Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 21:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_467e15ced5e0f404c205ee8d449dd117_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_467e15ced5e0f404c205ee8d449dd117_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_467e15ced5e0f404c205ee8d449dd117_elex_mafia.exe
- Size 560KB
- Sample260930-1ae4msygmc
- SHA256 6f411a6ce2d5663fa697e2c1c9ff024af464d5206d0ed9e6e7d518dd20c70dca
- MD5 467e15ced5e0f404c205ee8d449dd117
- SHA1 210ff42b519babd505b34f4285ab07d23a693660
- SHA512 265ea6e2db83793ab6e513fa9f5add3aaeee3c706bde663179d9649fb4d1146971891f82d80ddac7ffddbde033ac3086f7f737d98d529ab32df2505283f9ab66
- SSDEEP 12288:MlFXOQUDmrC8SYZc6S087EZ10kPEoOuIZxV:MlUQbC8SYZ60aEZbjOuIR
- TLSH T1E2C4F0167684C073E2D202304A66DB625B3F7C755B3A64C73794262EAEB53D1DB3838B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1324 8841.tmp 2592 8979.tmp 1076 8AA2.tmp 2020 8B9C.tmp 880 8CD5.tmp 4836 8DA0.tmp 2656 8F27.tmp 2864 8FF2.tmp 4420 90FB.tmp 4268 91E6.tmp 4160 92C0.tmp 3116 93DA.tmp 4888 94F3.tmp 6056 95ED.tmp 928 9716.tmp 1260 97F1.tmp 2124 98EB.tmp 3772 99F4.tmp 2948 9AFE.tmp 5016 9C27.tmp 3264 9D40.tmp 956 9E3A.tmp 5860 9F53.tmp 5828 A05D.tmp 3824 A166.tmp 1236 A28F.tmp 6104 A399.tmp 3728 A4A3.tmp 5116 A5AC.tmp 5992 A6D5.tmp 708 A7EE.tmp 3024 A917.tmp 1660 AA02.tmp 256 AB0B.tmp 2604 ABC7.tmp 3288 ACA1.tmp 5484 AD6D.tmp 5356 AE38.tmp 252 AF12.tmp 3216 AFFD.tmp 5400 B0D8.tmp 4784 B1B2.tmp 4684 B25E.tmp 2600 B2FA.tmp 5744 B3B6.tmp 6032 B452.tmp 1752 B53D.tmp 2988 B5E8.tmp 2420 B675.tmp 3656 B6D3.tmp 3600 B77F.tmp 4128 B80B.tmp 5464 B898.tmp 5492 B934.tmp 2064 B9D0.tmp 1968 BA6D.tmp 2440 BAF9.tmp 5568 BB96.tmp 3464 BC13.tmp 1808 BC80.tmp 5976 BD0D.tmp 3840 BD6A.tmp 4264 BDF7.tmp 5392 BE55.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 416F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 633B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5957.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E715.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 257B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 571A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E909.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCEB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 1324 4572 2026-09-29_467e15ced5e0f404c205ee8d449dd117_elex_mafia.exe 90 PID 1324 wrote to memory of 2592 1324 8841.tmp 91 PID 2592 wrote to memory of 1076 2592 8979.tmp 92 PID 1076 wrote to memory of 2020 1076 8AA2.tmp 93 PID 2020 wrote to memory of 880 2020 8B9C.tmp 94 PID 880 wrote to memory of 4836 880 8CD5.tmp 95 PID 4836 wrote to memory of 2656 4836 8DA0.tmp 96 PID 2656 wrote to memory of 2864 2656 8F27.tmp 97 PID 2864 wrote to memory of 4420 2864 8FF2.tmp 98 PID 4420 wrote to memory of 4268 4420 90FB.tmp 99 PID 4268 wrote to memory of 4160 4268 91E6.tmp 100 PID 4160 wrote to memory of 3116 4160 92C0.tmp 101 PID 3116 wrote to memory of 4888 3116 93DA.tmp 102 PID 4888 wrote to memory of 6056 4888 94F3.tmp 103 PID 6056 wrote to memory of 928 6056 95ED.tmp 104 PID 928 wrote to memory of 1260 928 9716.tmp 105 PID 1260 wrote to memory of 2124 1260 97F1.tmp 106 PID 2124 wrote to memory of 3772 2124 98EB.tmp 107 PID 3772 wrote to memory of 2948 3772 99F4.tmp 108 PID 2948 wrote to memory of 5016 2948 9AFE.tmp 109 PID 5016 wrote to memory of 3264 5016 9C27.tmp 110 PID 3264 wrote to memory of 956 3264 9D40.tmp 111 PID 956 wrote to memory of 5860 956 9E3A.tmp 112 PID 5860 wrote to memory of 5828 5860 9F53.tmp 113 PID 5828 wrote to memory of 3824 5828 A05D.tmp 114 PID 3824 wrote to memory of 1236 3824 A166.tmp 115 PID 1236 wrote to memory of 6104 1236 A28F.tmp 116 PID 6104 wrote to memory of 3728 6104 A399.tmp 117 PID 3728 wrote to memory of 5116 3728 A4A3.tmp 118 PID 5116 wrote to memory of 5992 5116 A5AC.tmp 119 PID 5992 wrote to memory of 708 5992 A6D5.tmp 120 PID 708 wrote to memory of 3024 708 A7EE.tmp 121 PID 3024 wrote to memory of 1660 3024 A917.tmp 122 PID 1660 wrote to memory of 256 1660 AA02.tmp 123 PID 256 wrote to memory of 2604 256 AB0B.tmp 124 PID 2604 wrote to memory of 3288 2604 ABC7.tmp 125 PID 3288 wrote to memory of 5484 3288 ACA1.tmp 126 PID 5484 wrote to memory of 5356 5484 AD6D.tmp 127 PID 5356 wrote to memory of 252 5356 AE38.tmp 128 PID 252 wrote to memory of 3216 252 AF12.tmp 129 PID 3216 wrote to memory of 5400 3216 AFFD.tmp 130 PID 5400 wrote to memory of 4784 5400 B0D8.tmp 131 PID 4784 wrote to memory of 4684 4784 B1B2.tmp 132 PID 4684 wrote to memory of 2600 4684 B25E.tmp 133 PID 2600 wrote to memory of 5744 2600 B2FA.tmp 134 PID 5744 wrote to memory of 6032 5744 B3B6.tmp 135 PID 6032 wrote to memory of 1752 6032 B452.tmp 136 PID 1752 wrote to memory of 2988 1752 B53D.tmp 137 PID 2988 wrote to memory of 2420 2988 B5E8.tmp 138 PID 2420 wrote to memory of 3656 2420 B675.tmp 139 PID 3656 wrote to memory of 3600 3656 B6D3.tmp 140 PID 3600 wrote to memory of 4128 3600 B77F.tmp 141 PID 4128 wrote to memory of 5464 4128 B80B.tmp 142 PID 5464 wrote to memory of 5492 5464 B898.tmp 143 PID 5492 wrote to memory of 2064 5492 B934.tmp 144 PID 2064 wrote to memory of 1968 2064 B9D0.tmp 145 PID 1968 wrote to memory of 2440 1968 BA6D.tmp 146 PID 2440 wrote to memory of 5568 2440 BAF9.tmp 147 PID 5568 wrote to memory of 3464 5568 BB96.tmp 148 PID 3464 wrote to memory of 1808 3464 BC13.tmp 149 PID 1808 wrote to memory of 5976 1808 BC80.tmp 150 PID 5976 wrote to memory of 3840 5976 BD0D.tmp 151 PID 3840 wrote to memory of 4264 3840 BD6A.tmp 152 PID 4264 wrote to memory of 5392 4264 BDF7.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_467e15ced5e0f404c205ee8d449dd117_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_467e15ced5e0f404c205ee8d449dd117_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8979.tmp"C:\Users\Admin\AppData\Local\Temp\8979.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8FF2.tmp"C:\Users\Admin\AppData\Local\Temp\8FF2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\92C0.tmp"C:\Users\Admin\AppData\Local\Temp\92C0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\95ED.tmp"C:\Users\Admin\AppData\Local\Temp\95ED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\97F1.tmp"C:\Users\Admin\AppData\Local\Temp\97F1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\99F4.tmp"C:\Users\Admin\AppData\Local\Temp\99F4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9D40.tmp"C:\Users\Admin\AppData\Local\Temp\9D40.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\A05D.tmp"C:\Users\Admin\AppData\Local\Temp\A05D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\A4A3.tmp"C:\Users\Admin\AppData\Local\Temp\A4A3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\A917.tmp"C:\Users\Admin\AppData\Local\Temp\A917.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\AA02.tmp"C:\Users\Admin\AppData\Local\Temp\AA02.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\AE38.tmp"C:\Users\Admin\AppData\Local\Temp\AE38.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"C:\Users\Admin\AppData\Local\Temp\B5E8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B675.tmp"C:\Users\Admin\AppData\Local\Temp\B675.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\B77F.tmp"C:\Users\Admin\AppData\Local\Temp\B77F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\BC13.tmp"C:\Users\Admin\AppData\Local\Temp\BC13.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\BC80.tmp"C:\Users\Admin\AppData\Local\Temp\BC80.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"C:\Users\Admin\AppData\Local\Temp\BDF7.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"65⤵
- Executes dropped EXE
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"66⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"67⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"68⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C058.tmp"C:\Users\Admin\AppData\Local\Temp\C058.tmp"69⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"70⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"71⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\C21D.tmp"C:\Users\Admin\AppData\Local\Temp\C21D.tmp"72⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\C29A.tmp"C:\Users\Admin\AppData\Local\Temp\C29A.tmp"73⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"74⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"75⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\C421.tmp"C:\Users\Admin\AppData\Local\Temp\C421.tmp"76⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"77⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"78⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\C579.tmp"C:\Users\Admin\AppData\Local\Temp\C579.tmp"79⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"80⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\C682.tmp"C:\Users\Admin\AppData\Local\Temp\C682.tmp"81⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"82⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"83⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\C819.tmp"C:\Users\Admin\AppData\Local\Temp\C819.tmp"84⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\C896.tmp"C:\Users\Admin\AppData\Local\Temp\C896.tmp"85⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\C922.tmp"C:\Users\Admin\AppData\Local\Temp\C922.tmp"86⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"87⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"88⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"89⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"90⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\CB64.tmp"C:\Users\Admin\AppData\Local\Temp\CB64.tmp"91⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"92⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"93⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"95⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"96⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\CE91.tmp"C:\Users\Admin\AppData\Local\Temp\CE91.tmp"97⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"98⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"99⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\D018.tmp"C:\Users\Admin\AppData\Local\Temp\D018.tmp"100⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"101⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\D131.tmp"C:\Users\Admin\AppData\Local\Temp\D131.tmp"102⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"103⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\D25A.tmp"C:\Users\Admin\AppData\Local\Temp\D25A.tmp"104⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"105⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"106⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"107⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"108⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"110⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"C:\Users\Admin\AppData\Local\Temp\D5D4.tmp"111⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"112⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"113⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"114⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"115⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"116⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"117⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"119⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"120⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"121⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\DB24.tmp"C:\Users\Admin\AppData\Local\Temp\DB24.tmp"122⤵PID:496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-