Analysis
- max time kernel
129s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 21:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_1379c5bbc557e3b74dfb0ba33d3ff14d_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_1379c5bbc557e3b74dfb0ba33d3ff14d_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-02_1379c5bbc557e3b74dfb0ba33d3ff14d_elex_mafia.exe
- Size 521KB
- Sample260702-z9732afs6x
- SHA256 4535387cd0cebd851fd7728ef638e0ec36a03808416aa8dbb4768daa28f6d0d4
- MD5 1379c5bbc557e3b74dfb0ba33d3ff14d
- SHA1 a7542056f84929cb1591cb7f3af597158b896316
- SHA512 2532928d98f5c67e9f7354cd318e038d401162538464e859f612cfe3fc5f88b07f756e7c270786f24582eee8dc558067521fde159eca944c333c7487387d9f75
- SSDEEP 12288:gOlvWUTES1wDdp0Q3keTo3kLyR87/S8JONZi:gOkU/1SpFfTVM87FONg
- TLSH T159B4F011B688C033E59211314B62EBA2593F7D759B62A4C72B943A2E3FB13D0E7B4717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2484 C280.tmp 4584 C37A.tmp 2184 C493.tmp 2656 C55E.tmp 3252 C639.tmp 4296 C752.tmp 4852 C81D.tmp 4840 C8E9.tmp 2648 C9A4.tmp 832 CA60.tmp 1196 CB3A.tmp 5960 CBF6.tmp 6032 CCC1.tmp 2128 CDBB.tmp 2708 CE96.tmp 4788 CF32.tmp 5580 CFFD.tmp 1232 D0E7.tmp 6096 D193.tmp 2412 D24F.tmp 5988 D30A.tmp 1888 D3A7.tmp 3336 D4A1.tmp 2932 D53D.tmp 2544 D5F8.tmp 2664 D6C3.tmp 2908 D78F.tmp 6104 D83A.tmp 1548 D906.tmp 3828 D9D1.tmp 124 DA6D.tmp 3768 DB57.tmp 5880 DC61.tmp 5380 DD0D.tmp 5848 DDA9.tmp 3548 DE55.tmp 2416 DEF1.tmp 1864 DF5F.tmp 6012 E00A.tmp 3836 E097.tmp 2848 E114.tmp 3788 E191.tmp 1856 E23D.tmp 2688 E2CA.tmp 2352 E366.tmp 3724 E402.tmp 4468 E47F.tmp 5372 E4FC.tmp 3156 E598.tmp 3628 E615.tmp 3592 E692.tmp 360 E72F.tmp 2964 E7CB.tmp 5664 E877.tmp 4188 E903.tmp 1132 E9A0.tmp 1572 EA3C.tmp 1868 EAD8.tmp 6088 EB55.tmp 6108 EBF1.tmp 4088 EC7E.tmp 3776 ECFB.tmp 5360 EDA7.tmp 5008 EE33.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D45D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 853F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 379C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8984.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 162E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A99F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2C5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2484 2568 2026-07-02_1379c5bbc557e3b74dfb0ba33d3ff14d_elex_mafia.exe 88 PID 2484 wrote to memory of 4584 2484 C280.tmp 89 PID 4584 wrote to memory of 2184 4584 C37A.tmp 90 PID 2184 wrote to memory of 2656 2184 C493.tmp 91 PID 2656 wrote to memory of 3252 2656 C55E.tmp 92 PID 3252 wrote to memory of 4296 3252 C639.tmp 93 PID 4296 wrote to memory of 4852 4296 C752.tmp 94 PID 4852 wrote to memory of 4840 4852 C81D.tmp 95 PID 4840 wrote to memory of 2648 4840 C8E9.tmp 96 PID 2648 wrote to memory of 832 2648 C9A4.tmp 97 PID 832 wrote to memory of 1196 832 CA60.tmp 98 PID 1196 wrote to memory of 5960 1196 CB3A.tmp 99 PID 5960 wrote to memory of 6032 5960 CBF6.tmp 100 PID 6032 wrote to memory of 2128 6032 CCC1.tmp 101 PID 2128 wrote to memory of 2708 2128 CDBB.tmp 102 PID 2708 wrote to memory of 4788 2708 CE96.tmp 103 PID 4788 wrote to memory of 5580 4788 CF32.tmp 104 PID 5580 wrote to memory of 1232 5580 CFFD.tmp 105 PID 1232 wrote to memory of 6096 1232 D0E7.tmp 106 PID 6096 wrote to memory of 2412 6096 D193.tmp 107 PID 2412 wrote to memory of 5988 2412 D24F.tmp 108 PID 5988 wrote to memory of 1888 5988 D30A.tmp 109 PID 1888 wrote to memory of 3336 1888 D3A7.tmp 110 PID 3336 wrote to memory of 2932 3336 D4A1.tmp 111 PID 2932 wrote to memory of 2544 2932 D53D.tmp 112 PID 2544 wrote to memory of 2664 2544 D5F8.tmp 113 PID 2664 wrote to memory of 2908 2664 D6C3.tmp 114 PID 2908 wrote to memory of 6104 2908 D78F.tmp 115 PID 6104 wrote to memory of 1548 6104 D83A.tmp 116 PID 1548 wrote to memory of 3828 1548 D906.tmp 117 PID 3828 wrote to memory of 124 3828 D9D1.tmp 118 PID 124 wrote to memory of 3768 124 DA6D.tmp 119 PID 3768 wrote to memory of 5880 3768 DB57.tmp 120 PID 5880 wrote to memory of 5380 5880 DC61.tmp 121 PID 5380 wrote to memory of 5848 5380 DD0D.tmp 122 PID 5848 wrote to memory of 3548 5848 DDA9.tmp 123 PID 3548 wrote to memory of 2416 3548 DE55.tmp 124 PID 2416 wrote to memory of 1864 2416 DEF1.tmp 125 PID 1864 wrote to memory of 6012 1864 DF5F.tmp 126 PID 6012 wrote to memory of 3836 6012 E00A.tmp 127 PID 3836 wrote to memory of 2848 3836 E097.tmp 128 PID 2848 wrote to memory of 3788 2848 E114.tmp 129 PID 3788 wrote to memory of 1856 3788 E191.tmp 130 PID 1856 wrote to memory of 2688 1856 E23D.tmp 131 PID 2688 wrote to memory of 2352 2688 E2CA.tmp 132 PID 2352 wrote to memory of 3724 2352 E366.tmp 133 PID 3724 wrote to memory of 4468 3724 E402.tmp 134 PID 4468 wrote to memory of 5372 4468 E47F.tmp 135 PID 5372 wrote to memory of 3156 5372 E4FC.tmp 136 PID 3156 wrote to memory of 3628 3156 E598.tmp 137 PID 3628 wrote to memory of 3592 3628 E615.tmp 138 PID 3592 wrote to memory of 360 3592 E692.tmp 139 PID 360 wrote to memory of 2964 360 E72F.tmp 140 PID 2964 wrote to memory of 5664 2964 E7CB.tmp 141 PID 5664 wrote to memory of 4188 5664 E877.tmp 142 PID 4188 wrote to memory of 1132 4188 E903.tmp 143 PID 1132 wrote to memory of 1572 1132 E9A0.tmp 144 PID 1572 wrote to memory of 1868 1572 EA3C.tmp 145 PID 1868 wrote to memory of 6088 1868 EAD8.tmp 146 PID 6088 wrote to memory of 6108 6088 EB55.tmp 147 PID 6108 wrote to memory of 4088 6108 EBF1.tmp 148 PID 4088 wrote to memory of 3776 4088 EC7E.tmp 149 PID 3776 wrote to memory of 5360 3776 ECFB.tmp 150 PID 5360 wrote to memory of 5008 5360 EDA7.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_1379c5bbc557e3b74dfb0ba33d3ff14d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_1379c5bbc557e3b74dfb0ba33d3ff14d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C37A.tmp"C:\Users\Admin\AppData\Local\Temp\C37A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\C493.tmp"C:\Users\Admin\AppData\Local\Temp\C493.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\D193.tmp"C:\Users\Admin\AppData\Local\Temp\D193.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\D4A1.tmp"C:\Users\Admin\AppData\Local\Temp\D4A1.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D53D.tmp"C:\Users\Admin\AppData\Local\Temp\D53D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\D78F.tmp"C:\Users\Admin\AppData\Local\Temp\D78F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\D906.tmp"C:\Users\Admin\AppData\Local\Temp\D906.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\DB57.tmp"C:\Users\Admin\AppData\Local\Temp\DB57.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\E00A.tmp"C:\Users\Admin\AppData\Local\Temp\E00A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\E097.tmp"C:\Users\Admin\AppData\Local\Temp\E097.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\E191.tmp"C:\Users\Admin\AppData\Local\Temp\E191.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\E598.tmp"C:\Users\Admin\AppData\Local\Temp\E598.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\E615.tmp"C:\Users\Admin\AppData\Local\Temp\E615.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"C:\Users\Admin\AppData\Local\Temp\EC7E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\EE33.tmp"C:\Users\Admin\AppData\Local\Temp\EE33.tmp"65⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"66⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"67⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\EFF9.tmp"C:\Users\Admin\AppData\Local\Temp\EFF9.tmp"68⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\F085.tmp"C:\Users\Admin\AppData\Local\Temp\F085.tmp"69⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\F102.tmp"C:\Users\Admin\AppData\Local\Temp\F102.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:432 -
C:\Users\Admin\AppData\Local\Temp\F17F.tmp"C:\Users\Admin\AppData\Local\Temp\F17F.tmp"71⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\F21B.tmp"C:\Users\Admin\AppData\Local\Temp\F21B.tmp"72⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"73⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"74⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"75⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"76⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\F4DB.tmp"C:\Users\Admin\AppData\Local\Temp\F4DB.tmp"77⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"78⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"79⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"80⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\F72C.tmp"C:\Users\Admin\AppData\Local\Temp\F72C.tmp"81⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"82⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"83⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"84⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\F97E.tmp"C:\Users\Admin\AppData\Local\Temp\F97E.tmp"85⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"86⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\FA88.tmp"C:\Users\Admin\AppData\Local\Temp\FA88.tmp"87⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\FB34.tmp"C:\Users\Admin\AppData\Local\Temp\FB34.tmp"88⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"89⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"90⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"91⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\FD85.tmp"C:\Users\Admin\AppData\Local\Temp\FD85.tmp"92⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\FE02.tmp"C:\Users\Admin\AppData\Local\Temp\FE02.tmp"93⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\FF0C.tmp"C:\Users\Admin\AppData\Local\Temp\FF0C.tmp"95⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"96⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"97⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B2.tmp"C:\Users\Admin\AppData\Local\Temp\B2.tmp"98⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"99⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\1CB.tmp"C:\Users\Admin\AppData\Local\Temp\1CB.tmp"100⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"101⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\313.tmp"C:\Users\Admin\AppData\Local\Temp\313.tmp"102⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3CF.tmp"C:\Users\Admin\AppData\Local\Temp\3CF.tmp"103⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\46B.tmp"C:\Users\Admin\AppData\Local\Temp\46B.tmp"104⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\517.tmp"C:\Users\Admin\AppData\Local\Temp\517.tmp"105⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\594.tmp"C:\Users\Admin\AppData\Local\Temp\594.tmp"106⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\620.tmp"C:\Users\Admin\AppData\Local\Temp\620.tmp"107⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"108⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"110⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"111⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\8A1.tmp"C:\Users\Admin\AppData\Local\Temp\8A1.tmp"112⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"113⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"114⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"115⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"116⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\C4B.tmp"C:\Users\Admin\AppData\Local\Temp\C4B.tmp"118⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\CD7.tmp"C:\Users\Admin\AppData\Local\Temp\CD7.tmp"119⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"120⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\DD1.tmp"C:\Users\Admin\AppData\Local\Temp\DD1.tmp"121⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\E4E.tmp"C:\Users\Admin\AppData\Local\Temp\E4E.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:3256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-