Analysis
- max time kernel
127s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_2c1044e0d38ab29e42d0051a09bb5446_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_2c1044e0d38ab29e42d0051a09bb5446_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-26_2c1044e0d38ab29e42d0051a09bb5446_elex_mafia.exe
- Size 521KB
- Sample260629-vt2tvsav8x
- SHA256 ac296b9bed2f46587ff5693473bccecd5d0d09bc5d59168cf77f58f6c882e60d
- MD5 2c1044e0d38ab29e42d0051a09bb5446
- SHA1 35c2fbb3acc1b24e1882296334788f7e2304a383
- SHA512 e4483a1ba332daf4d01296aec7dbd762a2826e3fc8f9c0de56eb67fdf96293cf914aed103f92fe963fad3f505f67dba39d88f9bac7601f09e2e4cfe4d300e65e
- SSDEEP 12288:gOlvWUTES19aof/bVqjES0zzkaRhIiqB+NZi:gOkU/1ZVqj0PpNg
- TLSH T1C8B4F015B644C033E69312314BA1EB62697A7C358B26A5C33BD43B6D6FF12D0E2B4727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 8 DB96.tmp 5420 DCBF.tmp 1568 DDA9.tmp 708 DE45.tmp 932 DEE2.tmp 3916 DF4F.tmp 1660 DFDC.tmp 6068 E068.tmp 5188 E0E5.tmp 3456 E181.tmp 4772 E1FE.tmp 6080 E28B.tmp 2344 E327.tmp 4980 E3D3.tmp 2836 E48F.tmp 5068 E54A.tmp 1708 E5C7.tmp 1504 E663.tmp 3544 E6E0.tmp 2628 E79C.tmp 4092 E848.tmp 4156 E8D4.tmp 1160 E961.tmp 1048 E9DE.tmp 5772 EA8A.tmp 1200 EB26.tmp 5356 EBC2.tmp 704 EC4F.tmp 3304 ECDC.tmp 3124 ED97.tmp 360 EE43.tmp 2312 EEC0.tmp 5840 EF6C.tmp 5940 EFCA.tmp 3500 F037.tmp 3656 F0C4.tmp 5524 F150.tmp 3004 F1BE.tmp 2596 F22B.tmp 4500 F289.tmp 3176 F306.tmp 1996 F383.tmp 1292 F400.tmp 3040 F47D.tmp 1056 F4EA.tmp 5760 F567.tmp 3836 F603.tmp 1984 F680.tmp 3536 F6EE.tmp 1784 F76B.tmp 1552 F7E8.tmp 1296 F865.tmp 2296 F8D2.tmp 1840 F95F.tmp 3464 F9DC.tmp 3716 FA59.tmp 5936 FAC6.tmp 5640 FB43.tmp 4488 FBD0.tmp 2432 FC3D.tmp 3516 FCBA.tmp 4484 FD47.tmp 420 FDC4.tmp 5572 FE22.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 493F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 184C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1880.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1EC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 8 2800 2026-06-26_2c1044e0d38ab29e42d0051a09bb5446_elex_mafia.exe 87 PID 8 wrote to memory of 5420 8 DB96.tmp 88 PID 5420 wrote to memory of 1568 5420 DCBF.tmp 89 PID 1568 wrote to memory of 708 1568 DDA9.tmp 90 PID 708 wrote to memory of 932 708 DE45.tmp 91 PID 932 wrote to memory of 3916 932 DEE2.tmp 92 PID 3916 wrote to memory of 1660 3916 DF4F.tmp 93 PID 1660 wrote to memory of 6068 1660 DFDC.tmp 94 PID 6068 wrote to memory of 5188 6068 E068.tmp 95 PID 5188 wrote to memory of 3456 5188 E0E5.tmp 96 PID 3456 wrote to memory of 4772 3456 E181.tmp 97 PID 4772 wrote to memory of 6080 4772 E1FE.tmp 98 PID 6080 wrote to memory of 2344 6080 E28B.tmp 99 PID 2344 wrote to memory of 4980 2344 E327.tmp 100 PID 4980 wrote to memory of 2836 4980 E3D3.tmp 101 PID 2836 wrote to memory of 5068 2836 E48F.tmp 102 PID 5068 wrote to memory of 1708 5068 E54A.tmp 103 PID 1708 wrote to memory of 1504 1708 E5C7.tmp 104 PID 1504 wrote to memory of 3544 1504 E663.tmp 105 PID 3544 wrote to memory of 2628 3544 E6E0.tmp 106 PID 2628 wrote to memory of 4092 2628 E79C.tmp 107 PID 4092 wrote to memory of 4156 4092 E848.tmp 108 PID 4156 wrote to memory of 1160 4156 E8D4.tmp 109 PID 1160 wrote to memory of 1048 1160 E961.tmp 110 PID 1048 wrote to memory of 5772 1048 E9DE.tmp 111 PID 5772 wrote to memory of 1200 5772 EA8A.tmp 112 PID 1200 wrote to memory of 5356 1200 EB26.tmp 113 PID 5356 wrote to memory of 704 5356 EBC2.tmp 114 PID 704 wrote to memory of 3304 704 EC4F.tmp 115 PID 3304 wrote to memory of 3124 3304 ECDC.tmp 116 PID 3124 wrote to memory of 360 3124 ED97.tmp 117 PID 360 wrote to memory of 2312 360 EE43.tmp 118 PID 2312 wrote to memory of 5840 2312 EEC0.tmp 119 PID 5840 wrote to memory of 5940 5840 EF6C.tmp 120 PID 5940 wrote to memory of 3500 5940 EFCA.tmp 121 PID 3500 wrote to memory of 3656 3500 F037.tmp 122 PID 3656 wrote to memory of 5524 3656 F0C4.tmp 123 PID 5524 wrote to memory of 3004 5524 F150.tmp 124 PID 3004 wrote to memory of 2596 3004 F1BE.tmp 125 PID 2596 wrote to memory of 4500 2596 F22B.tmp 126 PID 4500 wrote to memory of 3176 4500 F289.tmp 127 PID 3176 wrote to memory of 1996 3176 F306.tmp 128 PID 1996 wrote to memory of 1292 1996 F383.tmp 129 PID 1292 wrote to memory of 3040 1292 F400.tmp 130 PID 3040 wrote to memory of 1056 3040 F47D.tmp 131 PID 1056 wrote to memory of 5760 1056 F4EA.tmp 132 PID 5760 wrote to memory of 3836 5760 F567.tmp 133 PID 3836 wrote to memory of 1984 3836 F603.tmp 134 PID 1984 wrote to memory of 3536 1984 F680.tmp 135 PID 3536 wrote to memory of 1784 3536 F6EE.tmp 136 PID 1784 wrote to memory of 1552 1784 F76B.tmp 137 PID 1552 wrote to memory of 1296 1552 F7E8.tmp 138 PID 1296 wrote to memory of 2296 1296 F865.tmp 139 PID 2296 wrote to memory of 1840 2296 F8D2.tmp 140 PID 1840 wrote to memory of 3464 1840 F95F.tmp 141 PID 3464 wrote to memory of 3716 3464 F9DC.tmp 142 PID 3716 wrote to memory of 5936 3716 FA59.tmp 143 PID 5936 wrote to memory of 5640 5936 FAC6.tmp 144 PID 5640 wrote to memory of 4488 5640 FB43.tmp 145 PID 4488 wrote to memory of 2432 4488 FBD0.tmp 146 PID 2432 wrote to memory of 3516 2432 FC3D.tmp 147 PID 3516 wrote to memory of 4484 3516 FCBA.tmp 148 PID 4484 wrote to memory of 420 4484 FD47.tmp 149 PID 420 wrote to memory of 5572 420 FDC4.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_2c1044e0d38ab29e42d0051a09bb5446_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_2c1044e0d38ab29e42d0051a09bb5446_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\DEE2.tmp"C:\Users\Admin\AppData\Local\Temp\DEE2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\E181.tmp"C:\Users\Admin\AppData\Local\Temp\E181.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\E48F.tmp"C:\Users\Admin\AppData\Local\Temp\E48F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"C:\Users\Admin\AppData\Local\Temp\E9DE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\EA8A.tmp"C:\Users\Admin\AppData\Local\Temp\EA8A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\ED97.tmp"C:\Users\Admin\AppData\Local\Temp\ED97.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\F037.tmp"C:\Users\Admin\AppData\Local\Temp\F037.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\F150.tmp"C:\Users\Admin\AppData\Local\Temp\F150.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F22B.tmp"C:\Users\Admin\AppData\Local\Temp\F22B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\F47D.tmp"C:\Users\Admin\AppData\Local\Temp\F47D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\F603.tmp"C:\Users\Admin\AppData\Local\Temp\F603.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\F680.tmp"C:\Users\Admin\AppData\Local\Temp\F680.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\F76B.tmp"C:\Users\Admin\AppData\Local\Temp\F76B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\F9DC.tmp"C:\Users\Admin\AppData\Local\Temp\F9DC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\FA59.tmp"C:\Users\Admin\AppData\Local\Temp\FA59.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\FC3D.tmp"C:\Users\Admin\AppData\Local\Temp\FC3D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\FD47.tmp"C:\Users\Admin\AppData\Local\Temp\FD47.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"65⤵
- Executes dropped EXE
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"66⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"67⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"68⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"69⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\83.tmp"C:\Users\Admin\AppData\Local\Temp\83.tmp"70⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\100.tmp"C:\Users\Admin\AppData\Local\Temp\100.tmp"71⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\15E.tmp"C:\Users\Admin\AppData\Local\Temp\15E.tmp"72⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"73⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"74⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"75⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\332.tmp"C:\Users\Admin\AppData\Local\Temp\332.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3A0.tmp"C:\Users\Admin\AppData\Local\Temp\3A0.tmp"77⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"78⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\4B9.tmp"C:\Users\Admin\AppData\Local\Temp\4B9.tmp"79⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"80⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5B3.tmp"C:\Users\Admin\AppData\Local\Temp\5B3.tmp"81⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"82⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\69D.tmp"C:\Users\Admin\AppData\Local\Temp\69D.tmp"83⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\70B.tmp"C:\Users\Admin\AppData\Local\Temp\70B.tmp"84⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"85⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"87⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\8E0.tmp"C:\Users\Admin\AppData\Local\Temp\8E0.tmp"88⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"89⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"90⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"91⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\AD4.tmp"C:\Users\Admin\AppData\Local\Temp\AD4.tmp"92⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\B41.tmp"C:\Users\Admin\AppData\Local\Temp\B41.tmp"93⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"94⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"95⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\CE7.tmp"C:\Users\Admin\AppData\Local\Temp\CE7.tmp"96⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\D64.tmp"C:\Users\Admin\AppData\Local\Temp\D64.tmp"97⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\E00.tmp"C:\Users\Admin\AppData\Local\Temp\E00.tmp"98⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\E7D.tmp"C:\Users\Admin\AppData\Local\Temp\E7D.tmp"99⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"100⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"101⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"102⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\1061.tmp"C:\Users\Admin\AppData\Local\Temp\1061.tmp"103⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\10DE.tmp"C:\Users\Admin\AppData\Local\Temp\10DE.tmp"104⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\115B.tmp"C:\Users\Admin\AppData\Local\Temp\115B.tmp"105⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"106⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"107⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"108⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"109⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"110⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"111⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"112⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\1515.tmp"C:\Users\Admin\AppData\Local\Temp\1515.tmp"113⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"114⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"115⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\167C.tmp"C:\Users\Admin\AppData\Local\Temp\167C.tmp"116⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\16F9.tmp"C:\Users\Admin\AppData\Local\Temp\16F9.tmp"117⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"118⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"119⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"121⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"122⤵PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-