Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_caa68efb9d2e82fe3502a1c997e3e215_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_caa68efb9d2e82fe3502a1c997e3e215_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-02_caa68efb9d2e82fe3502a1c997e3e215_elex_mafia.exe
- Size 520KB
- Sample261102-2m6b2afy2q
- SHA256 4d57ea32187e862e00c7c55e528a91b42969f69dec68350533cee2ce6676d100
- MD5 caa68efb9d2e82fe3502a1c997e3e215
- SHA1 29732b98279836cbc2c5c1eba8aea8a2a175551d
- SHA512 905422a31cf58bf6fc7ad9219aa6e9ca49269824538e23d81b8ec36be23e3ceb96acd69df17cbcee1e63046ce6d003267a5d446687a9b641947140b55e1e4f7c
- SSDEEP 12288:roRXOQjmOylALwTCUBjF1lr6YEfkrMf6Fi8NZ:rogQ9yJFflrPZi6nN
- TLSH T1E8B4F0127588C036E1D256348B22DFA24B3E7D769B2696C73B8437696FB02C2E774347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6016 135F.tmp 5484 13EC.tmp 4544 14E6.tmp 3452 1592.tmp 2872 162E.tmp 5460 16BA.tmp 1556 1737.tmp 4428 17C4.tmp 4656 1870.tmp 3168 194B.tmp 1864 19D7.tmp 4928 1A64.tmp 2292 1B8D.tmp 2944 1C48.tmp 5096 1D13.tmp 3404 1DA0.tmp 4616 1E1D.tmp 1436 1E8A.tmp 352 1F46.tmp 992 2011.tmp 4940 208E.tmp 5576 214A.tmp 4800 21C7.tmp 2972 2253.tmp 2488 22D0.tmp 5444 237C.tmp 5676 2428.tmp 3356 2503.tmp 5040 259F.tmp 2344 264B.tmp 1804 2716.tmp 2976 27C2.tmp 3536 285E.tmp 2712 28EB.tmp 2816 2968.tmp 3764 29F4.tmp 5500 2A62.tmp 5856 2ACF.tmp 2584 2B3C.tmp 4276 2BAA.tmp 3048 2C27.tmp 1276 2C94.tmp 5332 2D02.tmp 4876 2DAD.tmp 1568 2E1B.tmp 2548 2E79.tmp 1944 2EE6.tmp 3924 2F63.tmp 1428 2FE0.tmp 3760 304D.tmp 4904 30CA.tmp 6104 3128.tmp 4808 31A5.tmp 1088 3222.tmp 4772 3280.tmp 5308 32ED.tmp 4192 336A.tmp 2540 33D8.tmp 904 3445.tmp 3976 34C2.tmp 2436 353F.tmp 4464 35DB.tmp 2856 3649.tmp 2744 36D5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1592.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B59A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3796 wrote to memory of 6016 3796 2026-11-02_caa68efb9d2e82fe3502a1c997e3e215_elex_mafia.exe 89 PID 6016 wrote to memory of 5484 6016 135F.tmp 90 PID 5484 wrote to memory of 4544 5484 13EC.tmp 91 PID 4544 wrote to memory of 3452 4544 14E6.tmp 92 PID 3452 wrote to memory of 2872 3452 1592.tmp 93 PID 2872 wrote to memory of 5460 2872 162E.tmp 94 PID 5460 wrote to memory of 1556 5460 16BA.tmp 95 PID 1556 wrote to memory of 4428 1556 1737.tmp 96 PID 4428 wrote to memory of 4656 4428 17C4.tmp 97 PID 4656 wrote to memory of 3168 4656 1870.tmp 98 PID 3168 wrote to memory of 1864 3168 194B.tmp 99 PID 1864 wrote to memory of 4928 1864 19D7.tmp 100 PID 4928 wrote to memory of 2292 4928 1A64.tmp 101 PID 2292 wrote to memory of 2944 2292 1B8D.tmp 102 PID 2944 wrote to memory of 5096 2944 1C48.tmp 103 PID 5096 wrote to memory of 3404 5096 1D13.tmp 104 PID 3404 wrote to memory of 4616 3404 1DA0.tmp 105 PID 4616 wrote to memory of 1436 4616 1E1D.tmp 106 PID 1436 wrote to memory of 352 1436 1E8A.tmp 107 PID 352 wrote to memory of 992 352 1F46.tmp 108 PID 992 wrote to memory of 4940 992 2011.tmp 109 PID 4940 wrote to memory of 5576 4940 208E.tmp 110 PID 5576 wrote to memory of 4800 5576 214A.tmp 111 PID 4800 wrote to memory of 2972 4800 21C7.tmp 112 PID 2972 wrote to memory of 2488 2972 2253.tmp 113 PID 2488 wrote to memory of 5444 2488 22D0.tmp 114 PID 5444 wrote to memory of 5676 5444 237C.tmp 115 PID 5676 wrote to memory of 3356 5676 2428.tmp 116 PID 3356 wrote to memory of 5040 3356 2503.tmp 117 PID 5040 wrote to memory of 2344 5040 259F.tmp 118 PID 2344 wrote to memory of 1804 2344 264B.tmp 119 PID 1804 wrote to memory of 2976 1804 2716.tmp 120 PID 2976 wrote to memory of 3536 2976 27C2.tmp 121 PID 3536 wrote to memory of 2712 3536 285E.tmp 122 PID 2712 wrote to memory of 2816 2712 28EB.tmp 123 PID 2816 wrote to memory of 3764 2816 2968.tmp 124 PID 3764 wrote to memory of 5500 3764 29F4.tmp 125 PID 5500 wrote to memory of 5856 5500 2A62.tmp 126 PID 5856 wrote to memory of 2584 5856 2ACF.tmp 127 PID 2584 wrote to memory of 4276 2584 2B3C.tmp 128 PID 4276 wrote to memory of 3048 4276 2BAA.tmp 129 PID 3048 wrote to memory of 1276 3048 2C27.tmp 130 PID 1276 wrote to memory of 5332 1276 2C94.tmp 131 PID 5332 wrote to memory of 4876 5332 2D02.tmp 132 PID 4876 wrote to memory of 1568 4876 2DAD.tmp 133 PID 1568 wrote to memory of 2548 1568 2E1B.tmp 134 PID 2548 wrote to memory of 1944 2548 2E79.tmp 135 PID 1944 wrote to memory of 3924 1944 2EE6.tmp 136 PID 3924 wrote to memory of 1428 3924 2F63.tmp 137 PID 1428 wrote to memory of 3760 1428 2FE0.tmp 138 PID 3760 wrote to memory of 4904 3760 304D.tmp 139 PID 4904 wrote to memory of 6104 4904 30CA.tmp 140 PID 6104 wrote to memory of 4808 6104 3128.tmp 141 PID 4808 wrote to memory of 1088 4808 31A5.tmp 142 PID 1088 wrote to memory of 4772 1088 3222.tmp 143 PID 4772 wrote to memory of 5308 4772 3280.tmp 144 PID 5308 wrote to memory of 4192 5308 32ED.tmp 145 PID 4192 wrote to memory of 2540 4192 336A.tmp 146 PID 2540 wrote to memory of 904 2540 33D8.tmp 147 PID 904 wrote to memory of 3976 904 3445.tmp 148 PID 3976 wrote to memory of 2436 3976 34C2.tmp 149 PID 2436 wrote to memory of 4464 2436 353F.tmp 150 PID 4464 wrote to memory of 2856 4464 35DB.tmp 151 PID 2856 wrote to memory of 2744 2856 3649.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_caa68efb9d2e82fe3502a1c997e3e215_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_caa68efb9d2e82fe3502a1c997e3e215_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\162E.tmp"C:\Users\Admin\AppData\Local\Temp\162E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\1737.tmp"C:\Users\Admin\AppData\Local\Temp\1737.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1F46.tmp"C:\Users\Admin\AppData\Local\Temp\1F46.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\214A.tmp"C:\Users\Admin\AppData\Local\Temp\214A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\22D0.tmp"C:\Users\Admin\AppData\Local\Temp\22D0.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\2428.tmp"C:\Users\Admin\AppData\Local\Temp\2428.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\264B.tmp"C:\Users\Admin\AppData\Local\Temp\264B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\27C2.tmp"C:\Users\Admin\AppData\Local\Temp\27C2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\285E.tmp"C:\Users\Admin\AppData\Local\Temp\285E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\2B3C.tmp"C:\Users\Admin\AppData\Local\Temp\2B3C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2C27.tmp"C:\Users\Admin\AppData\Local\Temp\2C27.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2D02.tmp"C:\Users\Admin\AppData\Local\Temp\2D02.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\2E79.tmp"C:\Users\Admin\AppData\Local\Temp\2E79.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\30CA.tmp"C:\Users\Admin\AppData\Local\Temp\30CA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\31A5.tmp"C:\Users\Admin\AppData\Local\Temp\31A5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3222.tmp"C:\Users\Admin\AppData\Local\Temp\3222.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3280.tmp"C:\Users\Admin\AppData\Local\Temp\3280.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3445.tmp"C:\Users\Admin\AppData\Local\Temp\3445.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\34C2.tmp"C:\Users\Admin\AppData\Local\Temp\34C2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\3649.tmp"C:\Users\Admin\AppData\Local\Temp\3649.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"65⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"66⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"67⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"68⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"69⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\38F8.tmp"C:\Users\Admin\AppData\Local\Temp\38F8.tmp"70⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"71⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"72⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"73⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"74⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"75⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"76⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"77⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\3C82.tmp"C:\Users\Admin\AppData\Local\Temp\3C82.tmp"78⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"79⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"80⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"81⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"83⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"84⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"85⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"86⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"87⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4126.tmp"C:\Users\Admin\AppData\Local\Temp\4126.tmp"88⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\41A3.tmp"C:\Users\Admin\AppData\Local\Temp\41A3.tmp"89⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"90⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"91⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"92⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\43A6.tmp"C:\Users\Admin\AppData\Local\Temp\43A6.tmp"93⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"94⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"95⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"96⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\456C.tmp"C:\Users\Admin\AppData\Local\Temp\456C.tmp"97⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"98⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"99⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\46F2.tmp"C:\Users\Admin\AppData\Local\Temp\46F2.tmp"100⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\476F.tmp"C:\Users\Admin\AppData\Local\Temp\476F.tmp"101⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"102⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\485A.tmp"C:\Users\Admin\AppData\Local\Temp\485A.tmp"103⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"104⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4934.tmp"C:\Users\Admin\AppData\Local\Temp\4934.tmp"105⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"106⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"107⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4B09.tmp"C:\Users\Admin\AppData\Local\Temp\4B09.tmp"109⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\4B96.tmp"C:\Users\Admin\AppData\Local\Temp\4B96.tmp"110⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"111⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"112⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"113⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"115⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"116⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"117⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"118⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"119⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"120⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"121⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\50E5.tmp"C:\Users\Admin\AppData\Local\Temp\50E5.tmp"122⤵PID:4140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-