Analysis
- max time kernel
117s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_86efebf91910cbe4d56edf422602fff2_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_86efebf91910cbe4d56edf422602fff2_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_86efebf91910cbe4d56edf422602fff2_elex_mafia.exe
- Size 520KB
- Sample260728-2j1mdacc49
- SHA256 523ea5e71909ba8be312a4c8373c56668b736ca27391da2a6819d0e0adbcd501
- MD5 86efebf91910cbe4d56edf422602fff2
- SHA1 a84b565557107de6c4524ee1035deb78eec3ef4f
- SHA512 dcf287e4f712c34c5be2549d5747f2aabe28054e50364b99fedfcd3b7555260723ed9307743503eb01719033b3831eb95dae45a3d2df0a8c99d2d45bf6b96c91
- SSDEEP 12288:gj8fuxR21t5i8fkCesHT9UCduQf9hvFNZ:gj8fuK1GYkCeb/QTNN
- TLSH T129B4F1157989C032E5E615314B62DBA10BBEBC798B2695C33BC4367DAFB52C0D67830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3224 8D23.tmp 5100 8E0D.tmp 2228 8EB9.tmp 4576 8FB3.tmp 4876 90DC.tmp 4572 91F5.tmp 4680 92A1.tmp 4860 932E.tmp 4268 93F9.tmp 1360 94D4.tmp 4408 959F.tmp 4320 964B.tmp 2020 9725.tmp 1292 97E1.tmp 1364 988D.tmp 3320 9919.tmp 5720 9996.tmp 3384 9A62.tmp 2128 9B0D.tmp 5408 9BAA.tmp 3532 9C75.tmp 3656 9D11.tmp 3928 9DBD.tmp 696 9E3A.tmp 4624 9EF5.tmp 5600 9FE0.tmp 1516 A09B.tmp 4732 A147.tmp 3068 A1F3.tmp 4720 A28F.tmp 2164 A33B.tmp 5392 A3F7.tmp 3408 A4E1.tmp 3040 A55E.tmp 5972 A5EB.tmp 1652 A677.tmp 2364 A704.tmp 5208 A791.tmp 4616 A81D.tmp 2596 A8B9.tmp 4976 A927.tmp 5828 A9B3.tmp 4468 AA21.tmp 2052 AAAD.tmp 3628 AB2A.tmp 5136 ABB7.tmp 2508 AC44.tmp 2040 ACD0.tmp 4552 AD3E.tmp 5420 ADBB.tmp 5380 AE38.tmp 5016 AEB5.tmp 2480 AF41.tmp 3908 AFDE.tmp 4104 B089.tmp 4356 B106.tmp 5084 B183.tmp 1468 B210.tmp 252 B27D.tmp 1464 B2EB.tmp 5792 B368.tmp 2456 B404.tmp 2844 B491.tmp 5692 B52D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 395C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 120D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BE1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5416 wrote to memory of 3224 5416 2026-07-28_86efebf91910cbe4d56edf422602fff2_elex_mafia.exe 89 PID 3224 wrote to memory of 5100 3224 8D23.tmp 90 PID 5100 wrote to memory of 2228 5100 8E0D.tmp 91 PID 2228 wrote to memory of 4576 2228 8EB9.tmp 92 PID 4576 wrote to memory of 4876 4576 8FB3.tmp 93 PID 4876 wrote to memory of 4572 4876 90DC.tmp 94 PID 4572 wrote to memory of 4680 4572 91F5.tmp 95 PID 4680 wrote to memory of 4860 4680 92A1.tmp 96 PID 4860 wrote to memory of 4268 4860 932E.tmp 97 PID 4268 wrote to memory of 1360 4268 93F9.tmp 98 PID 1360 wrote to memory of 4408 1360 94D4.tmp 99 PID 4408 wrote to memory of 4320 4408 959F.tmp 100 PID 4320 wrote to memory of 2020 4320 964B.tmp 101 PID 2020 wrote to memory of 1292 2020 9725.tmp 102 PID 1292 wrote to memory of 1364 1292 97E1.tmp 103 PID 1364 wrote to memory of 3320 1364 988D.tmp 104 PID 3320 wrote to memory of 5720 3320 9919.tmp 105 PID 5720 wrote to memory of 3384 5720 9996.tmp 106 PID 3384 wrote to memory of 2128 3384 9A62.tmp 107 PID 2128 wrote to memory of 5408 2128 9B0D.tmp 108 PID 5408 wrote to memory of 3532 5408 9BAA.tmp 109 PID 3532 wrote to memory of 3656 3532 9C75.tmp 110 PID 3656 wrote to memory of 3928 3656 9D11.tmp 111 PID 3928 wrote to memory of 696 3928 9DBD.tmp 112 PID 696 wrote to memory of 4624 696 9E3A.tmp 113 PID 4624 wrote to memory of 5600 4624 9EF5.tmp 114 PID 5600 wrote to memory of 1516 5600 9FE0.tmp 115 PID 1516 wrote to memory of 4732 1516 A09B.tmp 116 PID 4732 wrote to memory of 3068 4732 A147.tmp 117 PID 3068 wrote to memory of 4720 3068 A1F3.tmp 118 PID 4720 wrote to memory of 2164 4720 A28F.tmp 119 PID 2164 wrote to memory of 5392 2164 A33B.tmp 120 PID 5392 wrote to memory of 3408 5392 A3F7.tmp 121 PID 3408 wrote to memory of 3040 3408 A4E1.tmp 122 PID 3040 wrote to memory of 5972 3040 A55E.tmp 123 PID 5972 wrote to memory of 1652 5972 A5EB.tmp 124 PID 1652 wrote to memory of 2364 1652 A677.tmp 125 PID 2364 wrote to memory of 5208 2364 A704.tmp 126 PID 5208 wrote to memory of 4616 5208 A791.tmp 127 PID 4616 wrote to memory of 2596 4616 A81D.tmp 128 PID 2596 wrote to memory of 4976 2596 A8B9.tmp 129 PID 4976 wrote to memory of 5828 4976 A927.tmp 130 PID 5828 wrote to memory of 4468 5828 A9B3.tmp 131 PID 4468 wrote to memory of 2052 4468 AA21.tmp 132 PID 2052 wrote to memory of 3628 2052 AAAD.tmp 133 PID 3628 wrote to memory of 5136 3628 AB2A.tmp 134 PID 5136 wrote to memory of 2508 5136 ABB7.tmp 135 PID 2508 wrote to memory of 2040 2508 AC44.tmp 136 PID 2040 wrote to memory of 4552 2040 ACD0.tmp 137 PID 4552 wrote to memory of 5420 4552 AD3E.tmp 138 PID 5420 wrote to memory of 5380 5420 ADBB.tmp 139 PID 5380 wrote to memory of 5016 5380 AE38.tmp 140 PID 5016 wrote to memory of 2480 5016 AEB5.tmp 141 PID 2480 wrote to memory of 3908 2480 AF41.tmp 142 PID 3908 wrote to memory of 4104 3908 AFDE.tmp 143 PID 4104 wrote to memory of 4356 4104 B089.tmp 144 PID 4356 wrote to memory of 5084 4356 B106.tmp 145 PID 5084 wrote to memory of 1468 5084 B183.tmp 146 PID 1468 wrote to memory of 252 1468 B210.tmp 147 PID 252 wrote to memory of 1464 252 B27D.tmp 148 PID 1464 wrote to memory of 5792 1464 B2EB.tmp 149 PID 5792 wrote to memory of 2456 5792 B368.tmp 150 PID 2456 wrote to memory of 2844 2456 B404.tmp 151 PID 2844 wrote to memory of 5692 2844 B491.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_86efebf91910cbe4d56edf422602fff2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_86efebf91910cbe4d56edf422602fff2_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\91F5.tmp"C:\Users\Admin\AppData\Local\Temp\91F5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\959F.tmp"C:\Users\Admin\AppData\Local\Temp\959F.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\988D.tmp"C:\Users\Admin\AppData\Local\Temp\988D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\9A62.tmp"C:\Users\Admin\AppData\Local\Temp\9A62.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\9D11.tmp"C:\Users\Admin\AppData\Local\Temp\9D11.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\A09B.tmp"C:\Users\Admin\AppData\Local\Temp\A09B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\A55E.tmp"C:\Users\Admin\AppData\Local\Temp\A55E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\A677.tmp"C:\Users\Admin\AppData\Local\Temp\A677.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\A81D.tmp"C:\Users\Admin\AppData\Local\Temp\A81D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A927.tmp"C:\Users\Admin\AppData\Local\Temp\A927.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\AA21.tmp"C:\Users\Admin\AppData\Local\Temp\AA21.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"C:\Users\Admin\AppData\Local\Temp\AB2A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\AC44.tmp"C:\Users\Admin\AppData\Local\Temp\AC44.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"C:\Users\Admin\AppData\Local\Temp\AD3E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\AE38.tmp"C:\Users\Admin\AppData\Local\Temp\AE38.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\B183.tmp"C:\Users\Admin\AppData\Local\Temp\B183.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\B404.tmp"C:\Users\Admin\AppData\Local\Temp\B404.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B491.tmp"C:\Users\Admin\AppData\Local\Temp\B491.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B52D.tmp"C:\Users\Admin\AppData\Local\Temp\B52D.tmp"65⤵
- Executes dropped EXE
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"66⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"67⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"68⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"69⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"70⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"71⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"72⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"73⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"74⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"75⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"76⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"78⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"79⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"80⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"81⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\BE74.tmp"C:\Users\Admin\AppData\Local\Temp\BE74.tmp"82⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"83⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"84⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"85⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"86⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\C114.tmp"C:\Users\Admin\AppData\Local\Temp\C114.tmp"87⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"88⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"89⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"90⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"91⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"92⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"93⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"94⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"95⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"96⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"97⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\C75D.tmp"C:\Users\Admin\AppData\Local\Temp\C75D.tmp"98⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"99⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"100⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"101⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\C951.tmp"C:\Users\Admin\AppData\Local\Temp\C951.tmp"102⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"C:\Users\Admin\AppData\Local\Temp\C9CE.tmp"103⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"C:\Users\Admin\AppData\Local\Temp\CA4B.tmp"104⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"105⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"106⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"107⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"108⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"109⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"C:\Users\Admin\AppData\Local\Temp\CDC6.tmp"110⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\CE43.tmp"C:\Users\Admin\AppData\Local\Temp\CE43.tmp"111⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"112⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"113⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"114⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"115⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"116⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\D150.tmp"C:\Users\Admin\AppData\Local\Temp\D150.tmp"117⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"118⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"119⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"C:\Users\Admin\AppData\Local\Temp\D2C7.tmp"120⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"121⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"122⤵PID:1108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-