 3CDB.tmp 134 PID 4584 wrote to memory of 4612 4584 3D68.tmp 135 PID 4612 wrote to memory of 812 4612 3DE5.tmp 136 PID 812 wrote to memory of 3788 812 3E62.tmp 137 PID 3788 wrote to memory of 4048 3788 3EEF.tmp 138 PID 4048 wrote to memory of 4300 4048 3F7B.tmp 139 PID 4300 wrote to memory of 3396 4300 3FF8.tmp 140 PID 3396 wrote to memory of 3816 3396 4085.tmp 141 PID 3816 wrote to memory of 1300 3816 4131.tmp 142 PID 1300 wrote to memory of 2036 1300 41BD.tmp 143 PID 2036 wrote to memory of 2968 2036 424A.tmp 144 PID 2968 wrote to memory of 1396 2968 42F6.tmp 145 PID 1396 wrote to memory of 1044 1396 4373.tmp 146 PID 1044 wrote to memory of 5656 1044 43F0.tmp 147 PID 5656 wrote to memory of 2672 5656 447C.tmp 148 PID 2672 wrote to memory of 3120 2672 44DA.tmp 149 PID 3120 wrote to memory of 4072 3120 4548.tmp 150 PID 4072 wrote to memory of 4620 4072 45C5.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_c223064968a6cb9c899bb5fc8681c0c5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_c223064968a6cb9c899bb5fc8681c0c5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\26A4.tmp"C:\Users\Admin\AppData\Local\Temp\26A4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"C:\Users\Admin\AppData\Local\Temp\2A9B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2B67.tmp"C:\Users\Admin\AppData\Local\Temp\2B67.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\2C61.tmp"C:\Users\Admin\AppData\Local\Temp\2C61.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2CED.tmp"C:\Users\Admin\AppData\Local\Temp\2CED.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\2E45.tmp"C:\Users\Admin\AppData\Local\Temp\2E45.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"C:\Users\Admin\AppData\Local\Temp\2EE1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"C:\Users\Admin\AppData\Local\Temp\2F5E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\3068.tmp"C:\Users\Admin\AppData\Local\Temp\3068.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\30D5.tmp"C:\Users\Admin\AppData\Local\Temp\30D5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\3143.tmp"C:\Users\Admin\AppData\Local\Temp\3143.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\31B0.tmp"C:\Users\Admin\AppData\Local\Temp\31B0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\321D.tmp"C:\Users\Admin\AppData\Local\Temp\321D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\327B.tmp"C:\Users\Admin\AppData\Local\Temp\327B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\3308.tmp"C:\Users\Admin\AppData\Local\Temp\3308.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3365.tmp"C:\Users\Admin\AppData\Local\Temp\3365.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\33E2.tmp"C:\Users\Admin\AppData\Local\Temp\33E2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\345F.tmp"C:\Users\Admin\AppData\Local\Temp\345F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\34EC.tmp"C:\Users\Admin\AppData\Local\Temp\34EC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3559.tmp"C:\Users\Admin\AppData\Local\Temp\3559.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\35E6.tmp"C:\Users\Admin\AppData\Local\Temp\35E6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3653.tmp"C:\Users\Admin\AppData\Local\Temp\3653.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\36D0.tmp"C:\Users\Admin\AppData\Local\Temp\36D0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\374D.tmp"C:\Users\Admin\AppData\Local\Temp\374D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\37BB.tmp"C:\Users\Admin\AppData\Local\Temp\37BB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\3828.tmp"C:\Users\Admin\AppData\Local\Temp\3828.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\3896.tmp"C:\Users\Admin\AppData\Local\Temp\3896.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\38E4.tmp"C:\Users\Admin\AppData\Local\Temp\38E4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3951.tmp"C:\Users\Admin\AppData\Local\Temp\3951.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\39AF.tmp"C:\Users\Admin\AppData\Local\Temp\39AF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"C:\Users\Admin\AppData\Local\Temp\3A0D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3B35.tmp"C:\Users\Admin\AppData\Local\Temp\3B35.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3BC2.tmp"C:\Users\Admin\AppData\Local\Temp\3BC2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"C:\Users\Admin\AppData\Local\Temp\3CDB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\3D68.tmp"C:\Users\Admin\AppData\Local\Temp\3D68.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\3E62.tmp"C:\Users\Admin\AppData\Local\Temp\3E62.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\3FF8.tmp"C:\Users\Admin\AppData\Local\Temp\3FF8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4085.tmp"C:\Users\Admin\AppData\Local\Temp\4085.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4131.tmp"C:\Users\Admin\AppData\Local\Temp\4131.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\41BD.tmp"C:\Users\Admin\AppData\Local\Temp\41BD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\424A.tmp"C:\Users\Admin\AppData\Local\Temp\424A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\42F6.tmp"C:\Users\Admin\AppData\Local\Temp\42F6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\4373.tmp"C:\Users\Admin\AppData\Local\Temp\4373.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\43F0.tmp"C:\Users\Admin\AppData\Local\Temp\43F0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\447C.tmp"C:\Users\Admin\AppData\Local\Temp\447C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\44DA.tmp"C:\Users\Admin\AppData\Local\Temp\44DA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4548.tmp"C:\Users\Admin\AppData\Local\Temp\4548.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\45C5.tmp"C:\Users\Admin\AppData\Local\Temp\45C5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4642.tmp"C:\Users\Admin\AppData\Local\Temp\4642.tmp"65⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\46ED.tmp"C:\Users\Admin\AppData\Local\Temp\46ED.tmp"66⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\477A.tmp"C:\Users\Admin\AppData\Local\Temp\477A.tmp"67⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\47E7.tmp"C:\Users\Admin\AppData\Local\Temp\47E7.tmp"68⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\4855.tmp"C:\Users\Admin\AppData\Local\Temp\4855.tmp"69⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\48E1.tmp"C:\Users\Admin\AppData\Local\Temp\48E1.tmp"70⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\494F.tmp"C:\Users\Admin\AppData\Local\Temp\494F.tmp"71⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\49BC.tmp"C:\Users\Admin\AppData\Local\Temp\49BC.tmp"72⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"74⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"75⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"76⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"77⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\4D27.tmp"C:\Users\Admin\AppData\Local\Temp\4D27.tmp"78⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\4E21.tmp"C:\Users\Admin\AppData\Local\Temp\4E21.tmp"80⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"81⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"C:\Users\Admin\AppData\Local\Temp\4F3A.tmp"82⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"83⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5063.tmp"C:\Users\Admin\AppData\Local\Temp\5063.tmp"84⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\50F0.tmp"C:\Users\Admin\AppData\Local\Temp\50F0.tmp"85⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\518C.tmp"C:\Users\Admin\AppData\Local\Temp\518C.tmp"86⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5209.tmp"C:\Users\Admin\AppData\Local\Temp\5209.tmp"87⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\5296.tmp"C:\Users\Admin\AppData\Local\Temp\5296.tmp"88⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5313.tmp"C:\Users\Admin\AppData\Local\Temp\5313.tmp"89⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5390.tmp"C:\Users\Admin\AppData\Local\Temp\5390.tmp"90⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\540D.tmp"C:\Users\Admin\AppData\Local\Temp\540D.tmp"91⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\548A.tmp"C:\Users\Admin\AppData\Local\Temp\548A.tmp"92⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5507.tmp"C:\Users\Admin\AppData\Local\Temp\5507.tmp"93⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\5574.tmp"C:\Users\Admin\AppData\Local\Temp\5574.tmp"94⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\55F1.tmp"C:\Users\Admin\AppData\Local\Temp\55F1.tmp"95⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\566E.tmp"C:\Users\Admin\AppData\Local\Temp\566E.tmp"96⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\56EB.tmp"C:\Users\Admin\AppData\Local\Temp\56EB.tmp"97⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\5787.tmp"C:\Users\Admin\AppData\Local\Temp\5787.tmp"98⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5804.tmp"C:\Users\Admin\AppData\Local\Temp\5804.tmp"99⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\5881.tmp"C:\Users\Admin\AppData\Local\Temp\5881.tmp"100⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\591E.tmp"C:\Users\Admin\AppData\Local\Temp\591E.tmp"101⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\59AA.tmp"C:\Users\Admin\AppData\Local\Temp\59AA.tmp"102⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\5A27.tmp"C:\Users\Admin\AppData\Local\Temp\5A27.tmp"103⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5AA4.tmp"C:\Users\Admin\AppData\Local\Temp\5AA4.tmp"104⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\5B31.tmp"C:\Users\Admin\AppData\Local\Temp\5B31.tmp"105⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\5BAE.tmp"C:\Users\Admin\AppData\Local\Temp\5BAE.tmp"106⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:204 -
C:\Users\Admin\AppData\Local\Temp\5C98.tmp"C:\Users\Admin\AppData\Local\Temp\5C98.tmp"108⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5D15.tmp"C:\Users\Admin\AppData\Local\Temp\5D15.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"110⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\5E2F.tmp"C:\Users\Admin\AppData\Local\Temp\5E2F.tmp"111⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"112⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\5F19.tmp"C:\Users\Admin\AppData\Local\Temp\5F19.tmp"113⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\5F86.tmp"C:\Users\Admin\AppData\Local\Temp\5F86.tmp"114⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6013.tmp"C:\Users\Admin\AppData\Local\Temp\6013.tmp"115⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\60A0.tmp"C:\Users\Admin\AppData\Local\Temp\60A0.tmp"116⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"117⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\61A9.tmp"C:\Users\Admin\AppData\Local\Temp\61A9.tmp"118⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6226.tmp"C:\Users\Admin\AppData\Local\Temp\6226.tmp"119⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\62A3.tmp"C:\Users\Admin\AppData\Local\Temp\62A3.tmp"120⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6330.tmp"C:\Users\Admin\AppData\Local\Temp\6330.tmp"121⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\63BC.tmp"C:\Users\Admin\AppData\Local\Temp\63BC.tmp"122⤵PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-