Analysis
- max time kernel
66s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_475ef76e80278f3d13805ae85e226bbc_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_475ef76e80278f3d13805ae85e226bbc_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-26_475ef76e80278f3d13805ae85e226bbc_elex_mafia.exe
- Size 521KB
- Sample260629-twypjsbs8q
- SHA256 dceaa83f1bc42a0cde57fd464661b9cd97a4451ccd06b44494cd5c2c59b8a017
- MD5 475ef76e80278f3d13805ae85e226bbc
- SHA1 34267bf9becd0ded1b03a1bd2aa56716d82dea5a
- SHA512 5f5ed3dfe4f86ecc5112756fbceb31a9223a51b28e36e189c8febbd4f32634127253914dbc86f2f918a27bc17a17b101215cf53ed7ee908fd590f714a0181cc3
- SSDEEP 12288:gOlvWUTES1lKGbdqqM8yRUDt726HOaRyzsDyNZi:gOkU/1lxdLnSU5726ONg
- TLSH T10FB4E011B648C033E1A201354F96EBA25D3F7C256B66A4C73B943A2D6FF02D1D6B8717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4988 D646.tmp 2724 D6A4.tmp 1100 D6F2.tmp 2812 D750.tmp 4560 D79E.tmp 1148 D7EC.tmp 3872 D83A.tmp 3640 D889.tmp 4372 D8D7.tmp 2128 D934.tmp 4432 D983.tmp 3184 D9E0.tmp 60 DA3E.tmp 1800 DA9C.tmp 1340 DAFA.tmp 5052 DB48.tmp 4508 DB96.tmp 4208 DBF4.tmp 2632 DC51.tmp 1880 DCAF.tmp 3388 DD2C.tmp 1760 DD7A.tmp 884 DE16.tmp 2700 DEC2.tmp 3888 DFBC.tmp 1060 E039.tmp 1600 E0B6.tmp 2460 E114.tmp 4128 E172.tmp 3056 E1DF.tmp 4384 E23D.tmp 3272 E28B.tmp 3900 E3A4.tmp 1872 E402.tmp 3244 E450.tmp 4124 E49E.tmp 1632 E4EC.tmp 2832 E53B.tmp 828 E589.tmp 2780 E5D7.tmp 4472 E644.tmp 4544 E692.tmp 896 E6E0.tmp 3660 E72F.tmp 4816 E77D.tmp 1328 E7CB.tmp 5000 E819.tmp 1656 E867.tmp 3580 E8B5.tmp 4932 E903.tmp 2164 E980.tmp 3992 E9DE.tmp 408 EA2C.tmp 1596 EA7A.tmp 2576 EAC8.tmp 4528 EB17.tmp 1520 EB65.tmp 2804 EC01.tmp 4792 EC4F.tmp 4396 EC9D.tmp 2020 ECEB.tmp 2568 ED39.tmp 3624 ED88.tmp 688 EDD6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 195A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 289D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62E6.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4988 4652 2026-06-26_475ef76e80278f3d13805ae85e226bbc_elex_mafia.exe 84 PID 4988 wrote to memory of 2724 4988 D646.tmp 85 PID 2724 wrote to memory of 1100 2724 D6A4.tmp 86 PID 1100 wrote to memory of 2812 1100 D6F2.tmp 87 PID 2812 wrote to memory of 4560 2812 D750.tmp 88 PID 4560 wrote to memory of 1148 4560 D79E.tmp 89 PID 1148 wrote to memory of 3872 1148 D7EC.tmp 90 PID 3872 wrote to memory of 3640 3872 D83A.tmp 91 PID 3640 wrote to memory of 4372 3640 D889.tmp 92 PID 4372 wrote to memory of 2128 4372 D8D7.tmp 93 PID 2128 wrote to memory of 4432 2128 D934.tmp 94 PID 4432 wrote to memory of 3184 4432 D983.tmp 95 PID 3184 wrote to memory of 60 3184 D9E0.tmp 96 PID 60 wrote to memory of 1800 60 DA3E.tmp 97 PID 1800 wrote to memory of 1340 1800 DA9C.tmp 98 PID 1340 wrote to memory of 5052 1340 DAFA.tmp 99 PID 5052 wrote to memory of 4508 5052 DB48.tmp 100 PID 4508 wrote to memory of 4208 4508 DB96.tmp 101 PID 4208 wrote to memory of 2632 4208 DBF4.tmp 102 PID 2632 wrote to memory of 1880 2632 DC51.tmp 103 PID 1880 wrote to memory of 3388 1880 DCAF.tmp 104 PID 3388 wrote to memory of 1760 3388 DD2C.tmp 105 PID 1760 wrote to memory of 884 1760 DD7A.tmp 106 PID 884 wrote to memory of 2700 884 DE16.tmp 107 PID 2700 wrote to memory of 3888 2700 DEC2.tmp 108 PID 3888 wrote to memory of 1060 3888 DFBC.tmp 109 PID 1060 wrote to memory of 1600 1060 E039.tmp 110 PID 1600 wrote to memory of 2460 1600 E0B6.tmp 111 PID 2460 wrote to memory of 4128 2460 E114.tmp 112 PID 4128 wrote to memory of 3056 4128 E172.tmp 114 PID 3056 wrote to memory of 4384 3056 E1DF.tmp 115 PID 4384 wrote to memory of 3272 4384 E23D.tmp 116 PID 3272 wrote to memory of 3900 3272 E28B.tmp 117 PID 3900 wrote to memory of 1872 3900 E3A4.tmp 118 PID 1872 wrote to memory of 3244 1872 E402.tmp 119 PID 3244 wrote to memory of 4124 3244 E450.tmp 120 PID 4124 wrote to memory of 1632 4124 E49E.tmp 121 PID 1632 wrote to memory of 2832 1632 E4EC.tmp 122 PID 2832 wrote to memory of 828 2832 E53B.tmp 123 PID 828 wrote to memory of 2780 828 E589.tmp 124 PID 2780 wrote to memory of 4472 2780 E5D7.tmp 125 PID 4472 wrote to memory of 4544 4472 E644.tmp 126 PID 4544 wrote to memory of 896 4544 E692.tmp 127 PID 896 wrote to memory of 3660 896 E6E0.tmp 128 PID 3660 wrote to memory of 4816 3660 E72F.tmp 129 PID 4816 wrote to memory of 1328 4816 E77D.tmp 130 PID 1328 wrote to memory of 5000 1328 E7CB.tmp 131 PID 5000 wrote to memory of 1656 5000 E819.tmp 132 PID 1656 wrote to memory of 3580 1656 E867.tmp 133 PID 3580 wrote to memory of 4932 3580 E8B5.tmp 135 PID 4932 wrote to memory of 2164 4932 E903.tmp 136 PID 2164 wrote to memory of 3992 2164 E980.tmp 137 PID 3992 wrote to memory of 408 3992 E9DE.tmp 138 PID 408 wrote to memory of 1596 408 EA2C.tmp 139 PID 1596 wrote to memory of 2576 1596 EA7A.tmp 140 PID 2576 wrote to memory of 4528 2576 EAC8.tmp 142 PID 4528 wrote to memory of 1520 4528 EB17.tmp 144 PID 4036 wrote to memory of 2804 4036 EBB3.tmp 147 PID 2804 wrote to memory of 4792 2804 EC01.tmp 148 PID 4792 wrote to memory of 4396 4792 EC4F.tmp 149 PID 4396 wrote to memory of 2020 4396 EC9D.tmp 150 PID 2020 wrote to memory of 2568 2020 ECEB.tmp 151 PID 2568 wrote to memory of 3624 2568 ED39.tmp 152 PID 3624 wrote to memory of 688 3624 ED88.tmp 153
Processes
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv ihPUOpJjZUWojooY9YFfUA.01⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_475ef76e80278f3d13805ae85e226bbc_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_475ef76e80278f3d13805ae85e226bbc_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\D750.tmp"C:\Users\Admin\AppData\Local\Temp\D750.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\D79E.tmp"C:\Users\Admin\AppData\Local\Temp\D79E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\DBF4.tmp"C:\Users\Admin\AppData\Local\Temp\DBF4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\DC51.tmp"C:\Users\Admin\AppData\Local\Temp\DC51.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\DE16.tmp"C:\Users\Admin\AppData\Local\Temp\DE16.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\E172.tmp"C:\Users\Admin\AppData\Local\Temp\E172.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"C:\Users\Admin\AppData\Local\Temp\E1DF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\E49E.tmp"C:\Users\Admin\AppData\Local\Temp\E49E.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\E77D.tmp"C:\Users\Admin\AppData\Local\Temp\E77D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\E819.tmp"C:\Users\Admin\AppData\Local\Temp\E819.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E867.tmp"C:\Users\Admin\AppData\Local\Temp\E867.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\E980.tmp"C:\Users\Admin\AppData\Local\Temp\E980.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\EB17.tmp"C:\Users\Admin\AppData\Local\Temp\EB17.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"59⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\ED39.tmp"C:\Users\Admin\AppData\Local\Temp\ED39.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:688 -
C:\Users\Admin\AppData\Local\Temp\EE24.tmp"C:\Users\Admin\AppData\Local\Temp\EE24.tmp"67⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"68⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\EEDF.tmp"C:\Users\Admin\AppData\Local\Temp\EEDF.tmp"69⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"70⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"71⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"72⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\F027.tmp"C:\Users\Admin\AppData\Local\Temp\F027.tmp"73⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"74⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"75⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"76⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"77⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"78⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"79⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"80⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"81⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"82⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"83⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"85⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\F42F.tmp"C:\Users\Admin\AppData\Local\Temp\F42F.tmp"86⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\F47D.tmp"C:\Users\Admin\AppData\Local\Temp\F47D.tmp"87⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"88⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"89⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"90⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"91⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\F603.tmp"C:\Users\Admin\AppData\Local\Temp\F603.tmp"92⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"93⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"94⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"95⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\F73C.tmp"C:\Users\Admin\AppData\Local\Temp\F73C.tmp"96⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\F78A.tmp"C:\Users\Admin\AppData\Local\Temp\F78A.tmp"97⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"98⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\F826.tmp"C:\Users\Admin\AppData\Local\Temp\F826.tmp"99⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"100⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"101⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\F911.tmp"C:\Users\Admin\AppData\Local\Temp\F911.tmp"102⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"103⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\F9AD.tmp"C:\Users\Admin\AppData\Local\Temp\F9AD.tmp"104⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"105⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"106⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\FA97.tmp"C:\Users\Admin\AppData\Local\Temp\FA97.tmp"107⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"108⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\FB34.tmp"C:\Users\Admin\AppData\Local\Temp\FB34.tmp"109⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\FB82.tmp"C:\Users\Admin\AppData\Local\Temp\FB82.tmp"110⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"111⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"112⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"113⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"114⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\FD56.tmp"C:\Users\Admin\AppData\Local\Temp\FD56.tmp"116⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"117⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"118⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\FE41.tmp"C:\Users\Admin\AppData\Local\Temp\FE41.tmp"119⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"120⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"121⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"122⤵PID:5020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-