Analysis
- max time kernel
122s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 08:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_8403def5854f2ad4e8ecff2543614999_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_8403def5854f2ad4e8ecff2543614999_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-02_8403def5854f2ad4e8ecff2543614999_elex_mafia.exe
- Size 520KB
- Sample261003-ktmd3avcpd
- SHA256 4a793eeddf6d130ff015806cc37d13c7a717b3b17c8adf21ec3bdbe4ea541f9d
- MD5 8403def5854f2ad4e8ecff2543614999
- SHA1 93279f40ccbf170d5b741b904b5d491dfb129dc8
- SHA512 231864d02b6215dd4912560921bd193e697e935447c7fa10645ff93469a1da5587f27ff7958fa26980ee783c0acd57cef8d60c67825fb374dad99aa47c452bea
- SSDEEP 12288:gj8fuxR21t5i8fAdI8O4ts6MB94xLZc506LNZ6:gj8fuK1GYsI8/MBSLcXNI
- TLSH T1D3B4F112B948C033E5D205314A66DBA10BBA7D799B3685C73B9036AD6FB53D1D73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1968 FDE3.tmp 5228 FE8F.tmp 4092 FFA8.tmp 4712 64.tmp 2440 100.tmp 1332 1BB.tmp 2712 296.tmp 5556 323.tmp 3736 3A0.tmp 4308 48A.tmp 5892 594.tmp 3756 630.tmp 4200 6BD.tmp 620 749.tmp 2300 7C6.tmp 800 8B1.tmp 4852 94D.tmp 5616 A18.tmp 3652 A85.tmp 4612 B41.tmp 252 C2B.tmp 1528 CC8.tmp 596 D73.tmp 5376 E1F.tmp 4708 F29.tmp 4128 1004.tmp 624 110D.tmp 5736 11D8.tmp 3416 1294.tmp 2836 1321.tmp 3352 13EC.tmp 2336 1498.tmp 4500 1524.tmp 5520 15A1.tmp 3304 161E.tmp 4488 16CA.tmp 5716 1757.tmp 6092 17D4.tmp 2612 1851.tmp 2784 18DD.tmp 4936 197A.tmp 4864 1A16.tmp 4608 1A93.tmp 1516 1B1F.tmp 4236 1BCB.tmp 4400 1C48.tmp 4644 1CC5.tmp 2932 1D42.tmp 2196 1DBF.tmp 4376 1E3C.tmp 4660 1ED9.tmp 1832 1F65.tmp 5584 1FE2.tmp 2244 205F.tmp 2832 20EC.tmp 6076 2188.tmp 4224 21F5.tmp 4420 2282.tmp 2964 231E.tmp 916 23AB.tmp 6072 2447.tmp 2644 24D4.tmp 2892 2570.tmp 3532 25DD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 322D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 134B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 351B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 610D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C48.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 1968 4216 2026-10-02_8403def5854f2ad4e8ecff2543614999_elex_mafia.exe 89 PID 1968 wrote to memory of 5228 1968 FDE3.tmp 90 PID 5228 wrote to memory of 4092 5228 FE8F.tmp 91 PID 4092 wrote to memory of 4712 4092 FFA8.tmp 92 PID 4712 wrote to memory of 2440 4712 64.tmp 93 PID 2440 wrote to memory of 1332 2440 100.tmp 94 PID 1332 wrote to memory of 2712 1332 1BB.tmp 95 PID 2712 wrote to memory of 5556 2712 296.tmp 96 PID 5556 wrote to memory of 3736 5556 323.tmp 97 PID 3736 wrote to memory of 4308 3736 3A0.tmp 98 PID 4308 wrote to memory of 5892 4308 48A.tmp 99 PID 5892 wrote to memory of 3756 5892 594.tmp 100 PID 3756 wrote to memory of 4200 3756 630.tmp 101 PID 4200 wrote to memory of 620 4200 6BD.tmp 102 PID 620 wrote to memory of 2300 620 749.tmp 103 PID 2300 wrote to memory of 800 2300 7C6.tmp 104 PID 800 wrote to memory of 4852 800 8B1.tmp 105 PID 4852 wrote to memory of 5616 4852 94D.tmp 106 PID 5616 wrote to memory of 3652 5616 A18.tmp 107 PID 3652 wrote to memory of 4612 3652 A85.tmp 108 PID 4612 wrote to memory of 252 4612 B41.tmp 109 PID 252 wrote to memory of 1528 252 C2B.tmp 110 PID 1528 wrote to memory of 596 1528 CC8.tmp 111 PID 596 wrote to memory of 5376 596 D73.tmp 112 PID 5376 wrote to memory of 4708 5376 E1F.tmp 113 PID 4708 wrote to memory of 4128 4708 F29.tmp 114 PID 4128 wrote to memory of 624 4128 1004.tmp 115 PID 624 wrote to memory of 5736 624 110D.tmp 116 PID 5736 wrote to memory of 3416 5736 11D8.tmp 117 PID 3416 wrote to memory of 2836 3416 1294.tmp 118 PID 2836 wrote to memory of 3352 2836 1321.tmp 119 PID 3352 wrote to memory of 2336 3352 13EC.tmp 120 PID 2336 wrote to memory of 4500 2336 1498.tmp 121 PID 4500 wrote to memory of 5520 4500 1524.tmp 122 PID 5520 wrote to memory of 3304 5520 15A1.tmp 123 PID 3304 wrote to memory of 4488 3304 161E.tmp 124 PID 4488 wrote to memory of 5716 4488 16CA.tmp 125 PID 5716 wrote to memory of 6092 5716 1757.tmp 126 PID 6092 wrote to memory of 2612 6092 17D4.tmp 127 PID 2612 wrote to memory of 2784 2612 1851.tmp 128 PID 2784 wrote to memory of 4936 2784 18DD.tmp 129 PID 4936 wrote to memory of 4864 4936 197A.tmp 130 PID 4864 wrote to memory of 4608 4864 1A16.tmp 131 PID 4608 wrote to memory of 1516 4608 1A93.tmp 132 PID 1516 wrote to memory of 4236 1516 1B1F.tmp 133 PID 4236 wrote to memory of 4400 4236 1BCB.tmp 134 PID 4400 wrote to memory of 4644 4400 1C48.tmp 135 PID 4644 wrote to memory of 2932 4644 1CC5.tmp 136 PID 2932 wrote to memory of 2196 2932 1D42.tmp 137 PID 2196 wrote to memory of 4376 2196 1DBF.tmp 138 PID 4376 wrote to memory of 4660 4376 1E3C.tmp 139 PID 4660 wrote to memory of 1832 4660 1ED9.tmp 140 PID 1832 wrote to memory of 5584 1832 1F65.tmp 141 PID 5584 wrote to memory of 2244 5584 1FE2.tmp 142 PID 2244 wrote to memory of 2832 2244 205F.tmp 143 PID 2832 wrote to memory of 6076 2832 20EC.tmp 144 PID 6076 wrote to memory of 4224 6076 2188.tmp 145 PID 4224 wrote to memory of 4420 4224 21F5.tmp 146 PID 4420 wrote to memory of 2964 4420 2282.tmp 147 PID 2964 wrote to memory of 916 2964 231E.tmp 148 PID 916 wrote to memory of 6072 916 23AB.tmp 149 PID 6072 wrote to memory of 2644 6072 2447.tmp 150 PID 2644 wrote to memory of 2892 2644 24D4.tmp 151 PID 2892 wrote to memory of 3532 2892 2570.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_8403def5854f2ad4e8ecff2543614999_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_8403def5854f2ad4e8ecff2543614999_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\64.tmp"C:\Users\Admin\AppData\Local\Temp\64.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\100.tmp"C:\Users\Admin\AppData\Local\Temp\100.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1BB.tmp"C:\Users\Admin\AppData\Local\Temp\1BB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\3A0.tmp"C:\Users\Admin\AppData\Local\Temp\3A0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\594.tmp"C:\Users\Admin\AppData\Local\Temp\594.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\6BD.tmp"C:\Users\Admin\AppData\Local\Temp\6BD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\A18.tmp"C:\Users\Admin\AppData\Local\Temp\A18.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\B41.tmp"C:\Users\Admin\AppData\Local\Temp\B41.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\1321.tmp"C:\Users\Admin\AppData\Local\Temp\1321.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\161E.tmp"C:\Users\Admin\AppData\Local\Temp\161E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\18DD.tmp"C:\Users\Admin\AppData\Local\Temp\18DD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1A93.tmp"C:\Users\Admin\AppData\Local\Temp\1A93.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\1D42.tmp"C:\Users\Admin\AppData\Local\Temp\1D42.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\1F65.tmp"C:\Users\Admin\AppData\Local\Temp\1F65.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1FE2.tmp"C:\Users\Admin\AppData\Local\Temp\1FE2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\20EC.tmp"C:\Users\Admin\AppData\Local\Temp\20EC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\21F5.tmp"C:\Users\Admin\AppData\Local\Temp\21F5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2282.tmp"C:\Users\Admin\AppData\Local\Temp\2282.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\231E.tmp"C:\Users\Admin\AppData\Local\Temp\231E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\23AB.tmp"C:\Users\Admin\AppData\Local\Temp\23AB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\24D4.tmp"C:\Users\Admin\AppData\Local\Temp\24D4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"65⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"66⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"67⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"68⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\2800.tmp"C:\Users\Admin\AppData\Local\Temp\2800.tmp"69⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"70⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\2929.tmp"C:\Users\Admin\AppData\Local\Temp\2929.tmp"71⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\29B6.tmp"C:\Users\Admin\AppData\Local\Temp\29B6.tmp"72⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\2A33.tmp"C:\Users\Admin\AppData\Local\Temp\2A33.tmp"73⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"74⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"75⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"76⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2C56.tmp"C:\Users\Admin\AppData\Local\Temp\2C56.tmp"77⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"78⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"79⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"80⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"C:\Users\Admin\AppData\Local\Temp\2EC7.tmp"81⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"82⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\305D.tmp"C:\Users\Admin\AppData\Local\Temp\305D.tmp"84⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\30DA.tmp"C:\Users\Admin\AppData\Local\Temp\30DA.tmp"85⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\3157.tmp"C:\Users\Admin\AppData\Local\Temp\3157.tmp"86⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"87⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"88⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"89⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"90⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"91⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"92⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"93⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"94⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"95⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"96⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"97⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"98⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"99⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\3937.tmp"C:\Users\Admin\AppData\Local\Temp\3937.tmp"100⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\39B4.tmp"C:\Users\Admin\AppData\Local\Temp\39B4.tmp"101⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3A31.tmp"C:\Users\Admin\AppData\Local\Temp\3A31.tmp"102⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"103⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"104⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"105⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"106⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"107⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"109⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"110⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"111⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"112⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"114⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\4184.tmp"C:\Users\Admin\AppData\Local\Temp\4184.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4201.tmp"C:\Users\Admin\AppData\Local\Temp\4201.tmp"116⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"117⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"118⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"119⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"121⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"122⤵PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-