Analysis
- max time kernel
122s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_cc94a958d7f4d21807255a16c530d75f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_cc94a958d7f4d21807255a16c530d75f_elex_mafia.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-07_cc94a958d7f4d21807255a16c530d75f_elex_mafia.exe
- Size 524KB
- Sample260707-yfcvcsdx2p
- SHA256 4d2e81dcc40b4bb060338092aa5219d9d046983ac9ca82a5ef3ed458430c63ed
- MD5 cc94a958d7f4d21807255a16c530d75f
- SHA1 51380e20172defe132e9c35764275a37f60e72f5
- SHA512 5d07b6fe089b3295bd4637ec35e47440284f554b152d26b97b44c2c1a72099747e138e4b6d3b2d86b6cf68c13c8522df40d93e95e28993d0684ce9e04d463ed2
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf7gnsmyLrBHtpVsx2b5txhiRvUF8fOucA1le6Rzj:TRyZzqyL66TustXBHVipXOLAHeGSYNZ
- TLSH T1C6B4F015B140C432E69201768B59EBA2597ABC719B27A4CB3BC53A7D2FF13D1E27430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3092 EB70.tmp 5248 EC79.tmp 4404 EDD1.tmp 3728 EEBB.tmp 5200 EF48.tmp 5472 F080.tmp 384 F18A.tmp 4760 F2C3.tmp 1328 F39D.tmp 5364 F497.tmp 816 F572.tmp 4788 F66C.tmp 3684 F756.tmp 600 F850.tmp 4536 F90C.tmp 2380 F9F6.tmp 240 FB10.tmp 2712 FBEA.tmp 5068 FCD5.tmp 252 FDAF.tmp 4872 FE7B.tmp 2104 FF55.tmp 624 40.tmp 3096 11A.tmp 3048 205.tmp 5828 2FF.tmp 2956 3BA.tmp 6016 4D4.tmp 704 5DD.tmp 1624 6D7.tmp 6000 810.tmp 2488 8CB.tmp 5980 9D5.tmp 2396 A90.tmp 5880 B3C.tmp 1832 C07.tmp 1960 CD2.tmp 5336 D8E.tmp 204 E2A.tmp 8 EB7.tmp 2720 F53.tmp 4924 FE0.tmp 5592 108C.tmp 1272 1147.tmp 3636 1241.tmp 4448 12BE.tmp 2032 135A.tmp 1244 13F7.tmp 5688 14B2.tmp 4308 154E.tmp 1364 15DB.tmp 2792 1658.tmp 6140 16D5.tmp 2464 1752.tmp 5500 17DF.tmp 5520 187B.tmp 5624 18F8.tmp 5920 1965.tmp 4624 19D3.tmp 6080 1A50.tmp 4032 1ACD.tmp 1916 1B4A.tmp 2292 1BE6.tmp 1424 1C63.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 809B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 363F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C97B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 721F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A26B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F02E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 833B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8355.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 901C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 3092 1992 2026-07-07_cc94a958d7f4d21807255a16c530d75f_elex_mafia.exe 87 PID 3092 wrote to memory of 5248 3092 EB70.tmp 88 PID 5248 wrote to memory of 4404 5248 EC79.tmp 89 PID 4404 wrote to memory of 3728 4404 EDD1.tmp 90 PID 3728 wrote to memory of 5200 3728 EEBB.tmp 91 PID 5200 wrote to memory of 5472 5200 EF48.tmp 92 PID 5472 wrote to memory of 384 5472 F080.tmp 93 PID 384 wrote to memory of 4760 384 F18A.tmp 94 PID 4760 wrote to memory of 1328 4760 F2C3.tmp 95 PID 1328 wrote to memory of 5364 1328 F39D.tmp 96 PID 5364 wrote to memory of 816 5364 F497.tmp 97 PID 816 wrote to memory of 4788 816 F572.tmp 98 PID 4788 wrote to memory of 3684 4788 F66C.tmp 99 PID 3684 wrote to memory of 600 3684 F756.tmp 100 PID 600 wrote to memory of 4536 600 F850.tmp 101 PID 4536 wrote to memory of 2380 4536 F90C.tmp 102 PID 2380 wrote to memory of 240 2380 F9F6.tmp 103 PID 240 wrote to memory of 2712 240 FB10.tmp 104 PID 2712 wrote to memory of 5068 2712 FBEA.tmp 105 PID 5068 wrote to memory of 252 5068 FCD5.tmp 106 PID 252 wrote to memory of 4872 252 FDAF.tmp 107 PID 4872 wrote to memory of 2104 4872 FE7B.tmp 108 PID 2104 wrote to memory of 624 2104 FF55.tmp 109 PID 624 wrote to memory of 3096 624 40.tmp 110 PID 3096 wrote to memory of 3048 3096 11A.tmp 111 PID 3048 wrote to memory of 5828 3048 205.tmp 112 PID 5828 wrote to memory of 2956 5828 2FF.tmp 113 PID 2956 wrote to memory of 6016 2956 3BA.tmp 114 PID 6016 wrote to memory of 704 6016 4D4.tmp 115 PID 704 wrote to memory of 1624 704 5DD.tmp 116 PID 1624 wrote to memory of 6000 1624 6D7.tmp 117 PID 6000 wrote to memory of 2488 6000 810.tmp 118 PID 2488 wrote to memory of 5980 2488 8CB.tmp 119 PID 5980 wrote to memory of 2396 5980 9D5.tmp 120 PID 2396 wrote to memory of 5880 2396 A90.tmp 121 PID 5880 wrote to memory of 1832 5880 B3C.tmp 122 PID 1832 wrote to memory of 1960 1832 C07.tmp 123 PID 1960 wrote to memory of 5336 1960 CD2.tmp 124 PID 5336 wrote to memory of 204 5336 D8E.tmp 125 PID 204 wrote to memory of 8 204 E2A.tmp 126 PID 8 wrote to memory of 2720 8 EB7.tmp 127 PID 2720 wrote to memory of 4924 2720 F53.tmp 128 PID 4924 wrote to memory of 5592 4924 FE0.tmp 129 PID 5592 wrote to memory of 1272 5592 108C.tmp 130 PID 1272 wrote to memory of 3636 1272 1147.tmp 131 PID 3636 wrote to memory of 4448 3636 1241.tmp 132 PID 4448 wrote to memory of 2032 4448 12BE.tmp 133 PID 2032 wrote to memory of 1244 2032 135A.tmp 134 PID 1244 wrote to memory of 5688 1244 13F7.tmp 135 PID 5688 wrote to memory of 4308 5688 14B2.tmp 136 PID 4308 wrote to memory of 1364 4308 154E.tmp 137 PID 1364 wrote to memory of 2792 1364 15DB.tmp 138 PID 2792 wrote to memory of 6140 2792 1658.tmp 139 PID 6140 wrote to memory of 2464 6140 16D5.tmp 140 PID 2464 wrote to memory of 5500 2464 1752.tmp 141 PID 5500 wrote to memory of 5520 5500 17DF.tmp 142 PID 5520 wrote to memory of 5624 5520 187B.tmp 143 PID 5624 wrote to memory of 5920 5624 18F8.tmp 144 PID 5920 wrote to memory of 4624 5920 1965.tmp 145 PID 4624 wrote to memory of 6080 4624 19D3.tmp 146 PID 6080 wrote to memory of 4032 6080 1A50.tmp 147 PID 4032 wrote to memory of 1916 4032 1ACD.tmp 148 PID 1916 wrote to memory of 2292 1916 1B4A.tmp 149 PID 2292 wrote to memory of 1424 2292 1BE6.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_cc94a958d7f4d21807255a16c530d75f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_cc94a958d7f4d21807255a16c530d75f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\F18A.tmp"C:\Users\Admin\AppData\Local\Temp\F18A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\F756.tmp"C:\Users\Admin\AppData\Local\Temp\F756.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\F850.tmp"C:\Users\Admin\AppData\Local\Temp\F850.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\F90C.tmp"C:\Users\Admin\AppData\Local\Temp\F90C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\FB10.tmp"C:\Users\Admin\AppData\Local\Temp\FB10.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\205.tmp"C:\Users\Admin\AppData\Local\Temp\205.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\5DD.tmp"C:\Users\Admin\AppData\Local\Temp\5DD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\6D7.tmp"C:\Users\Admin\AppData\Local\Temp\6D7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\8CB.tmp"C:\Users\Admin\AppData\Local\Temp\8CB.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9D5.tmp"C:\Users\Admin\AppData\Local\Temp\9D5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B3C.tmp"C:\Users\Admin\AppData\Local\Temp\B3C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\F53.tmp"C:\Users\Admin\AppData\Local\Temp\F53.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\12BE.tmp"C:\Users\Admin\AppData\Local\Temp\12BE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\13F7.tmp"C:\Users\Admin\AppData\Local\Temp\13F7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\16D5.tmp"C:\Users\Admin\AppData\Local\Temp\16D5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\187B.tmp"C:\Users\Admin\AppData\Local\Temp\187B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\18F8.tmp"C:\Users\Admin\AppData\Local\Temp\18F8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\1965.tmp"C:\Users\Admin\AppData\Local\Temp\1965.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\19D3.tmp"C:\Users\Admin\AppData\Local\Temp\19D3.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\1B4A.tmp"C:\Users\Admin\AppData\Local\Temp\1B4A.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1C63.tmp"C:\Users\Admin\AppData\Local\Temp\1C63.tmp"65⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"66⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"67⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"68⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"69⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"70⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"71⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"72⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"73⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"74⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"75⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"76⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"77⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"78⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"79⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"80⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\2471.tmp"C:\Users\Admin\AppData\Local\Temp\2471.tmp"81⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\258B.tmp"C:\Users\Admin\AppData\Local\Temp\258B.tmp"83⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\2608.tmp"C:\Users\Admin\AppData\Local\Temp\2608.tmp"84⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2685.tmp"C:\Users\Admin\AppData\Local\Temp\2685.tmp"85⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2711.tmp"C:\Users\Admin\AppData\Local\Temp\2711.tmp"86⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\27AD.tmp"C:\Users\Admin\AppData\Local\Temp\27AD.tmp"87⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\281B.tmp"C:\Users\Admin\AppData\Local\Temp\281B.tmp"88⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2888.tmp"C:\Users\Admin\AppData\Local\Temp\2888.tmp"89⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\2915.tmp"C:\Users\Admin\AppData\Local\Temp\2915.tmp"90⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\2992.tmp"C:\Users\Admin\AppData\Local\Temp\2992.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"92⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"93⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"94⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\2B95.tmp"C:\Users\Admin\AppData\Local\Temp\2B95.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\2C22.tmp"C:\Users\Admin\AppData\Local\Temp\2C22.tmp"96⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"98⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"99⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"C:\Users\Admin\AppData\Local\Temp\2DF7.tmp"100⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2E83.tmp"C:\Users\Admin\AppData\Local\Temp\2E83.tmp"101⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"102⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"103⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\3039.tmp"C:\Users\Admin\AppData\Local\Temp\3039.tmp"104⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\30C6.tmp"C:\Users\Admin\AppData\Local\Temp\30C6.tmp"105⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\3162.tmp"C:\Users\Admin\AppData\Local\Temp\3162.tmp"106⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\31EE.tmp"C:\Users\Admin\AppData\Local\Temp\31EE.tmp"107⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\326B.tmp"C:\Users\Admin\AppData\Local\Temp\326B.tmp"108⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"109⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\3365.tmp"C:\Users\Admin\AppData\Local\Temp\3365.tmp"110⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\33E2.tmp"C:\Users\Admin\AppData\Local\Temp\33E2.tmp"111⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"112⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\34EC.tmp"C:\Users\Admin\AppData\Local\Temp\34EC.tmp"113⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3559.tmp"C:\Users\Admin\AppData\Local\Temp\3559.tmp"114⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\3615.tmp"C:\Users\Admin\AppData\Local\Temp\3615.tmp"115⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\3682.tmp"C:\Users\Admin\AppData\Local\Temp\3682.tmp"116⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\36F0.tmp"C:\Users\Admin\AppData\Local\Temp\36F0.tmp"117⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\378C.tmp"C:\Users\Admin\AppData\Local\Temp\378C.tmp"118⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3809.tmp"C:\Users\Admin\AppData\Local\Temp\3809.tmp"119⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\38A5.tmp"C:\Users\Admin\AppData\Local\Temp\38A5.tmp"120⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"121⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\399F.tmp"C:\Users\Admin\AppData\Local\Temp\399F.tmp"122⤵PID:4900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-