Analysis
- max time kernel
119s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_2f084cc09e21669299d0a18460af3e2f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_2f084cc09e21669299d0a18460af3e2f_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-10_2f084cc09e21669299d0a18460af3e2f_elex_mafia.exe
- Size 518KB
- Sample260710-wt6ngset6q
- SHA256 8131a331e6cc1213ff83052888f93d5e29e60e868720ada4a3f3756324c529e6
- MD5 2f084cc09e21669299d0a18460af3e2f
- SHA1 ea5170269b713a118ace1580352c1b1fe2ac7bff
- SHA512 554e3b21bd50929b3c280ec8fc4624a92cddc556b1dfee8a06b8cdf483da7094f8e5d7b65a2d1ad6034e30eec5131daa8bbe4235925accd137b3e19edf39215f
- SSDEEP 12288:Jf1yBOtIZdpH+IKe33lPeR6d+m/zDrMeNms+NZ:JfcBzZdcIKm3lPhoczXRwN
- TLSH T1E3B4F112BA84C032E9D301318A61EB96593E7C759726A4C77BC436AD6FF53D2C27834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4648 452D.tmp 3760 45D9.tmp 3436 4711.tmp 2268 481B.tmp 5152 4905.tmp 5088 4992.tmp 4792 4B28.tmp 5032 4BE4.tmp 5000 4C90.tmp 1212 4DC8.tmp 2160 4EE1.tmp 1360 4FAD.tmp 3584 5087.tmp 5408 5181.tmp 5164 527B.tmp 5492 5337.tmp 3964 5440.tmp 1596 553A.tmp 3280 5654.tmp 352 576D.tmp 1376 5848.tmp 4964 5961.tmp 5264 5AA9.tmp 4608 5B84.tmp 1568 5CDC.tmp 4072 5DD6.tmp 5280 5EC0.tmp 4060 5FCA.tmp 4560 60D3.tmp 3844 61AE.tmp 4272 62A8.tmp 3472 63E0.tmp 1356 649C.tmp 1988 6519.tmp 3728 6596.tmp 4840 6642.tmp 5524 66DE.tmp 3148 676B.tmp 5008 67E8.tmp 1660 68B3.tmp 1948 694F.tmp 5812 6A1A.tmp 1256 6AD6.tmp 2632 6B53.tmp 2876 6BEF.tmp 4576 6CBA.tmp 3712 6D47.tmp 2136 6DC4.tmp 3056 6E8F.tmp 6132 6F2B.tmp 4384 6FC7.tmp 3520 7064.tmp 1548 712F.tmp 4724 71DB.tmp 4360 7267.tmp 5780 72F4.tmp 3136 7390.tmp 1104 742C.tmp 4684 7507.tmp 4304 75C3.tmp 3608 765F.tmp 4632 77B7.tmp 3500 7872.tmp 3916 78EF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D293.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 936C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 883C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 349E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C28B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 4648 1272 2026-07-10_2f084cc09e21669299d0a18460af3e2f_elex_mafia.exe 86 PID 4648 wrote to memory of 3760 4648 452D.tmp 87 PID 3760 wrote to memory of 3436 3760 45D9.tmp 88 PID 3436 wrote to memory of 2268 3436 4711.tmp 89 PID 2268 wrote to memory of 5152 2268 481B.tmp 90 PID 5152 wrote to memory of 5088 5152 4905.tmp 91 PID 5088 wrote to memory of 4792 5088 4992.tmp 92 PID 4792 wrote to memory of 5032 4792 4B28.tmp 93 PID 5032 wrote to memory of 5000 5032 4BE4.tmp 94 PID 5000 wrote to memory of 1212 5000 4C90.tmp 95 PID 1212 wrote to memory of 2160 1212 4DC8.tmp 96 PID 2160 wrote to memory of 1360 2160 4EE1.tmp 97 PID 1360 wrote to memory of 3584 1360 4FAD.tmp 98 PID 3584 wrote to memory of 5408 3584 5087.tmp 99 PID 5408 wrote to memory of 5164 5408 5181.tmp 100 PID 5164 wrote to memory of 5492 5164 527B.tmp 101 PID 5492 wrote to memory of 3964 5492 5337.tmp 102 PID 3964 wrote to memory of 1596 3964 5440.tmp 103 PID 1596 wrote to memory of 3280 1596 553A.tmp 104 PID 3280 wrote to memory of 352 3280 5654.tmp 105 PID 352 wrote to memory of 1376 352 576D.tmp 106 PID 1376 wrote to memory of 4964 1376 5848.tmp 107 PID 4964 wrote to memory of 5264 4964 5961.tmp 108 PID 5264 wrote to memory of 4608 5264 5AA9.tmp 109 PID 4608 wrote to memory of 1568 4608 5B84.tmp 110 PID 1568 wrote to memory of 4072 1568 5CDC.tmp 111 PID 4072 wrote to memory of 5280 4072 5DD6.tmp 112 PID 5280 wrote to memory of 4060 5280 5EC0.tmp 113 PID 4060 wrote to memory of 4560 4060 5FCA.tmp 114 PID 4560 wrote to memory of 3844 4560 60D3.tmp 115 PID 3844 wrote to memory of 4272 3844 61AE.tmp 116 PID 4272 wrote to memory of 3472 4272 62A8.tmp 117 PID 3472 wrote to memory of 1356 3472 63E0.tmp 118 PID 1356 wrote to memory of 1988 1356 649C.tmp 119 PID 1988 wrote to memory of 3728 1988 6519.tmp 120 PID 3728 wrote to memory of 4840 3728 6596.tmp 121 PID 4840 wrote to memory of 5524 4840 6642.tmp 122 PID 5524 wrote to memory of 3148 5524 66DE.tmp 123 PID 3148 wrote to memory of 5008 3148 676B.tmp 124 PID 5008 wrote to memory of 1660 5008 67E8.tmp 125 PID 1660 wrote to memory of 1948 1660 68B3.tmp 126 PID 1948 wrote to memory of 5812 1948 694F.tmp 127 PID 5812 wrote to memory of 1256 5812 6A1A.tmp 128 PID 1256 wrote to memory of 2632 1256 6AD6.tmp 129 PID 2632 wrote to memory of 2876 2632 6B53.tmp 130 PID 2876 wrote to memory of 4576 2876 6BEF.tmp 131 PID 4576 wrote to memory of 3712 4576 6CBA.tmp 132 PID 3712 wrote to memory of 2136 3712 6D47.tmp 133 PID 2136 wrote to memory of 3056 2136 6DC4.tmp 134 PID 3056 wrote to memory of 6132 3056 6E8F.tmp 135 PID 6132 wrote to memory of 4384 6132 6F2B.tmp 136 PID 4384 wrote to memory of 3520 4384 6FC7.tmp 137 PID 3520 wrote to memory of 1548 3520 7064.tmp 138 PID 1548 wrote to memory of 4724 1548 712F.tmp 139 PID 4724 wrote to memory of 4360 4724 71DB.tmp 140 PID 4360 wrote to memory of 5780 4360 7267.tmp 141 PID 5780 wrote to memory of 3136 5780 72F4.tmp 142 PID 3136 wrote to memory of 1104 3136 7390.tmp 143 PID 1104 wrote to memory of 4684 1104 742C.tmp 144 PID 4684 wrote to memory of 4304 4684 7507.tmp 145 PID 4304 wrote to memory of 3608 4304 75C3.tmp 146 PID 5580 wrote to memory of 4632 5580 772A.tmp 148 PID 4632 wrote to memory of 3500 4632 77B7.tmp 149 PID 3500 wrote to memory of 3916 3500 7872.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_2f084cc09e21669299d0a18460af3e2f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_2f084cc09e21669299d0a18460af3e2f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\4711.tmp"C:\Users\Admin\AppData\Local\Temp\4711.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\481B.tmp"C:\Users\Admin\AppData\Local\Temp\481B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\5181.tmp"C:\Users\Admin\AppData\Local\Temp\5181.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\5337.tmp"C:\Users\Admin\AppData\Local\Temp\5337.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\553A.tmp"C:\Users\Admin\AppData\Local\Temp\553A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\576D.tmp"C:\Users\Admin\AppData\Local\Temp\576D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\5961.tmp"C:\Users\Admin\AppData\Local\Temp\5961.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5DD6.tmp"C:\Users\Admin\AppData\Local\Temp\5DD6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\5EC0.tmp"C:\Users\Admin\AppData\Local\Temp\5EC0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\61AE.tmp"C:\Users\Admin\AppData\Local\Temp\61AE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\62A8.tmp"C:\Users\Admin\AppData\Local\Temp\62A8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\63E0.tmp"C:\Users\Admin\AppData\Local\Temp\63E0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\67E8.tmp"C:\Users\Admin\AppData\Local\Temp\67E8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\68B3.tmp"C:\Users\Admin\AppData\Local\Temp\68B3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\694F.tmp"C:\Users\Admin\AppData\Local\Temp\694F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\6B53.tmp"C:\Users\Admin\AppData\Local\Temp\6B53.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\6D47.tmp"C:\Users\Admin\AppData\Local\Temp\6D47.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7064.tmp"C:\Users\Admin\AppData\Local\Temp\7064.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\7267.tmp"C:\Users\Admin\AppData\Local\Temp\7267.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\742C.tmp"C:\Users\Admin\AppData\Local\Temp\742C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\75C3.tmp"C:\Users\Admin\AppData\Local\Temp\75C3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"62⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\772A.tmp"C:\Users\Admin\AppData\Local\Temp\772A.tmp"63⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\77B7.tmp"C:\Users\Admin\AppData\Local\Temp\77B7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"66⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"67⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"68⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"69⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"70⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"71⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"72⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"73⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"74⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"75⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"76⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"77⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"78⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"79⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"80⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"81⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"82⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"83⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"84⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"85⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"86⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\8505.tmp"C:\Users\Admin\AppData\Local\Temp\8505.tmp"87⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"88⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"89⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"90⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"91⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"92⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\888F.tmp"C:\Users\Admin\AppData\Local\Temp\888F.tmp"93⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"94⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"95⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"96⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"97⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"98⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"99⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"100⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"102⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"103⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\8F17.tmp"C:\Users\Admin\AppData\Local\Temp\8F17.tmp"104⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"105⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"106⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\90AD.tmp"C:\Users\Admin\AppData\Local\Temp\90AD.tmp"107⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\9149.tmp"C:\Users\Admin\AppData\Local\Temp\9149.tmp"108⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"109⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"110⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\92EF.tmp"C:\Users\Admin\AppData\Local\Temp\92EF.tmp"111⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"113⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\9486.tmp"C:\Users\Admin\AppData\Local\Temp\9486.tmp"114⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"116⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"117⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\96B8.tmp"C:\Users\Admin\AppData\Local\Temp\96B8.tmp"118⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"119⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"121⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"122⤵PID:5248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-