Analysis
- max time kernel
122s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_f544db9f68b90f44e6fe831ea47fee01_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_f544db9f68b90f44e6fe831ea47fee01_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-02_f544db9f68b90f44e6fe831ea47fee01_elex_mafia.exe
- Size 524KB
- Sample261102-wp8bhsd15j
- SHA256 c6d35770a4253462bb3b51cccfa53d2d503457bd55165b4bdb33a64637d8a9ac
- MD5 f544db9f68b90f44e6fe831ea47fee01
- SHA1 51e659051c51e5a4f408091975667cf21d2532bc
- SHA512 bcfdd62e2c7970d9c59b51981749b06281ec3f1b3bfc1ab641d7cffcf2bec3dee292bb842e43e2d0462420417065721e130d96e7f64f1848c5675778ae890262
- SSDEEP 12288:TRyZzqyL66TP0OMUXst9vCgNsLgM6t1Zc3EBGNZ:TRyQylTyRCgMgM6t1+0QN
- TLSH T1A5B4F125B585C032E29205368B66EB62587E7D72AB2794CB3B85253E6FF03C1D778307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4688 E46B.tmp 4612 E526.tmp 5752 E68E.tmp 2692 E7C6.tmp 3476 E8B0.tmp 6024 E92D.tmp 1328 E99B.tmp 3708 EAB4.tmp 480 EB9E.tmp 2508 EC89.tmp 4352 EDA2.tmp 4172 EE7D.tmp 1572 EF48.tmp 2068 F061.tmp 4672 F15B.tmp 4392 F246.tmp 2688 F311.tmp 2436 F3FB.tmp 4828 F4D6.tmp 2560 F5FF.tmp 6048 F6E9.tmp 1172 F7C4.tmp 6056 F8AE.tmp 3356 F999.tmp 5232 FAD1.tmp 2292 FBFA.tmp 2528 FD13.tmp 5740 FE0D.tmp 6064 FEC9.tmp 5124 FFF2.tmp 1512 10B.tmp 2748 224.tmp 204 2EF.tmp 3156 3BA.tmp 3100 437.tmp 5108 4E3.tmp 5580 551.tmp 552 63B.tmp 2612 6C8.tmp 4620 7A2.tmp 5968 88D.tmp 2204 987.tmp 4292 A42.tmp 864 ACF.tmp 5772 B7B.tmp 3500 C55.tmp 3328 CC3.tmp 4340 D40.tmp 5420 DDC.tmp 3780 E88.tmp 4396 F05.tmp 5020 F72.tmp 3640 FFF.tmp 4376 105D.tmp 6040 10E9.tmp 5964 1166.tmp 2932 11E3.tmp 244 1260.tmp 1344 12DD.tmp 1404 135A.tmp 2992 13D7.tmp 1088 1474.tmp 3420 1500.tmp 4444 157D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 203B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 825B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 669B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D439.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 367.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D58.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4160 wrote to memory of 4688 4160 2026-11-02_f544db9f68b90f44e6fe831ea47fee01_elex_mafia.exe 88 PID 4688 wrote to memory of 4612 4688 E46B.tmp 89 PID 4612 wrote to memory of 5752 4612 E526.tmp 90 PID 5752 wrote to memory of 2692 5752 E68E.tmp 91 PID 2692 wrote to memory of 3476 2692 E7C6.tmp 92 PID 3476 wrote to memory of 6024 3476 E8B0.tmp 93 PID 6024 wrote to memory of 1328 6024 E92D.tmp 94 PID 1328 wrote to memory of 3708 1328 E99B.tmp 95 PID 3708 wrote to memory of 480 3708 EAB4.tmp 96 PID 480 wrote to memory of 2508 480 EB9E.tmp 97 PID 2508 wrote to memory of 4352 2508 EC89.tmp 98 PID 4352 wrote to memory of 4172 4352 EDA2.tmp 99 PID 4172 wrote to memory of 1572 4172 EE7D.tmp 100 PID 1572 wrote to memory of 2068 1572 EF48.tmp 101 PID 2068 wrote to memory of 4672 2068 F061.tmp 102 PID 4672 wrote to memory of 4392 4672 F15B.tmp 103 PID 4392 wrote to memory of 2688 4392 F246.tmp 104 PID 2688 wrote to memory of 2436 2688 F311.tmp 105 PID 2436 wrote to memory of 4828 2436 F3FB.tmp 106 PID 4828 wrote to memory of 2560 4828 F4D6.tmp 107 PID 2560 wrote to memory of 6048 2560 F5FF.tmp 108 PID 6048 wrote to memory of 1172 6048 F6E9.tmp 109 PID 1172 wrote to memory of 6056 1172 F7C4.tmp 110 PID 6056 wrote to memory of 3356 6056 F8AE.tmp 111 PID 3356 wrote to memory of 5232 3356 F999.tmp 112 PID 5232 wrote to memory of 2292 5232 FAD1.tmp 113 PID 2292 wrote to memory of 2528 2292 FBFA.tmp 114 PID 2528 wrote to memory of 5740 2528 FD13.tmp 115 PID 5740 wrote to memory of 6064 5740 FE0D.tmp 116 PID 6064 wrote to memory of 5124 6064 FEC9.tmp 117 PID 5124 wrote to memory of 1512 5124 FFF2.tmp 118 PID 1512 wrote to memory of 2748 1512 10B.tmp 119 PID 2748 wrote to memory of 204 2748 224.tmp 120 PID 204 wrote to memory of 3156 204 2EF.tmp 121 PID 3156 wrote to memory of 3100 3156 3BA.tmp 122 PID 3100 wrote to memory of 5108 3100 437.tmp 123 PID 5108 wrote to memory of 5580 5108 4E3.tmp 124 PID 5580 wrote to memory of 552 5580 551.tmp 125 PID 552 wrote to memory of 2612 552 63B.tmp 126 PID 2612 wrote to memory of 4620 2612 6C8.tmp 127 PID 4620 wrote to memory of 5968 4620 7A2.tmp 128 PID 5968 wrote to memory of 2204 5968 88D.tmp 129 PID 2204 wrote to memory of 4292 2204 987.tmp 130 PID 4292 wrote to memory of 864 4292 A42.tmp 131 PID 864 wrote to memory of 5772 864 ACF.tmp 132 PID 5772 wrote to memory of 3500 5772 B7B.tmp 133 PID 3500 wrote to memory of 3328 3500 C55.tmp 134 PID 3328 wrote to memory of 4340 3328 CC3.tmp 135 PID 4340 wrote to memory of 5420 4340 D40.tmp 136 PID 5420 wrote to memory of 3780 5420 DDC.tmp 137 PID 3780 wrote to memory of 4396 3780 E88.tmp 138 PID 4396 wrote to memory of 5020 4396 F05.tmp 139 PID 5020 wrote to memory of 3640 5020 F72.tmp 140 PID 3640 wrote to memory of 4376 3640 FFF.tmp 141 PID 4376 wrote to memory of 6040 4376 105D.tmp 142 PID 6040 wrote to memory of 5964 6040 10E9.tmp 143 PID 5964 wrote to memory of 2932 5964 1166.tmp 144 PID 2932 wrote to memory of 244 2932 11E3.tmp 145 PID 244 wrote to memory of 1344 244 1260.tmp 146 PID 1344 wrote to memory of 1404 1344 12DD.tmp 147 PID 1404 wrote to memory of 2992 1404 135A.tmp 148 PID 2992 wrote to memory of 1088 2992 13D7.tmp 149 PID 1088 wrote to memory of 3420 1088 1474.tmp 150 PID 3420 wrote to memory of 4444 3420 1500.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_f544db9f68b90f44e6fe831ea47fee01_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f544db9f68b90f44e6fe831ea47fee01_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\E99B.tmp"C:\Users\Admin\AppData\Local\Temp\E99B.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\EE7D.tmp"C:\Users\Admin\AppData\Local\Temp\EE7D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\F061.tmp"C:\Users\Admin\AppData\Local\Temp\F061.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\F311.tmp"C:\Users\Admin\AppData\Local\Temp\F311.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"C:\Users\Admin\AppData\Local\Temp\F8AE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2EF.tmp"C:\Users\Admin\AppData\Local\Temp\2EF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\4E3.tmp"C:\Users\Admin\AppData\Local\Temp\4E3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\63B.tmp"C:\Users\Admin\AppData\Local\Temp\63B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\6C8.tmp"C:\Users\Admin\AppData\Local\Temp\6C8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7A2.tmp"C:\Users\Admin\AppData\Local\Temp\7A2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\ACF.tmp"C:\Users\Admin\AppData\Local\Temp\ACF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\B7B.tmp"C:\Users\Admin\AppData\Local\Temp\B7B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\C55.tmp"C:\Users\Admin\AppData\Local\Temp\C55.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\D40.tmp"C:\Users\Admin\AppData\Local\Temp\D40.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\DDC.tmp"C:\Users\Admin\AppData\Local\Temp\DDC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\E88.tmp"C:\Users\Admin\AppData\Local\Temp\E88.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\F72.tmp"C:\Users\Admin\AppData\Local\Temp\F72.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\10E9.tmp"C:\Users\Admin\AppData\Local\Temp\10E9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\1166.tmp"C:\Users\Admin\AppData\Local\Temp\1166.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\11E3.tmp"C:\Users\Admin\AppData\Local\Temp\11E3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\13D7.tmp"C:\Users\Admin\AppData\Local\Temp\13D7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1474.tmp"C:\Users\Admin\AppData\Local\Temp\1474.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\1500.tmp"C:\Users\Admin\AppData\Local\Temp\1500.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"65⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"67⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"68⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"69⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"70⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\187B.tmp"C:\Users\Admin\AppData\Local\Temp\187B.tmp"71⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\18F8.tmp"C:\Users\Admin\AppData\Local\Temp\18F8.tmp"72⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\19C3.tmp"C:\Users\Admin\AppData\Local\Temp\19C3.tmp"73⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\1A40.tmp"C:\Users\Admin\AppData\Local\Temp\1A40.tmp"74⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"76⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"77⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"78⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"79⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"80⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"81⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"82⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"83⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"84⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\203B.tmp"C:\Users\Admin\AppData\Local\Temp\203B.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\20B8.tmp"C:\Users\Admin\AppData\Local\Temp\20B8.tmp"86⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\2135.tmp"C:\Users\Admin\AppData\Local\Temp\2135.tmp"87⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"88⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\222F.tmp"C:\Users\Admin\AppData\Local\Temp\222F.tmp"89⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\229D.tmp"C:\Users\Admin\AppData\Local\Temp\229D.tmp"90⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"91⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"92⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"93⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\24BF.tmp"C:\Users\Admin\AppData\Local\Temp\24BF.tmp"94⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"95⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"96⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"97⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"98⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"99⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\27AD.tmp"C:\Users\Admin\AppData\Local\Temp\27AD.tmp"100⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"101⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\28A7.tmp"C:\Users\Admin\AppData\Local\Temp\28A7.tmp"102⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"103⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\29B1.tmp"C:\Users\Admin\AppData\Local\Temp\29B1.tmp"104⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"105⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"C:\Users\Admin\AppData\Local\Temp\2ACA.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2B47.tmp"C:\Users\Admin\AppData\Local\Temp\2B47.tmp"107⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\2C32.tmp"C:\Users\Admin\AppData\Local\Temp\2C32.tmp"109⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"C:\Users\Admin\AppData\Local\Temp\2CAF.tmp"110⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"C:\Users\Admin\AppData\Local\Temp\2D4B.tmp"111⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"C:\Users\Admin\AppData\Local\Temp\2DC8.tmp"112⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2E45.tmp"C:\Users\Admin\AppData\Local\Temp\2E45.tmp"113⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"114⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"115⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"116⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3049.tmp"C:\Users\Admin\AppData\Local\Temp\3049.tmp"117⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\30D5.tmp"C:\Users\Admin\AppData\Local\Temp\30D5.tmp"118⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\3181.tmp"C:\Users\Admin\AppData\Local\Temp\3181.tmp"119⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\31FE.tmp"C:\Users\Admin\AppData\Local\Temp\31FE.tmp"120⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\327B.tmp"C:\Users\Admin\AppData\Local\Temp\327B.tmp"121⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\32F8.tmp"C:\Users\Admin\AppData\Local\Temp\32F8.tmp"122⤵PID:1340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-