Analysis
- max time kernel
131s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_703a670f6ee2bee160f574781a36383f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_703a670f6ee2bee160f574781a36383f_elex_mafia.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-08_703a670f6ee2bee160f574781a36383f_elex_mafia.exe
- Size 520KB
- Sample260708-c2qsfsav9j
- SHA256 512112cae5f40ccae8dad1e65c64520a103c16e74bc68221419562d1b17268c6
- MD5 703a670f6ee2bee160f574781a36383f
- SHA1 8703116e47d705532942fc6de1360bfbb84ab9a9
- SHA512 0c22168cbcf275fd35c431464501d160e4583e59ec429eaa84dbea3566cd9deb88cbaffed7d297a65e20f23a652b903cabadfe5d64e72e28766974568ec5fccc
- SSDEEP 12288:gj8fuxR21t5i8fXzO738UgA5eH677KQbUfNZ6:gj8fuK1GYa38UgA5w677K8ANI
- TLSH T1D8B4F1127984C037E9E615314A22DBA55BBFBC358B3591C737803AAD6EB42D1E77830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 828 A36F.tmp 1708 A40B.tmp 992 A4B7.tmp 5908 A553.tmp 6036 A61E.tmp 2660 A69B.tmp 5800 A718.tmp 1032 A7F3.tmp 4504 A870.tmp 5736 A93B.tmp 4784 A9D7.tmp 4772 AA64.tmp 4972 AB10.tmp 6136 ABCB.tmp 2936 AC87.tmp 4984 AD23.tmp 6088 ADB0.tmp 6056 AE3C.tmp 4604 AEE8.tmp 5936 AF75.tmp 4956 B011.tmp 5588 B0DC.tmp 4916 B1A7.tmp 4164 B234.tmp 1108 B2FF.tmp 432 B3AB.tmp 3624 B438.tmp 4824 B4D4.tmp 4584 B570.tmp 400 B65B.tmp 3300 B6F7.tmp 4872 B783.tmp 1196 B85E.tmp 3724 B8CC.tmp 5184 B939.tmp 3160 B9A6.tmp 2436 BA33.tmp 2956 BAC0.tmp 4140 BB2D.tmp 3320 BB9A.tmp 3784 BC17.tmp 3524 BC94.tmp 3156 BD02.tmp 1248 BD8E.tmp 3008 BDFC.tmp 6004 BE79.tmp 4296 BEF6.tmp 5364 BF73.tmp 5436 BFF0.tmp 2356 C05D.tmp 3888 C0DA.tmp 2852 C167.tmp 1080 C1E4.tmp 5080 C270.tmp 5876 C2FD.tmp 1672 C37A.tmp 2208 C3F7.tmp 1548 C474.tmp 5976 C4E1.tmp 2304 C5BC.tmp 5612 C649.tmp 2236 C6B6.tmp 1168 C733.tmp 5892 C7CF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 828 4132 2026-07-08_703a670f6ee2bee160f574781a36383f_elex_mafia.exe 88 PID 828 wrote to memory of 1708 828 A36F.tmp 89 PID 1708 wrote to memory of 992 1708 A40B.tmp 90 PID 992 wrote to memory of 5908 992 A4B7.tmp 91 PID 5908 wrote to memory of 6036 5908 A553.tmp 92 PID 6036 wrote to memory of 2660 6036 A61E.tmp 93 PID 2660 wrote to memory of 5800 2660 A69B.tmp 94 PID 5800 wrote to memory of 1032 5800 A718.tmp 95 PID 1032 wrote to memory of 4504 1032 A7F3.tmp 96 PID 4504 wrote to memory of 5736 4504 A870.tmp 97 PID 5736 wrote to memory of 4784 5736 A93B.tmp 98 PID 4784 wrote to memory of 4772 4784 A9D7.tmp 99 PID 4772 wrote to memory of 4972 4772 AA64.tmp 100 PID 4972 wrote to memory of 6136 4972 AB10.tmp 101 PID 6136 wrote to memory of 2936 6136 ABCB.tmp 102 PID 2936 wrote to memory of 4984 2936 AC87.tmp 103 PID 4984 wrote to memory of 6088 4984 AD23.tmp 104 PID 6088 wrote to memory of 6056 6088 ADB0.tmp 105 PID 6056 wrote to memory of 4604 6056 AE3C.tmp 106 PID 4604 wrote to memory of 5936 4604 AEE8.tmp 107 PID 5936 wrote to memory of 4956 5936 AF75.tmp 108 PID 4956 wrote to memory of 5588 4956 B011.tmp 109 PID 5588 wrote to memory of 4916 5588 B0DC.tmp 110 PID 4916 wrote to memory of 4164 4916 B1A7.tmp 111 PID 4164 wrote to memory of 1108 4164 B234.tmp 112 PID 1108 wrote to memory of 432 1108 B2FF.tmp 113 PID 432 wrote to memory of 3624 432 B3AB.tmp 114 PID 3624 wrote to memory of 4824 3624 B438.tmp 115 PID 4824 wrote to memory of 4584 4824 B4D4.tmp 116 PID 4584 wrote to memory of 400 4584 B570.tmp 117 PID 400 wrote to memory of 3300 400 B65B.tmp 118 PID 3300 wrote to memory of 4872 3300 B6F7.tmp 119 PID 4872 wrote to memory of 1196 4872 B783.tmp 120 PID 1196 wrote to memory of 3724 1196 B85E.tmp 121 PID 3724 wrote to memory of 5184 3724 B8CC.tmp 122 PID 5184 wrote to memory of 3160 5184 B939.tmp 123 PID 3160 wrote to memory of 2436 3160 B9A6.tmp 124 PID 2436 wrote to memory of 2956 2436 BA33.tmp 125 PID 2956 wrote to memory of 4140 2956 BAC0.tmp 126 PID 4140 wrote to memory of 3320 4140 BB2D.tmp 127 PID 3320 wrote to memory of 3784 3320 BB9A.tmp 128 PID 3784 wrote to memory of 3524 3784 BC17.tmp 129 PID 3524 wrote to memory of 3156 3524 BC94.tmp 130 PID 3156 wrote to memory of 1248 3156 BD02.tmp 131 PID 1248 wrote to memory of 3008 1248 BD8E.tmp 132 PID 3008 wrote to memory of 6004 3008 BDFC.tmp 133 PID 6004 wrote to memory of 4296 6004 BE79.tmp 134 PID 4296 wrote to memory of 5364 4296 BEF6.tmp 135 PID 5364 wrote to memory of 5436 5364 BF73.tmp 136 PID 5436 wrote to memory of 2356 5436 BFF0.tmp 137 PID 2356 wrote to memory of 3888 2356 C05D.tmp 138 PID 3888 wrote to memory of 2852 3888 C0DA.tmp 139 PID 2852 wrote to memory of 1080 2852 C167.tmp 140 PID 1080 wrote to memory of 5080 1080 C1E4.tmp 141 PID 5080 wrote to memory of 5876 5080 C270.tmp 142 PID 5876 wrote to memory of 1672 5876 C2FD.tmp 143 PID 1672 wrote to memory of 2208 1672 C37A.tmp 144 PID 2208 wrote to memory of 1548 2208 C3F7.tmp 145 PID 1548 wrote to memory of 5976 1548 C474.tmp 146 PID 5976 wrote to memory of 2304 5976 C4E1.tmp 147 PID 2304 wrote to memory of 5612 2304 C5BC.tmp 148 PID 5612 wrote to memory of 2236 5612 C649.tmp 149 PID 2236 wrote to memory of 1168 2236 C6B6.tmp 150 PID 1168 wrote to memory of 5892 1168 C733.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_703a670f6ee2bee160f574781a36383f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_703a670f6ee2bee160f574781a36383f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A36F.tmp"C:\Users\Admin\AppData\Local\Temp\A36F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\A40B.tmp"C:\Users\Admin\AppData\Local\Temp\A40B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\A553.tmp"C:\Users\Admin\AppData\Local\Temp\A553.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\A870.tmp"C:\Users\Admin\AppData\Local\Temp\A870.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\AA64.tmp"C:\Users\Admin\AppData\Local\Temp\AA64.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\AB10.tmp"C:\Users\Admin\AppData\Local\Temp\AB10.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\B438.tmp"C:\Users\Admin\AppData\Local\Temp\B438.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\B783.tmp"C:\Users\Admin\AppData\Local\Temp\B783.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\B85E.tmp"C:\Users\Admin\AppData\Local\Temp\B85E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\B939.tmp"C:\Users\Admin\AppData\Local\Temp\B939.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\BA33.tmp"C:\Users\Admin\AppData\Local\Temp\BA33.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\BB9A.tmp"C:\Users\Admin\AppData\Local\Temp\BB9A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\BD02.tmp"C:\Users\Admin\AppData\Local\Temp\BD02.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\C37A.tmp"C:\Users\Admin\AppData\Local\Temp\C37A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\C474.tmp"C:\Users\Admin\AppData\Local\Temp\C474.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C733.tmp"C:\Users\Admin\AppData\Local\Temp\C733.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"65⤵
- Executes dropped EXE
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\C84C.tmp"C:\Users\Admin\AppData\Local\Temp\C84C.tmp"66⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"67⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"68⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"69⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\CA50.tmp"C:\Users\Admin\AppData\Local\Temp\CA50.tmp"70⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"71⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"72⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"73⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"74⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"75⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"77⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"78⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"79⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"80⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"81⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"82⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"83⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"84⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\D193.tmp"C:\Users\Admin\AppData\Local\Temp\D193.tmp"85⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"86⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"87⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"89⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\D414.tmp"C:\Users\Admin\AppData\Local\Temp\D414.tmp"90⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"91⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\D50E.tmp"C:\Users\Admin\AppData\Local\Temp\D50E.tmp"92⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"93⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"94⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"95⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"96⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\D77F.tmp"C:\Users\Admin\AppData\Local\Temp\D77F.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"98⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"100⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"101⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\DABB.tmp"C:\Users\Admin\AppData\Local\Temp\DABB.tmp"103⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\DB28.tmp"C:\Users\Admin\AppData\Local\Temp\DB28.tmp"104⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:624 -
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"106⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"107⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"108⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"109⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"110⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"111⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"112⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"113⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"114⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"115⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\E124.tmp"C:\Users\Admin\AppData\Local\Temp\E124.tmp"116⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\E181.tmp"C:\Users\Admin\AppData\Local\Temp\E181.tmp"117⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\E20E.tmp"C:\Users\Admin\AppData\Local\Temp\E20E.tmp"118⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"119⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\E318.tmp"C:\Users\Admin\AppData\Local\Temp\E318.tmp"120⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\E375.tmp"C:\Users\Admin\AppData\Local\Temp\E375.tmp"121⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"122⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-