Analysis
- max time kernel
136s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_5f2162d15737e33a79fc8328bc171596_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_5f2162d15737e33a79fc8328bc171596_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-17_5f2162d15737e33a79fc8328bc171596_elex_mafia.exe
- Size 816KB
- Sample260718-d8gc2afs2k
- SHA256 40a929dd6b89879696e9fbfcc0cf11ba8e1a389cb6cf5bdca309dd305d5936a4
- MD5 5f2162d15737e33a79fc8328bc171596
- SHA1 6e853c4df5449cb231822af7368302b2d2f19e41
- SHA512 b8be7056f26e1d8d39ac15e73f2838e4bb02155717af7141ab1f95c8ceee70942ff88c52459cc1b8e3e64a89c7ecad8d59fe260f28647e903e877c34386b8e84
- SSDEEP 6144:2fzZD/P+lZs2rdEkyc54b8DsanxRl9DeoNc1pSLkOGOehDdlPRIqE1vyyJFcH6Ib:+mF/W8Dsy39bfch/Q1vDJIp7u/Ra3Z
- TLSH T10705F122F644C132E59312354A6AEFA2493A7D214B2359C77BD03A7E6FB07E1DA75303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4624 94E3.tmp 5900 958F.tmp 1568 95FD.tmp 5788 966A.tmp 2152 9793.tmp 5252 986E.tmp 5696 9929.tmp 412 9A04.tmp 5084 9B1D.tmp 5592 9BB9.tmp 3556 9CA4.tmp 4716 9D50.tmp 2220 9E0B.tmp 3432 9EC7.tmp 1416 9FD0.tmp 2328 A0AB.tmp 2364 A176.tmp 1656 A270.tmp 3856 A34B.tmp 5824 A406.tmp 1440 A4F1.tmp 3424 A5EB.tmp 3460 A6A6.tmp 3456 A733.tmp 2892 A82D.tmp 3404 A8F8.tmp 4064 A9E2.tmp 620 AABD.tmp 3020 ABA7.tmp 3952 AC82.tmp 804 AD9B.tmp 2156 AE67.tmp 3664 AF12.tmp 2384 AFAF.tmp 3264 B02C.tmp 4448 B106.tmp 1720 B1A3.tmp 2944 B26E.tmp 2684 B31A.tmp 4856 B397.tmp 3468 B423.tmp 5948 B4A0.tmp 248 B53D.tmp 5572 B5D9.tmp 5940 B675.tmp 1684 B702.tmp 968 B78E.tmp 4468 B82B.tmp 1592 B8C7.tmp 1156 B973.tmp 5952 BA2E.tmp 4840 BACA.tmp 2436 BB76.tmp 2732 BC03.tmp 3716 BC9F.tmp 4512 BD1C.tmp 1744 BDB8.tmp 4216 BE35.tmp 4588 BEC2.tmp 5060 BF5E.tmp 1576 C00A.tmp 4172 C0C6.tmp 2680 C143.tmp 2332 C1B0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9372.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 186B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 350B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D16F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 829A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 585D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 4624 2268 2026-07-17_5f2162d15737e33a79fc8328bc171596_elex_mafia.exe 88 PID 4624 wrote to memory of 5900 4624 94E3.tmp 89 PID 5900 wrote to memory of 1568 5900 958F.tmp 90 PID 1568 wrote to memory of 5788 1568 95FD.tmp 91 PID 5788 wrote to memory of 2152 5788 966A.tmp 92 PID 2152 wrote to memory of 5252 2152 9793.tmp 93 PID 5252 wrote to memory of 5696 5252 986E.tmp 94 PID 5696 wrote to memory of 412 5696 9929.tmp 95 PID 412 wrote to memory of 5084 412 9A04.tmp 96 PID 5084 wrote to memory of 5592 5084 9B1D.tmp 97 PID 5592 wrote to memory of 3556 5592 9BB9.tmp 98 PID 3556 wrote to memory of 4716 3556 9CA4.tmp 99 PID 4716 wrote to memory of 2220 4716 9D50.tmp 100 PID 2220 wrote to memory of 3432 2220 9E0B.tmp 101 PID 3432 wrote to memory of 1416 3432 9EC7.tmp 102 PID 1416 wrote to memory of 2328 1416 9FD0.tmp 103 PID 2328 wrote to memory of 2364 2328 A0AB.tmp 104 PID 2364 wrote to memory of 1656 2364 A176.tmp 105 PID 1656 wrote to memory of 3856 1656 A270.tmp 106 PID 3856 wrote to memory of 5824 3856 A34B.tmp 107 PID 5824 wrote to memory of 1440 5824 A406.tmp 108 PID 1440 wrote to memory of 3424 1440 A4F1.tmp 109 PID 3424 wrote to memory of 3460 3424 A5EB.tmp 110 PID 3460 wrote to memory of 3456 3460 A6A6.tmp 111 PID 3456 wrote to memory of 2892 3456 A733.tmp 112 PID 2892 wrote to memory of 3404 2892 A82D.tmp 113 PID 3404 wrote to memory of 4064 3404 A8F8.tmp 114 PID 4064 wrote to memory of 620 4064 A9E2.tmp 115 PID 620 wrote to memory of 3020 620 AABD.tmp 116 PID 3020 wrote to memory of 3952 3020 ABA7.tmp 117 PID 3952 wrote to memory of 804 3952 AC82.tmp 118 PID 804 wrote to memory of 2156 804 AD9B.tmp 119 PID 2156 wrote to memory of 3664 2156 AE67.tmp 120 PID 3664 wrote to memory of 2384 3664 AF12.tmp 121 PID 2384 wrote to memory of 3264 2384 AFAF.tmp 122 PID 3264 wrote to memory of 4448 3264 B02C.tmp 123 PID 4448 wrote to memory of 1720 4448 B106.tmp 124 PID 1720 wrote to memory of 2944 1720 B1A3.tmp 125 PID 2944 wrote to memory of 2684 2944 B26E.tmp 126 PID 2684 wrote to memory of 4856 2684 B31A.tmp 127 PID 4856 wrote to memory of 3468 4856 B397.tmp 128 PID 3468 wrote to memory of 5948 3468 B423.tmp 129 PID 5948 wrote to memory of 248 5948 B4A0.tmp 130 PID 248 wrote to memory of 5572 248 B53D.tmp 131 PID 5572 wrote to memory of 5940 5572 B5D9.tmp 132 PID 5940 wrote to memory of 1684 5940 B675.tmp 133 PID 1684 wrote to memory of 968 1684 B702.tmp 134 PID 968 wrote to memory of 4468 968 B78E.tmp 135 PID 4468 wrote to memory of 1592 4468 B82B.tmp 136 PID 1592 wrote to memory of 1156 1592 B8C7.tmp 137 PID 1156 wrote to memory of 5952 1156 B973.tmp 138 PID 5952 wrote to memory of 4840 5952 BA2E.tmp 139 PID 4840 wrote to memory of 2436 4840 BACA.tmp 140 PID 2436 wrote to memory of 2732 2436 BB76.tmp 141 PID 2732 wrote to memory of 3716 2732 BC03.tmp 142 PID 3716 wrote to memory of 4512 3716 BC9F.tmp 143 PID 4512 wrote to memory of 1744 4512 BD1C.tmp 144 PID 1744 wrote to memory of 4216 1744 BDB8.tmp 145 PID 4216 wrote to memory of 4588 4216 BE35.tmp 146 PID 4588 wrote to memory of 5060 4588 BEC2.tmp 147 PID 5060 wrote to memory of 1576 5060 BF5E.tmp 148 PID 1576 wrote to memory of 4172 1576 C00A.tmp 149 PID 4172 wrote to memory of 2680 4172 C0C6.tmp 150 PID 2680 wrote to memory of 2332 2680 C143.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_5f2162d15737e33a79fc8328bc171596_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5f2162d15737e33a79fc8328bc171596_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\958F.tmp"C:\Users\Admin\AppData\Local\Temp\958F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\95FD.tmp"C:\Users\Admin\AppData\Local\Temp\95FD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\966A.tmp"C:\Users\Admin\AppData\Local\Temp\966A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\A176.tmp"C:\Users\Admin\AppData\Local\Temp\A176.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\A34B.tmp"C:\Users\Admin\AppData\Local\Temp\A34B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\A406.tmp"C:\Users\Admin\AppData\Local\Temp\A406.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"C:\Users\Admin\AppData\Local\Temp\A6A6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\A733.tmp"C:\Users\Admin\AppData\Local\Temp\A733.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\B02C.tmp"C:\Users\Admin\AppData\Local\Temp\B02C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\B31A.tmp"C:\Users\Admin\AppData\Local\Temp\B31A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\B397.tmp"C:\Users\Admin\AppData\Local\Temp\B397.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\B675.tmp"C:\Users\Admin\AppData\Local\Temp\B675.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B973.tmp"C:\Users\Admin\AppData\Local\Temp\B973.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\C143.tmp"C:\Users\Admin\AppData\Local\Temp\C143.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"65⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"66⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"67⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"68⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"69⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"70⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"72⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"73⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\C692.tmp"C:\Users\Admin\AppData\Local\Temp\C692.tmp"74⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\C71F.tmp"C:\Users\Admin\AppData\Local\Temp\C71F.tmp"75⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"76⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"78⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"80⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"81⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"82⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"84⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"85⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"86⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"87⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"C:\Users\Admin\AppData\Local\Temp\CF2D.tmp"88⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"C:\Users\Admin\AppData\Local\Temp\CFC9.tmp"89⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\D056.tmp"C:\Users\Admin\AppData\Local\Temp\D056.tmp"90⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"91⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"93⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"94⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"95⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"96⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"97⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"98⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"99⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"100⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"C:\Users\Admin\AppData\Local\Temp\D5C5.tmp"101⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"102⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"103⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\D74B.tmp"C:\Users\Admin\AppData\Local\Temp\D74B.tmp"104⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"105⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"106⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"107⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"108⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\DA49.tmp"C:\Users\Admin\AppData\Local\Temp\DA49.tmp"109⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"110⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\DB72.tmp"C:\Users\Admin\AppData\Local\Temp\DB72.tmp"111⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"112⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"113⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"114⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"115⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"116⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\DF0C.tmp"C:\Users\Admin\AppData\Local\Temp\DF0C.tmp"117⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"118⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"119⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"120⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E15D.tmp"C:\Users\Admin\AppData\Local\Temp\E15D.tmp"121⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"122⤵PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-