Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/10/2026, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-15_16646bc75ea56bf527ce81280fa62aaf_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_16646bc75ea56bf527ce81280fa62aaf_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-15_16646bc75ea56bf527ce81280fa62aaf_elex_mafia.exe
- Size 524KB
- Sample261016-2bdsmsssbs
- SHA256 9240d3fc692a0bb65b5fea1687f45ee5657c4d45a9e03625334311b9fcf8b9f9
- MD5 16646bc75ea56bf527ce81280fa62aaf
- SHA1 0c3ef6988c0469cd020e5e0a6fdd49269e3b5311
- SHA512 ae23bf7784a03dca03bb2dcc1e2bdfe287fc06cb0b5b99732617a18c77438ed4659bad4cf3ca84cbb3c7f28b283ceb6c4a1652f6342d7dcb7e3ceb79b278db58
- SSDEEP 12288:TRyZzqyL66TRwAHCya0QYW4/QVAYRdJBrNZ:TRyQylTR9He0RW4GAgd3rN
- TLSH T12DB4F026B544C032F19205728B66EB926D3ABC759B26A4C73BC4366D6FB13D1E3B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5012 13FB.tmp 5756 1488.tmp 3232 15A1.tmp 1948 163D.tmp 2168 16AB.tmp 5040 1870.tmp 3412 194B.tmp 4724 1A45.tmp 4588 1B2F.tmp 4744 1C0A.tmp 4652 1CF4.tmp 4356 1DBF.tmp 528 1EB9.tmp 1300 1FF2.tmp 2740 20EC.tmp 2960 21B7.tmp 5444 22B1.tmp 1976 23CA.tmp 1560 2495.tmp 1608 2551.tmp 6076 260C.tmp 4316 2706.tmp 5668 27E1.tmp 3916 289D.tmp 6004 2968.tmp 4528 2A62.tmp 4532 2B0E.tmp 1572 2C08.tmp 4452 2CC3.tmp 856 2DAD.tmp 2288 2EB7.tmp 4952 2FA1.tmp 3832 309B.tmp 1964 3138.tmp 5200 31C4.tmp 5172 3251.tmp 2240 32DE.tmp 5032 3389.tmp 2524 3435.tmp 2748 34B2.tmp 5500 353F.tmp 4632 3639.tmp 4664 36C6.tmp 1732 3762.tmp 3988 37FE.tmp 5220 388B.tmp 4704 3965.tmp 5712 3A21.tmp 4548 3ABD.tmp 5292 3B59.tmp 2264 3BC7.tmp 5436 3C44.tmp 4720 3CB1.tmp 4976 3D1F.tmp 4228 3D7C.tmp 6048 3DEA.tmp 2352 3E57.tmp 3480 3ED4.tmp 3148 3F51.tmp 3604 3FCE.tmp 4272 404B.tmp 3372 40C8.tmp 2284 4135.tmp 4364 41A3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 698E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 479E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 816B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D89E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4666.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 548F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 809B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 5012 1120 2026-10-15_16646bc75ea56bf527ce81280fa62aaf_elex_mafia.exe 89 PID 5012 wrote to memory of 5756 5012 13FB.tmp 90 PID 5756 wrote to memory of 3232 5756 1488.tmp 91 PID 3232 wrote to memory of 1948 3232 15A1.tmp 92 PID 1948 wrote to memory of 2168 1948 163D.tmp 93 PID 2168 wrote to memory of 5040 2168 16AB.tmp 94 PID 5040 wrote to memory of 3412 5040 1870.tmp 95 PID 3412 wrote to memory of 4724 3412 194B.tmp 96 PID 4724 wrote to memory of 4588 4724 1A45.tmp 97 PID 4588 wrote to memory of 4744 4588 1B2F.tmp 98 PID 4744 wrote to memory of 4652 4744 1C0A.tmp 99 PID 4652 wrote to memory of 4356 4652 1CF4.tmp 100 PID 4356 wrote to memory of 528 4356 1DBF.tmp 101 PID 528 wrote to memory of 1300 528 1EB9.tmp 102 PID 1300 wrote to memory of 2740 1300 1FF2.tmp 103 PID 2740 wrote to memory of 2960 2740 20EC.tmp 104 PID 2960 wrote to memory of 5444 2960 21B7.tmp 105 PID 5444 wrote to memory of 1976 5444 22B1.tmp 106 PID 1976 wrote to memory of 1560 1976 23CA.tmp 107 PID 1560 wrote to memory of 1608 1560 2495.tmp 108 PID 1608 wrote to memory of 6076 1608 2551.tmp 109 PID 6076 wrote to memory of 4316 6076 260C.tmp 110 PID 4316 wrote to memory of 5668 4316 2706.tmp 111 PID 5668 wrote to memory of 3916 5668 27E1.tmp 112 PID 3916 wrote to memory of 6004 3916 289D.tmp 113 PID 6004 wrote to memory of 4528 6004 2968.tmp 114 PID 4528 wrote to memory of 4532 4528 2A62.tmp 115 PID 4532 wrote to memory of 1572 4532 2B0E.tmp 116 PID 1572 wrote to memory of 4452 1572 2C08.tmp 117 PID 4452 wrote to memory of 856 4452 2CC3.tmp 118 PID 856 wrote to memory of 2288 856 2DAD.tmp 119 PID 2288 wrote to memory of 4952 2288 2EB7.tmp 120 PID 4952 wrote to memory of 3832 4952 2FA1.tmp 121 PID 3832 wrote to memory of 1964 3832 309B.tmp 122 PID 1964 wrote to memory of 5200 1964 3138.tmp 123 PID 5200 wrote to memory of 5172 5200 31C4.tmp 124 PID 5172 wrote to memory of 2240 5172 3251.tmp 125 PID 2240 wrote to memory of 5032 2240 32DE.tmp 126 PID 5032 wrote to memory of 2524 5032 3389.tmp 127 PID 2524 wrote to memory of 2748 2524 3435.tmp 128 PID 2748 wrote to memory of 5500 2748 34B2.tmp 129 PID 5500 wrote to memory of 4632 5500 353F.tmp 130 PID 4632 wrote to memory of 4664 4632 3639.tmp 131 PID 4664 wrote to memory of 1732 4664 36C6.tmp 132 PID 1732 wrote to memory of 3988 1732 3762.tmp 133 PID 3988 wrote to memory of 5220 3988 37FE.tmp 134 PID 5220 wrote to memory of 4704 5220 388B.tmp 135 PID 4704 wrote to memory of 5712 4704 3965.tmp 136 PID 5712 wrote to memory of 4548 5712 3A21.tmp 137 PID 4548 wrote to memory of 5292 4548 3ABD.tmp 138 PID 5292 wrote to memory of 2264 5292 3B59.tmp 139 PID 2264 wrote to memory of 5436 2264 3BC7.tmp 140 PID 5436 wrote to memory of 4720 5436 3C44.tmp 141 PID 4720 wrote to memory of 4976 4720 3CB1.tmp 142 PID 4976 wrote to memory of 4228 4976 3D1F.tmp 143 PID 4228 wrote to memory of 6048 4228 3D7C.tmp 144 PID 6048 wrote to memory of 2352 6048 3DEA.tmp 145 PID 2352 wrote to memory of 3480 2352 3E57.tmp 146 PID 3480 wrote to memory of 3148 3480 3ED4.tmp 147 PID 3148 wrote to memory of 3604 3148 3F51.tmp 148 PID 3604 wrote to memory of 4272 3604 3FCE.tmp 149 PID 4272 wrote to memory of 3372 4272 404B.tmp 150 PID 3372 wrote to memory of 2284 3372 40C8.tmp 151 PID 2284 wrote to memory of 4364 2284 4135.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_16646bc75ea56bf527ce81280fa62aaf_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_16646bc75ea56bf527ce81280fa62aaf_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\20EC.tmp"C:\Users\Admin\AppData\Local\Temp\20EC.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\22B1.tmp"C:\Users\Admin\AppData\Local\Temp\22B1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\27E1.tmp"C:\Users\Admin\AppData\Local\Temp\27E1.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\2B0E.tmp"C:\Users\Admin\AppData\Local\Temp\2B0E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\3251.tmp"C:\Users\Admin\AppData\Local\Temp\3251.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\37FE.tmp"C:\Users\Admin\AppData\Local\Temp\37FE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\388B.tmp"C:\Users\Admin\AppData\Local\Temp\388B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3C44.tmp"C:\Users\Admin\AppData\Local\Temp\3C44.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\41A3.tmp"C:\Users\Admin\AppData\Local\Temp\41A3.tmp"65⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"66⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"67⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\430A.tmp"C:\Users\Admin\AppData\Local\Temp\430A.tmp"68⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"69⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\43E5.tmp"C:\Users\Admin\AppData\Local\Temp\43E5.tmp"70⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"71⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"72⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"73⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\45AA.tmp"C:\Users\Admin\AppData\Local\Temp\45AA.tmp"74⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"75⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\4666.tmp"C:\Users\Admin\AppData\Local\Temp\4666.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:760 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"77⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"78⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\481B.tmp"C:\Users\Admin\AppData\Local\Temp\481B.tmp"80⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\4898.tmp"C:\Users\Admin\AppData\Local\Temp\4898.tmp"81⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"82⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"83⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\49E0.tmp"C:\Users\Admin\AppData\Local\Temp\49E0.tmp"84⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"86⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"87⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"88⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\4C22.tmp"C:\Users\Admin\AppData\Local\Temp\4C22.tmp"89⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"90⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"91⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"92⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"93⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\4E64.tmp"C:\Users\Admin\AppData\Local\Temp\4E64.tmp"94⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"95⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"97⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"98⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"99⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"100⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"101⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"102⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\523D.tmp"C:\Users\Admin\AppData\Local\Temp\523D.tmp"103⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\52BA.tmp"C:\Users\Admin\AppData\Local\Temp\52BA.tmp"104⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\5337.tmp"C:\Users\Admin\AppData\Local\Temp\5337.tmp"105⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"106⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\5421.tmp"C:\Users\Admin\AppData\Local\Temp\5421.tmp"107⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\548F.tmp"C:\Users\Admin\AppData\Local\Temp\548F.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\54FC.tmp"C:\Users\Admin\AppData\Local\Temp\54FC.tmp"109⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\555A.tmp"C:\Users\Admin\AppData\Local\Temp\555A.tmp"110⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\55D7.tmp"C:\Users\Admin\AppData\Local\Temp\55D7.tmp"111⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"112⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"113⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5700.tmp"C:\Users\Admin\AppData\Local\Temp\5700.tmp"114⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\576D.tmp"C:\Users\Admin\AppData\Local\Temp\576D.tmp"115⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"116⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5828.tmp"C:\Users\Admin\AppData\Local\Temp\5828.tmp"117⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\5896.tmp"C:\Users\Admin\AppData\Local\Temp\5896.tmp"118⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\5913.tmp"C:\Users\Admin\AppData\Local\Temp\5913.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"120⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"121⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-