Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 10:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_0cb3157d4fc8854700b527ae6460cb66_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_0cb3157d4fc8854700b527ae6460cb66_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-01_0cb3157d4fc8854700b527ae6460cb66_elex_mafia.exe
- Size 518KB
- Sample260701-mr3dlses31
- SHA256 b7a01b62053e2d0107e7a4982b37e4f589eb3c09dd46727902e12818c7ff2d77
- MD5 0cb3157d4fc8854700b527ae6460cb66
- SHA1 3ba48a00309ee2428feb07c1ba57811adc83d172
- SHA512 faf8299d169af4a0b164d1dd703222cc0178c0de5b10c81446eeeb33879b933d88864bafbbb97a7657f25f74d735982a26ba31a9a7205384fcde296bd75a3362
- SSDEEP 12288:Jf1yBOtIZdpH+IKePegjg0fQCak+vYAGjEqVy7oB+NZ:JfcBzZdcIKU1jg0ICatgAYEPocN
- TLSH T197B4F112BA44C136F5A302348B56DB521D3B7C7A9B26A8C77BE0366D2EB13C2D674347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4896 BF05.tmp 3240 BFB1.tmp 3468 C09C.tmp 1812 C128.tmp 5924 C1A5.tmp 4448 C213.tmp 1896 C2BE.tmp 3720 C37A.tmp 5448 C407.tmp 6136 C4A3.tmp 4404 C54F.tmp 2184 C61A.tmp 560 C6B6.tmp 5784 C752.tmp 1424 C80E.tmp 5488 C88B.tmp 5796 C937.tmp 2832 C9E3.tmp 6020 CA7F.tmp 6068 CAEC.tmp 5144 CB88.tmp 1760 CC05.tmp 2964 CC82.tmp 248 CD3E.tmp 4468 CDBB.tmp 4952 CEA5.tmp 2416 CF32.tmp 5940 CFDE.tmp 3376 D099.tmp 4724 D116.tmp 1328 D1F1.tmp 5968 D27E.tmp 4732 D30A.tmp 1800 D387.tmp 5300 D3F5.tmp 2188 D462.tmp 2320 D4FE.tmp 3040 D57B.tmp 5944 D5E9.tmp 3668 D666.tmp 5372 D6D3.tmp 1936 D750.tmp 1060 D7AE.tmp 5284 D82B.tmp 5736 D8B7.tmp 940 D915.tmp 2388 D9B1.tmp 3816 DA2E.tmp 1524 DA8C.tmp 3316 DB09.tmp 4444 DB67.tmp 1048 DBE4.tmp 5524 DC51.tmp 5700 DCAF.tmp 2612 DD2C.tmp 2400 DDA9.tmp 5568 DE26.tmp 1768 DE93.tmp 5204 DF01.tmp 944 DF5F.tmp 5844 DFCC.tmp 4784 E02A.tmp 5884 E097.tmp 3228 E133.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 743C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F39D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C88B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31A0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 4896 4488 2026-07-01_0cb3157d4fc8854700b527ae6460cb66_elex_mafia.exe 90 PID 4896 wrote to memory of 3240 4896 BF05.tmp 91 PID 3240 wrote to memory of 3468 3240 BFB1.tmp 92 PID 3468 wrote to memory of 1812 3468 C09C.tmp 93 PID 1812 wrote to memory of 5924 1812 C128.tmp 94 PID 5924 wrote to memory of 4448 5924 C1A5.tmp 95 PID 4448 wrote to memory of 1896 4448 C213.tmp 96 PID 1896 wrote to memory of 3720 1896 C2BE.tmp 97 PID 3720 wrote to memory of 5448 3720 C37A.tmp 98 PID 5448 wrote to memory of 6136 5448 C407.tmp 99 PID 6136 wrote to memory of 4404 6136 C4A3.tmp 100 PID 4404 wrote to memory of 2184 4404 C54F.tmp 101 PID 2184 wrote to memory of 560 2184 C61A.tmp 102 PID 560 wrote to memory of 5784 560 C6B6.tmp 103 PID 5784 wrote to memory of 1424 5784 C752.tmp 104 PID 1424 wrote to memory of 5488 1424 C80E.tmp 105 PID 5488 wrote to memory of 5796 5488 C88B.tmp 106 PID 5796 wrote to memory of 2832 5796 C937.tmp 107 PID 2832 wrote to memory of 6020 2832 C9E3.tmp 108 PID 6020 wrote to memory of 6068 6020 CA7F.tmp 109 PID 6068 wrote to memory of 5144 6068 CAEC.tmp 110 PID 5144 wrote to memory of 1760 5144 CB88.tmp 111 PID 1760 wrote to memory of 2964 1760 CC05.tmp 112 PID 2964 wrote to memory of 248 2964 CC82.tmp 113 PID 248 wrote to memory of 4468 248 CD3E.tmp 114 PID 4468 wrote to memory of 4952 4468 CDBB.tmp 115 PID 4952 wrote to memory of 2416 4952 CEA5.tmp 116 PID 2416 wrote to memory of 5940 2416 CF32.tmp 117 PID 5940 wrote to memory of 3376 5940 CFDE.tmp 118 PID 3376 wrote to memory of 4724 3376 D099.tmp 119 PID 4724 wrote to memory of 1328 4724 D116.tmp 120 PID 1328 wrote to memory of 5968 1328 D1F1.tmp 121 PID 5968 wrote to memory of 4732 5968 D27E.tmp 122 PID 4732 wrote to memory of 1800 4732 D30A.tmp 123 PID 1800 wrote to memory of 5300 1800 D387.tmp 124 PID 5300 wrote to memory of 2188 5300 D3F5.tmp 125 PID 2188 wrote to memory of 2320 2188 D462.tmp 126 PID 2320 wrote to memory of 3040 2320 D4FE.tmp 127 PID 3040 wrote to memory of 5944 3040 D57B.tmp 128 PID 5944 wrote to memory of 3668 5944 D5E9.tmp 129 PID 3668 wrote to memory of 5372 3668 D666.tmp 130 PID 5372 wrote to memory of 1936 5372 D6D3.tmp 131 PID 1936 wrote to memory of 1060 1936 D750.tmp 132 PID 1060 wrote to memory of 5284 1060 D7AE.tmp 133 PID 5284 wrote to memory of 5736 5284 D82B.tmp 134 PID 5736 wrote to memory of 940 5736 D8B7.tmp 135 PID 940 wrote to memory of 2388 940 D915.tmp 136 PID 2388 wrote to memory of 3816 2388 D9B1.tmp 137 PID 3816 wrote to memory of 1524 3816 DA2E.tmp 138 PID 1524 wrote to memory of 3316 1524 DA8C.tmp 139 PID 3316 wrote to memory of 4444 3316 DB09.tmp 140 PID 4444 wrote to memory of 1048 4444 DB67.tmp 141 PID 1048 wrote to memory of 5524 1048 DBE4.tmp 142 PID 5524 wrote to memory of 5700 5524 DC51.tmp 143 PID 5700 wrote to memory of 2612 5700 DCAF.tmp 144 PID 2612 wrote to memory of 2400 2612 DD2C.tmp 145 PID 2400 wrote to memory of 5568 2400 DDA9.tmp 146 PID 5568 wrote to memory of 1768 5568 DE26.tmp 147 PID 1768 wrote to memory of 5204 1768 DE93.tmp 148 PID 5204 wrote to memory of 944 5204 DF01.tmp 149 PID 944 wrote to memory of 5844 944 DF5F.tmp 150 PID 5844 wrote to memory of 4784 5844 DFCC.tmp 151 PID 4784 wrote to memory of 5884 4784 E02A.tmp 152 PID 5884 wrote to memory of 3228 5884 E097.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_0cb3157d4fc8854700b527ae6460cb66_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0cb3157d4fc8854700b527ae6460cb66_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\BF05.tmp"C:\Users\Admin\AppData\Local\Temp\BF05.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\C09C.tmp"C:\Users\Admin\AppData\Local\Temp\C09C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\C1A5.tmp"C:\Users\Admin\AppData\Local\Temp\C1A5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\C37A.tmp"C:\Users\Admin\AppData\Local\Temp\C37A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\C407.tmp"C:\Users\Admin\AppData\Local\Temp\C407.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\C54F.tmp"C:\Users\Admin\AppData\Local\Temp\C54F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\C61A.tmp"C:\Users\Admin\AppData\Local\Temp\C61A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\C937.tmp"C:\Users\Admin\AppData\Local\Temp\C937.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\CC82.tmp"C:\Users\Admin\AppData\Local\Temp\CC82.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\D27E.tmp"C:\Users\Admin\AppData\Local\Temp\D27E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\D57B.tmp"C:\Users\Admin\AppData\Local\Temp\D57B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\D750.tmp"C:\Users\Admin\AppData\Local\Temp\D750.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D7AE.tmp"C:\Users\Admin\AppData\Local\Temp\D7AE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\DB09.tmp"C:\Users\Admin\AppData\Local\Temp\DB09.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\DC51.tmp"C:\Users\Admin\AppData\Local\Temp\DC51.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\E097.tmp"C:\Users\Admin\AppData\Local\Temp\E097.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\E133.tmp"C:\Users\Admin\AppData\Local\Temp\E133.tmp"65⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"66⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\E20E.tmp"C:\Users\Admin\AppData\Local\Temp\E20E.tmp"67⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"68⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"69⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"70⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"71⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"72⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"73⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"74⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\E52B.tmp"C:\Users\Admin\AppData\Local\Temp\E52B.tmp"75⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"76⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"77⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"78⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"79⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"80⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\E76D.tmp"C:\Users\Admin\AppData\Local\Temp\E76D.tmp"81⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"82⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\E829.tmp"C:\Users\Admin\AppData\Local\Temp\E829.tmp"83⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\E886.tmp"C:\Users\Admin\AppData\Local\Temp\E886.tmp"84⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"85⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"86⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\E9CE.tmp"C:\Users\Admin\AppData\Local\Temp\E9CE.tmp"87⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"88⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\EA8A.tmp"C:\Users\Admin\AppData\Local\Temp\EA8A.tmp"89⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"90⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"91⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\EC30.tmp"C:\Users\Admin\AppData\Local\Temp\EC30.tmp"93⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"94⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"95⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\ED97.tmp"C:\Users\Admin\AppData\Local\Temp\ED97.tmp"96⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\EE14.tmp"C:\Users\Admin\AppData\Local\Temp\EE14.tmp"97⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\EE91.tmp"C:\Users\Admin\AppData\Local\Temp\EE91.tmp"98⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"99⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\EFAA.tmp"C:\Users\Admin\AppData\Local\Temp\EFAA.tmp"100⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\F018.tmp"C:\Users\Admin\AppData\Local\Temp\F018.tmp"101⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"102⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"103⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\F17F.tmp"C:\Users\Admin\AppData\Local\Temp\F17F.tmp"104⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"105⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"107⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"108⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"109⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"110⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\F548.tmp"C:\Users\Admin\AppData\Local\Temp\F548.tmp"112⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"113⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"114⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"115⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\F72C.tmp"C:\Users\Admin\AppData\Local\Temp\F72C.tmp"116⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\F79A.tmp"C:\Users\Admin\AppData\Local\Temp\F79A.tmp"117⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\F807.tmp"C:\Users\Admin\AppData\Local\Temp\F807.tmp"118⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"119⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"120⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\F94F.tmp"C:\Users\Admin\AppData\Local\Temp\F94F.tmp"121⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-