Analysis
- max time kernel
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_9926172e835da56a1bfc9bac07bdbc1f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_9926172e835da56a1bfc9bac07bdbc1f_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-03_9926172e835da56a1bfc9bac07bdbc1f_elex_mafia.exe
- Size 561KB
- Sample260703-c8tspaft5l
- SHA256 71bfb0a0550536ec6974d58aa4a94139a47508d45365991f046d63a38a79ce2c
- MD5 9926172e835da56a1bfc9bac07bdbc1f
- SHA1 99ab6c0c06df3daefbd954631a3896f36af87d88
- SHA512 26948b92c0f491e5a5d42a9eaaf0785922952dc1313a82899d864f18e90e27f714656735c6ecafc6e4cf63cb95f1bc295e3c7759630f1682a1cf2d8a797307a3
- SSDEEP 12288:VuelPWET0yhBtuOy6jhRLL0fZBnBFZ+WLw9hQ5oAyDZuL:8eEEvhHuOBjrYfZBnBFZ+ywNDoL
- TLSH T1A1C4DF11B2D8C436F1B31A385AF19B62497B7C619B71D5CF2B84622D6FB02D1E638723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1076 CFCE.tmp 484 D05B.tmp 5908 D155.tmp 4724 D201.tmp 2792 D31A.tmp 1016 D3D5.tmp 2696 D443.tmp 1236 D4EF.tmp 3456 D59B.tmp 4504 D646.tmp 5808 D712.tmp 4272 D7EC.tmp 5820 D879.tmp 2900 D934.tmp 5228 D9F0.tmp 1592 DA9C.tmp 6036 DB57.tmp 2128 DC13.tmp 1444 DCEE.tmp 5980 DD6B.tmp 5012 DE16.tmp 5436 DEC2.tmp 2416 DF9D.tmp 5968 E02A.tmp 1028 E0B6.tmp 4780 E162.tmp 5892 E1EF.tmp 556 E28B.tmp 5988 E356.tmp 256 E412.tmp 1808 E48F.tmp 580 E569.tmp 5372 E635.tmp 2236 E6A2.tmp 1928 E70F.tmp 1212 E79C.tmp 2704 E819.tmp 2096 E896.tmp 2960 E932.tmp 4228 E9AF.tmp 1240 EA3C.tmp 1388 EAB9.tmp 4856 EB45.tmp 3208 EBE2.tmp 2684 EC6E.tmp 3924 ECFB.tmp 4300 ED97.tmp 2936 EE33.tmp 1344 EEC0.tmp 6028 EF2D.tmp 4796 EFBA.tmp 4284 F056.tmp 2872 F0E3.tmp 3756 F17F.tmp 2880 F20C.tmp 2100 F289.tmp 5984 F325.tmp 1484 F3A2.tmp 2576 F41F.tmp 5596 F4AC.tmp 5912 F538.tmp 8 F5D5.tmp 3724 F671.tmp 1332 F6FD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 807C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 545B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 576D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 1076 2232 2026-07-03_9926172e835da56a1bfc9bac07bdbc1f_elex_mafia.exe 88 PID 1076 wrote to memory of 484 1076 CFCE.tmp 89 PID 484 wrote to memory of 5908 484 D05B.tmp 90 PID 5908 wrote to memory of 4724 5908 D155.tmp 91 PID 4724 wrote to memory of 2792 4724 D201.tmp 92 PID 2792 wrote to memory of 1016 2792 D31A.tmp 93 PID 1016 wrote to memory of 2696 1016 D3D5.tmp 94 PID 2696 wrote to memory of 1236 2696 D443.tmp 95 PID 1236 wrote to memory of 3456 1236 D4EF.tmp 96 PID 3456 wrote to memory of 4504 3456 D59B.tmp 97 PID 4504 wrote to memory of 5808 4504 D646.tmp 98 PID 5808 wrote to memory of 4272 5808 D712.tmp 99 PID 4272 wrote to memory of 5820 4272 D7EC.tmp 100 PID 5820 wrote to memory of 2900 5820 D879.tmp 101 PID 2900 wrote to memory of 5228 2900 D934.tmp 102 PID 5228 wrote to memory of 1592 5228 D9F0.tmp 103 PID 1592 wrote to memory of 6036 1592 DA9C.tmp 104 PID 6036 wrote to memory of 2128 6036 DB57.tmp 105 PID 2128 wrote to memory of 1444 2128 DC13.tmp 106 PID 1444 wrote to memory of 5980 1444 DCEE.tmp 107 PID 5980 wrote to memory of 5012 5980 DD6B.tmp 108 PID 5012 wrote to memory of 5436 5012 DE16.tmp 109 PID 5436 wrote to memory of 2416 5436 DEC2.tmp 110 PID 2416 wrote to memory of 5968 2416 DF9D.tmp 111 PID 5968 wrote to memory of 1028 5968 E02A.tmp 112 PID 1028 wrote to memory of 4780 1028 E0B6.tmp 113 PID 4780 wrote to memory of 5892 4780 E162.tmp 114 PID 5892 wrote to memory of 556 5892 E1EF.tmp 115 PID 556 wrote to memory of 5988 556 E28B.tmp 116 PID 5988 wrote to memory of 256 5988 E356.tmp 117 PID 256 wrote to memory of 1808 256 E412.tmp 118 PID 1808 wrote to memory of 580 1808 E48F.tmp 119 PID 580 wrote to memory of 5372 580 E569.tmp 120 PID 5372 wrote to memory of 2236 5372 E635.tmp 121 PID 2236 wrote to memory of 1928 2236 E6A2.tmp 122 PID 1928 wrote to memory of 1212 1928 E70F.tmp 123 PID 1212 wrote to memory of 2704 1212 E79C.tmp 124 PID 2704 wrote to memory of 2096 2704 E819.tmp 125 PID 2096 wrote to memory of 2960 2096 E896.tmp 126 PID 2960 wrote to memory of 4228 2960 E932.tmp 127 PID 4228 wrote to memory of 1240 4228 E9AF.tmp 128 PID 1240 wrote to memory of 1388 1240 EA3C.tmp 129 PID 1388 wrote to memory of 4856 1388 EAB9.tmp 130 PID 4856 wrote to memory of 3208 4856 EB45.tmp 131 PID 3208 wrote to memory of 2684 3208 EBE2.tmp 132 PID 2684 wrote to memory of 3924 2684 EC6E.tmp 133 PID 3924 wrote to memory of 4300 3924 ECFB.tmp 134 PID 4300 wrote to memory of 2936 4300 ED97.tmp 135 PID 2936 wrote to memory of 1344 2936 EE33.tmp 136 PID 1344 wrote to memory of 6028 1344 EEC0.tmp 137 PID 6028 wrote to memory of 4796 6028 EF2D.tmp 138 PID 4796 wrote to memory of 4284 4796 EFBA.tmp 139 PID 4284 wrote to memory of 2872 4284 F056.tmp 140 PID 2872 wrote to memory of 3756 2872 F0E3.tmp 141 PID 3756 wrote to memory of 2880 3756 F17F.tmp 142 PID 2880 wrote to memory of 2100 2880 F20C.tmp 143 PID 2100 wrote to memory of 5984 2100 F289.tmp 144 PID 5984 wrote to memory of 1484 5984 F325.tmp 145 PID 1484 wrote to memory of 2576 1484 F3A2.tmp 146 PID 2576 wrote to memory of 5596 2576 F41F.tmp 147 PID 5596 wrote to memory of 5912 5596 F4AC.tmp 148 PID 5912 wrote to memory of 8 5912 F538.tmp 149 PID 8 wrote to memory of 3724 8 F5D5.tmp 150 PID 3724 wrote to memory of 1332 3724 F671.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_9926172e835da56a1bfc9bac07bdbc1f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_9926172e835da56a1bfc9bac07bdbc1f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\D4EF.tmp"C:\Users\Admin\AppData\Local\Temp\D4EF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\DB57.tmp"C:\Users\Admin\AppData\Local\Temp\DB57.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\DE16.tmp"C:\Users\Admin\AppData\Local\Temp\DE16.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\E48F.tmp"C:\Users\Admin\AppData\Local\Temp\E48F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\E635.tmp"C:\Users\Admin\AppData\Local\Temp\E635.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\E70F.tmp"C:\Users\Admin\AppData\Local\Temp\E70F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\E819.tmp"C:\Users\Admin\AppData\Local\Temp\E819.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\E896.tmp"C:\Users\Admin\AppData\Local\Temp\E896.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"C:\Users\Admin\AppData\Local\Temp\EA3C.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\EB45.tmp"C:\Users\Admin\AppData\Local\Temp\EB45.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\EBE2.tmp"C:\Users\Admin\AppData\Local\Temp\EBE2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\ED97.tmp"C:\Users\Admin\AppData\Local\Temp\ED97.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\EE33.tmp"C:\Users\Admin\AppData\Local\Temp\EE33.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\EFBA.tmp"C:\Users\Admin\AppData\Local\Temp\EFBA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\F056.tmp"C:\Users\Admin\AppData\Local\Temp\F056.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\F0E3.tmp"C:\Users\Admin\AppData\Local\Temp\F0E3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\F17F.tmp"C:\Users\Admin\AppData\Local\Temp\F17F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"65⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\F76B.tmp"C:\Users\Admin\AppData\Local\Temp\F76B.tmp"66⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"C:\Users\Admin\AppData\Local\Temp\F7D8.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\F846.tmp"C:\Users\Admin\AppData\Local\Temp\F846.tmp"68⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"69⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\F930.tmp"C:\Users\Admin\AppData\Local\Temp\F930.tmp"70⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"72⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"73⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\FB53.tmp"C:\Users\Admin\AppData\Local\Temp\FB53.tmp"74⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"75⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"76⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"77⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\FD85.tmp"C:\Users\Admin\AppData\Local\Temp\FD85.tmp"78⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"79⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\FE70.tmp"C:\Users\Admin\AppData\Local\Temp\FE70.tmp"80⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"81⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\FF6A.tmp"C:\Users\Admin\AppData\Local\Temp\FF6A.tmp"82⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\16.tmp"C:\Users\Admin\AppData\Local\Temp\16.tmp"83⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"84⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"85⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"86⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"87⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\2A6.tmp"C:\Users\Admin\AppData\Local\Temp\2A6.tmp"88⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"89⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\390.tmp"C:\Users\Admin\AppData\Local\Temp\390.tmp"90⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"91⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\4A9.tmp"C:\Users\Admin\AppData\Local\Temp\4A9.tmp"92⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\517.tmp"C:\Users\Admin\AppData\Local\Temp\517.tmp"93⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\584.tmp"C:\Users\Admin\AppData\Local\Temp\584.tmp"94⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"95⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"96⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\72A.tmp"C:\Users\Admin\AppData\Local\Temp\72A.tmp"97⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\7C6.tmp"C:\Users\Admin\AppData\Local\Temp\7C6.tmp"98⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"99⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\8D0.tmp"C:\Users\Admin\AppData\Local\Temp\8D0.tmp"100⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"101⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"103⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"104⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"105⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"106⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"107⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"108⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\D45.tmp"C:\Users\Admin\AppData\Local\Temp\D45.tmp"109⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\DE1.tmp"C:\Users\Admin\AppData\Local\Temp\DE1.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\E6D.tmp"C:\Users\Admin\AppData\Local\Temp\E6D.tmp"111⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\EEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEA.tmp"112⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"113⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"114⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\1071.tmp"C:\Users\Admin\AppData\Local\Temp\1071.tmp"115⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\10FE.tmp"C:\Users\Admin\AppData\Local\Temp\10FE.tmp"116⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"117⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"118⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"119⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"120⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"122⤵PID:832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-