Analysis
- max time kernel
118s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 16:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe
- Size 524KB
- Sample261113-vem26ady2v
- SHA256 4c8f055893cdd1572fe53aef12890ad32ec48baac3bf0a457385e5112c3d2515
- MD5 1646c95e6ad900c4b38ca86f6e382659
- SHA1 265750d2868d7812c379c853ebfbf17e2649c9db
- SHA512 3de14e829eb09ffb93d257cebaf9e5fa073697260961aaf0bdd8ce16945260649a5f758ee901d1fe244fa395b5eb0685335f6d3fb45f77936ab2771e2d7b2dc4
- SSDEEP 12288:TRyZzqyL66TJT6dyheWvEMsuN86Qs3StNZ:TRyQylTJT6o3zsumVs3StN
- TLSH T15BB40116B688C032F29216764B65DB62597A7C31AB2794CB3B843A7D6FF03D1D2B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2004 76CC.tmp 2384 77D6.tmp 1896 78EF.tmp 2868 79BA.tmp 4924 7A85.tmp 2596 7B9F.tmp 1560 7CD7.tmp 3872 7D93.tmp 3100 7E5E.tmp 5932 7F96.tmp 1244 8090.tmp 1660 81C9.tmp 796 82E2.tmp 4124 83BD.tmp 3628 8488.tmp 5276 85B1.tmp 5656 866C.tmp 3852 8728.tmp 984 87E3.tmp 5916 8870.tmp 1528 88ED.tmp 2296 895A.tmp 2420 89C8.tmp 4200 8A45.tmp 5496 8AC2.tmp 972 8B1F.tmp 4732 8B7D.tmp 5652 8BEA.tmp 2672 8C58.tmp 3712 8CD5.tmp 3560 8D42.tmp 3160 8DB0.tmp 2916 8E1D.tmp 5740 8E8A.tmp 2464 8F07.tmp 1364 8F84.tmp 3236 9040.tmp 5328 90FB.tmp 4176 95DD.tmp 4216 9689.tmp 4108 9735.tmp 840 97B2.tmp 2052 987D.tmp 3412 98EB.tmp 1592 9996.tmp 3820 9A42.tmp 5572 9B3C.tmp 1064 9C07.tmp 3188 9CA4.tmp 2476 9D50.tmp 5528 9DBD.tmp 3720 9E3A.tmp 256 9ED6.tmp 380 9F53.tmp 2736 9FD0.tmp 1312 A03E.tmp 6092 A0CA.tmp 1288 A147.tmp 3516 A1C4.tmp 2028 A232.tmp 4572 A2AF.tmp 2404 A33B.tmp 5828 A3C8.tmp 592 A454.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 346A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B79E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F82C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D83.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 2004 4056 2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe 89 PID 2004 wrote to memory of 2384 2004 76CC.tmp 90 PID 2384 wrote to memory of 1896 2384 77D6.tmp 91 PID 1896 wrote to memory of 2868 1896 78EF.tmp 92 PID 2868 wrote to memory of 4924 2868 79BA.tmp 93 PID 4924 wrote to memory of 2596 4924 7A85.tmp 94 PID 2596 wrote to memory of 1560 2596 7B9F.tmp 95 PID 1560 wrote to memory of 3872 1560 7CD7.tmp 96 PID 3872 wrote to memory of 3100 3872 7D93.tmp 97 PID 3100 wrote to memory of 5932 3100 7E5E.tmp 98 PID 5932 wrote to memory of 1244 5932 7F96.tmp 99 PID 1244 wrote to memory of 1660 1244 8090.tmp 100 PID 1660 wrote to memory of 796 1660 81C9.tmp 101 PID 796 wrote to memory of 4124 796 82E2.tmp 102 PID 4124 wrote to memory of 3628 4124 83BD.tmp 103 PID 3628 wrote to memory of 5276 3628 8488.tmp 104 PID 5276 wrote to memory of 5656 5276 85B1.tmp 105 PID 5656 wrote to memory of 3852 5656 866C.tmp 106 PID 3852 wrote to memory of 984 3852 8728.tmp 107 PID 984 wrote to memory of 5916 984 87E3.tmp 108 PID 5916 wrote to memory of 1528 5916 8870.tmp 109 PID 1528 wrote to memory of 2296 1528 88ED.tmp 110 PID 2296 wrote to memory of 2420 2296 895A.tmp 111 PID 2420 wrote to memory of 4200 2420 89C8.tmp 112 PID 4200 wrote to memory of 5496 4200 8A45.tmp 113 PID 5496 wrote to memory of 972 5496 8AC2.tmp 114 PID 972 wrote to memory of 4732 972 8B1F.tmp 115 PID 4732 wrote to memory of 5652 4732 8B7D.tmp 116 PID 5652 wrote to memory of 2672 5652 8BEA.tmp 117 PID 2672 wrote to memory of 3712 2672 8C58.tmp 118 PID 3712 wrote to memory of 3560 3712 8CD5.tmp 119 PID 3560 wrote to memory of 3160 3560 8D42.tmp 120 PID 3160 wrote to memory of 2916 3160 8DB0.tmp 121 PID 2916 wrote to memory of 5740 2916 8E1D.tmp 122 PID 5740 wrote to memory of 2464 5740 8E8A.tmp 123 PID 2464 wrote to memory of 1364 2464 8F07.tmp 124 PID 1364 wrote to memory of 3236 1364 8F84.tmp 125 PID 3236 wrote to memory of 5328 3236 9040.tmp 126 PID 5328 wrote to memory of 4176 5328 90FB.tmp 127 PID 4176 wrote to memory of 4216 4176 95DD.tmp 128 PID 4216 wrote to memory of 4108 4216 9689.tmp 129 PID 4108 wrote to memory of 840 4108 9735.tmp 130 PID 840 wrote to memory of 2052 840 97B2.tmp 131 PID 2052 wrote to memory of 3412 2052 987D.tmp 132 PID 3412 wrote to memory of 1592 3412 98EB.tmp 133 PID 1592 wrote to memory of 3820 1592 9996.tmp 134 PID 3820 wrote to memory of 5572 3820 9A42.tmp 135 PID 5572 wrote to memory of 1064 5572 9B3C.tmp 136 PID 1064 wrote to memory of 3188 1064 9C07.tmp 137 PID 3188 wrote to memory of 2476 3188 9CA4.tmp 138 PID 2476 wrote to memory of 5528 2476 9D50.tmp 139 PID 5528 wrote to memory of 3720 5528 9DBD.tmp 140 PID 3720 wrote to memory of 256 3720 9E3A.tmp 141 PID 256 wrote to memory of 380 256 9ED6.tmp 142 PID 380 wrote to memory of 2736 380 9F53.tmp 143 PID 2736 wrote to memory of 1312 2736 9FD0.tmp 144 PID 1312 wrote to memory of 6092 1312 A03E.tmp 145 PID 6092 wrote to memory of 1288 6092 A0CA.tmp 146 PID 1288 wrote to memory of 3516 1288 A147.tmp 147 PID 3516 wrote to memory of 2028 3516 A1C4.tmp 148 PID 2028 wrote to memory of 4572 2028 A232.tmp 149 PID 4572 wrote to memory of 2404 4572 A2AF.tmp 150 PID 2404 wrote to memory of 5828 2404 A33B.tmp 151 PID 5828 wrote to memory of 592 5828 A3C8.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_1646c95e6ad900c4b38ca86f6e382659_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\7F96.tmp"C:\Users\Admin\AppData\Local\Temp\7F96.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\81C9.tmp"C:\Users\Admin\AppData\Local\Temp\81C9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8488.tmp"C:\Users\Admin\AppData\Local\Temp\8488.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\8870.tmp"C:\Users\Admin\AppData\Local\Temp\8870.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\89C8.tmp"C:\Users\Admin\AppData\Local\Temp\89C8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\8F07.tmp"C:\Users\Admin\AppData\Local\Temp\8F07.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\8F84.tmp"C:\Users\Admin\AppData\Local\Temp\8F84.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\9689.tmp"C:\Users\Admin\AppData\Local\Temp\9689.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\9735.tmp"C:\Users\Admin\AppData\Local\Temp\9735.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\97B2.tmp"C:\Users\Admin\AppData\Local\Temp\97B2.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\9C07.tmp"C:\Users\Admin\AppData\Local\Temp\9C07.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"65⤵
- Executes dropped EXE
PID:592 -
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"66⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"67⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\A629.tmp"C:\Users\Admin\AppData\Local\Temp\A629.tmp"68⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"70⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\A84C.tmp"C:\Users\Admin\AppData\Local\Temp\A84C.tmp"72⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"73⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\A994.tmp"C:\Users\Admin\AppData\Local\Temp\A994.tmp"74⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\AA40.tmp"C:\Users\Admin\AppData\Local\Temp\AA40.tmp"75⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"76⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"77⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"78⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\AC63.tmp"C:\Users\Admin\AppData\Local\Temp\AC63.tmp"79⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"80⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"81⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\AE38.tmp"C:\Users\Admin\AppData\Local\Temp\AE38.tmp"82⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"83⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\AF32.tmp"C:\Users\Admin\AppData\Local\Temp\AF32.tmp"84⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"85⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"86⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"87⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"89⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"90⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"91⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"92⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"93⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"94⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"95⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"96⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"97⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"98⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"99⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\B79E.tmp"C:\Users\Admin\AppData\Local\Temp\B79E.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"101⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"102⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\B925.tmp"C:\Users\Admin\AppData\Local\Temp\B925.tmp"103⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\B992.tmp"C:\Users\Admin\AppData\Local\Temp\B992.tmp"104⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"C:\Users\Admin\AppData\Local\Temp\BA0F.tmp"105⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"106⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"107⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\BB86.tmp"C:\Users\Admin\AppData\Local\Temp\BB86.tmp"108⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\BC13.tmp"C:\Users\Admin\AppData\Local\Temp\BC13.tmp"109⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\BC90.tmp"C:\Users\Admin\AppData\Local\Temp\BC90.tmp"110⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"112⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\BF10.tmp"C:\Users\Admin\AppData\Local\Temp\BF10.tmp"114⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"C:\Users\Admin\AppData\Local\Temp\BF8D.tmp"115⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"C:\Users\Admin\AppData\Local\Temp\BFFB.tmp"116⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"117⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"118⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"119⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"120⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"121⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"122⤵PID:3920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-