Analysis
- max time kernel
111s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 13:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_1a38e9a2d26f131db3e2323c8a377ccc_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_1a38e9a2d26f131db3e2323c8a377ccc_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_1a38e9a2d26f131db3e2323c8a377ccc_elex_mafia.exe
- Size 520KB
- Sample260930-qvblvaztct
- SHA256 596759b1b3d0533dec006a9702f8f0c9ff22c78cf5e11ed4849f52ef2175a367
- MD5 1a38e9a2d26f131db3e2323c8a377ccc
- SHA1 5b39f159385631acb0dbbcc559e803788642f481
- SHA512 e3b6f6e4cdce8f0fe17f0930bfc4c30f5576f1f436e22b2b7f6e5cbd4d2eebc822b27db4b817604f016782281130c97755b8ace8339da97206ae4691b9a215cf
- SSDEEP 12288:gj8fuxR21t5i8fdgzubSqnQi+0mX3S7odBgNZ6:gj8fuK1GYCI7+zX39BgNI
- TLSH T159B4F1227849C033E5D215354A61DBA11BBE7C798B3595C73BC8366E6FB52C2E63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3272 BFBC.tmp 2508 C087.tmp 6024 C152.tmp 4664 C1DF.tmp 2688 C25C.tmp 2312 C2D9.tmp 5564 C411.tmp 1092 C49E.tmp 2360 C53A.tmp 4352 C598.tmp 4080 C625.tmp 6068 C6B1.tmp 3280 C71F.tmp 4328 C7AB.tmp 2008 C838.tmp 1448 C8D4.tmp 3908 C961.tmp 1044 C9DE.tmp 2608 CA5B.tmp 5060 CAD8.tmp 2068 CB45.tmp 3968 CBB3.tmp 1652 CC20.tmp 4732 CC8D.tmp 2720 CD1A.tmp 4276 CDA7.tmp 4764 CE33.tmp 3256 CEA1.tmp 2192 CF1E.tmp 3728 CF8B.tmp 3304 D008.tmp 4960 D085.tmp 3888 D102.tmp 3404 D18F.tmp 2844 D20C.tmp 4120 D289.tmp 1828 D2F6.tmp 1748 D363.tmp 5864 D3D1.tmp 4292 D43E.tmp 1208 D4AB.tmp 1648 D528.tmp 2480 D5A5.tmp 5760 D642.tmp 1628 D6BF.tmp 5748 D75B.tmp 4348 D7E8.tmp 3884 D874.tmp 2028 D8F1.tmp 4832 D97E.tmp 5656 D9FB.tmp 980 DA78.tmp 1496 DAF5.tmp 2368 DBC0.tmp 3444 DC4D.tmp 4600 DCD9.tmp 4736 DD56.tmp 264 DE21.tmp 3068 DEBE.tmp 5908 DF2B.tmp 1184 DFA8.tmp 2292 E025.tmp 5212 E0B2.tmp 4620 E13E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C71F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D20C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45EF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1376 wrote to memory of 3272 1376 2026-09-30_1a38e9a2d26f131db3e2323c8a377ccc_elex_mafia.exe 88 PID 3272 wrote to memory of 2508 3272 BFBC.tmp 89 PID 2508 wrote to memory of 6024 2508 C087.tmp 90 PID 6024 wrote to memory of 4664 6024 C152.tmp 91 PID 4664 wrote to memory of 2688 4664 C1DF.tmp 92 PID 2688 wrote to memory of 2312 2688 C25C.tmp 93 PID 2312 wrote to memory of 5564 2312 C2D9.tmp 94 PID 5564 wrote to memory of 1092 5564 C411.tmp 95 PID 1092 wrote to memory of 2360 1092 C49E.tmp 96 PID 2360 wrote to memory of 4352 2360 C53A.tmp 97 PID 4352 wrote to memory of 4080 4352 C598.tmp 98 PID 4080 wrote to memory of 6068 4080 C625.tmp 99 PID 6068 wrote to memory of 3280 6068 C6B1.tmp 100 PID 3280 wrote to memory of 4328 3280 C71F.tmp 101 PID 4328 wrote to memory of 2008 4328 C7AB.tmp 102 PID 2008 wrote to memory of 1448 2008 C838.tmp 103 PID 1448 wrote to memory of 3908 1448 C8D4.tmp 104 PID 3908 wrote to memory of 1044 3908 C961.tmp 105 PID 1044 wrote to memory of 2608 1044 C9DE.tmp 106 PID 2608 wrote to memory of 5060 2608 CA5B.tmp 107 PID 5060 wrote to memory of 2068 5060 CAD8.tmp 108 PID 2068 wrote to memory of 3968 2068 CB45.tmp 109 PID 3968 wrote to memory of 1652 3968 CBB3.tmp 110 PID 1652 wrote to memory of 4732 1652 CC20.tmp 111 PID 4732 wrote to memory of 2720 4732 CC8D.tmp 112 PID 2720 wrote to memory of 4276 2720 CD1A.tmp 113 PID 4276 wrote to memory of 4764 4276 CDA7.tmp 114 PID 4764 wrote to memory of 3256 4764 CE33.tmp 115 PID 3256 wrote to memory of 2192 3256 CEA1.tmp 116 PID 2192 wrote to memory of 3728 2192 CF1E.tmp 117 PID 3728 wrote to memory of 3304 3728 CF8B.tmp 118 PID 3304 wrote to memory of 4960 3304 D008.tmp 119 PID 4960 wrote to memory of 3888 4960 D085.tmp 120 PID 3888 wrote to memory of 3404 3888 D102.tmp 121 PID 3404 wrote to memory of 2844 3404 D18F.tmp 122 PID 2844 wrote to memory of 4120 2844 D20C.tmp 123 PID 4120 wrote to memory of 1828 4120 D289.tmp 124 PID 1828 wrote to memory of 1748 1828 D2F6.tmp 125 PID 1748 wrote to memory of 5864 1748 D363.tmp 126 PID 5864 wrote to memory of 4292 5864 D3D1.tmp 127 PID 4292 wrote to memory of 1208 4292 D43E.tmp 128 PID 1208 wrote to memory of 1648 1208 D4AB.tmp 129 PID 1648 wrote to memory of 2480 1648 D528.tmp 130 PID 2480 wrote to memory of 5760 2480 D5A5.tmp 131 PID 5760 wrote to memory of 1628 5760 D642.tmp 132 PID 1628 wrote to memory of 5748 1628 D6BF.tmp 133 PID 5748 wrote to memory of 4348 5748 D75B.tmp 134 PID 4348 wrote to memory of 3884 4348 D7E8.tmp 135 PID 3884 wrote to memory of 2028 3884 D874.tmp 136 PID 2028 wrote to memory of 4832 2028 D8F1.tmp 137 PID 4832 wrote to memory of 5656 4832 D97E.tmp 138 PID 5656 wrote to memory of 980 5656 D9FB.tmp 139 PID 980 wrote to memory of 1496 980 DA78.tmp 140 PID 1496 wrote to memory of 2368 1496 DAF5.tmp 141 PID 2368 wrote to memory of 3444 2368 DBC0.tmp 142 PID 3444 wrote to memory of 4600 3444 DC4D.tmp 143 PID 4600 wrote to memory of 4736 4600 DCD9.tmp 144 PID 4736 wrote to memory of 264 4736 DD56.tmp 145 PID 264 wrote to memory of 3068 264 DE21.tmp 146 PID 3068 wrote to memory of 5908 3068 DEBE.tmp 147 PID 5908 wrote to memory of 1184 5908 DF2B.tmp 148 PID 1184 wrote to memory of 2292 1184 DFA8.tmp 149 PID 2292 wrote to memory of 5212 2292 E025.tmp 150 PID 5212 wrote to memory of 4620 5212 E0B2.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_1a38e9a2d26f131db3e2323c8a377ccc_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_1a38e9a2d26f131db3e2323c8a377ccc_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"C:\Users\Admin\AppData\Local\Temp\BFBC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\C152.tmp"C:\Users\Admin\AppData\Local\Temp\C152.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\C25C.tmp"C:\Users\Admin\AppData\Local\Temp\C25C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\C411.tmp"C:\Users\Admin\AppData\Local\Temp\C411.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\C53A.tmp"C:\Users\Admin\AppData\Local\Temp\C53A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\C598.tmp"C:\Users\Admin\AppData\Local\Temp\C598.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\C625.tmp"C:\Users\Admin\AppData\Local\Temp\C625.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"C:\Users\Admin\AppData\Local\Temp\C6B1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\C71F.tmp"C:\Users\Admin\AppData\Local\Temp\C71F.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\C838.tmp"C:\Users\Admin\AppData\Local\Temp\C838.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"C:\Users\Admin\AppData\Local\Temp\C9DE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\CA5B.tmp"C:\Users\Admin\AppData\Local\Temp\CA5B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\CC20.tmp"C:\Users\Admin\AppData\Local\Temp\CC20.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\D085.tmp"C:\Users\Admin\AppData\Local\Temp\D085.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\D20C.tmp"C:\Users\Admin\AppData\Local\Temp\D20C.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\D43E.tmp"C:\Users\Admin\AppData\Local\Temp\D43E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\D4AB.tmp"C:\Users\Admin\AppData\Local\Temp\D4AB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\D528.tmp"C:\Users\Admin\AppData\Local\Temp\D528.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\DD56.tmp"C:\Users\Admin\AppData\Local\Temp\DD56.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\DE21.tmp"C:\Users\Admin\AppData\Local\Temp\DE21.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"65⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"66⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"67⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"68⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"69⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"70⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"71⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\E545.tmp"C:\Users\Admin\AppData\Local\Temp\E545.tmp"72⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"73⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"74⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"75⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\E768.tmp"C:\Users\Admin\AppData\Local\Temp\E768.tmp"76⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"77⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"78⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"79⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"80⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"81⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\EB02.tmp"C:\Users\Admin\AppData\Local\Temp\EB02.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"84⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"85⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\ED92.tmp"C:\Users\Admin\AppData\Local\Temp\ED92.tmp"86⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"87⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\EECB.tmp"C:\Users\Admin\AppData\Local\Temp\EECB.tmp"88⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"89⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"90⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\F090.tmp"C:\Users\Admin\AppData\Local\Temp\F090.tmp"91⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"92⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"93⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"94⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"96⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\F468.tmp"C:\Users\Admin\AppData\Local\Temp\F468.tmp"97⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"98⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"C:\Users\Admin\AppData\Local\Temp\F5A1.tmp"99⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\F61E.tmp"C:\Users\Admin\AppData\Local\Temp\F61E.tmp"100⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"101⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"102⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"103⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"104⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"105⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\F979.tmp"C:\Users\Admin\AppData\Local\Temp\F979.tmp"106⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"107⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"108⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"110⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"111⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"112⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"113⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"114⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"115⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"117⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\FB.tmp"C:\Users\Admin\AppData\Local\Temp\FB.tmp"118⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\243.tmp"C:\Users\Admin\AppData\Local\Temp\243.tmp"120⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"121⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"122⤵PID:4140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-