Analysis
- max time kernel
119s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 14:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_d70362d8bef2c6c6d492cae9e5ee52e2_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_d70362d8bef2c6c6d492cae9e5ee52e2_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_d70362d8bef2c6c6d492cae9e5ee52e2_elex_mafia.exe
- Size 520KB
- Sample260729-rdwfcshm5x
- SHA256 82a9bf72777c379405f7694e3046e784aea3b46ca1e98c1d6a92641c74a36387
- MD5 d70362d8bef2c6c6d492cae9e5ee52e2
- SHA1 9fdd71d60ceec31142cc1909d79961bca14f83f1
- SHA512 13b2c3296e2d43353af3124f51e3ebc7fa3dfa82768539622fe7f01ee0351f974410bd0867a8e10f4a7225b4042ad71ec0cc33cfc8f5b4887303c34a76c7f0eb
- SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkb1dg6Ee0KszNCKigwgssD2TEcRX45w4onQ:gj8fuxR21t5i8f+0z4bMD2fRom4oBNZ6
- TLSH T14DB4F112B545C036E9D616304B22CBA11BBE7D398B3695C73BC4336D6EB52D1EA3930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2540 CDB6.tmp 1524 CE52.tmp 5196 CF4C.tmp 6092 D008.tmp 1268 D0A4.tmp 1556 D1FC.tmp 4444 D354.tmp 4640 D3F0.tmp 4740 D49C.tmp 1688 D557.tmp 4256 D5E4.tmp 2424 D6AF.tmp 260 D78A.tmp 2972 D816.tmp 2600 D8B3.tmp 4696 D96E.tmp 2308 DA0A.tmp 4264 DAA7.tmp 4332 DB43.tmp 3744 DBDF.tmp 4808 DC8B.tmp 3480 DD37.tmp 2312 DDD3.tmp 572 DEAE.tmp 3928 DF69.tmp 5516 E006.tmp 5076 E0E0.tmp 4728 E18C.tmp 1904 E267.tmp 2524 E313.tmp 4724 E3AF.tmp 2192 E47A.tmp 2384 E536.tmp 1104 E5B3.tmp 3900 E64F.tmp 2572 E6EB.tmp 4184 E778.tmp 1744 E805.tmp 1712 E882.tmp 2724 E90E.tmp 5972 E9AA.tmp 5816 EA47.tmp 2428 EAB4.tmp 1236 EB60.tmp 3064 EBDD.tmp 2992 EC5A.tmp 3720 ECE7.tmp 4604 ED64.tmp 2504 EDF0.tmp 1228 EE6D.tmp 1348 EEFA.tmp 3196 EF77.tmp 2512 F003.tmp 4668 F0BF.tmp 6024 F13C.tmp 5776 F265.tmp 2996 F2E2.tmp 1516 F35F.tmp 2904 F3EB.tmp 5968 F459.tmp 6132 F4F5.tmp 4744 F591.tmp 4276 F5FF.tmp 3028 F66C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7720.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 324C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9065.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 346F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 378C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ACE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3143.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 2540 4992 2026-07-29_d70362d8bef2c6c6d492cae9e5ee52e2_elex_mafia.exe 88 PID 2540 wrote to memory of 1524 2540 CDB6.tmp 89 PID 1524 wrote to memory of 5196 1524 CE52.tmp 90 PID 5196 wrote to memory of 6092 5196 CF4C.tmp 91 PID 6092 wrote to memory of 1268 6092 D008.tmp 92 PID 1268 wrote to memory of 1556 1268 D0A4.tmp 93 PID 1556 wrote to memory of 4444 1556 D1FC.tmp 94 PID 4444 wrote to memory of 4640 4444 D354.tmp 95 PID 4640 wrote to memory of 4740 4640 D3F0.tmp 96 PID 4740 wrote to memory of 1688 4740 D49C.tmp 97 PID 1688 wrote to memory of 4256 1688 D557.tmp 98 PID 4256 wrote to memory of 2424 4256 D5E4.tmp 99 PID 2424 wrote to memory of 260 2424 D6AF.tmp 100 PID 260 wrote to memory of 2972 260 D78A.tmp 101 PID 2972 wrote to memory of 2600 2972 D816.tmp 102 PID 2600 wrote to memory of 4696 2600 D8B3.tmp 103 PID 4696 wrote to memory of 2308 4696 D96E.tmp 104 PID 2308 wrote to memory of 4264 2308 DA0A.tmp 105 PID 4264 wrote to memory of 4332 4264 DAA7.tmp 106 PID 4332 wrote to memory of 3744 4332 DB43.tmp 107 PID 3744 wrote to memory of 4808 3744 DBDF.tmp 108 PID 4808 wrote to memory of 3480 4808 DC8B.tmp 109 PID 3480 wrote to memory of 2312 3480 DD37.tmp 110 PID 2312 wrote to memory of 572 2312 DDD3.tmp 111 PID 572 wrote to memory of 3928 572 DEAE.tmp 112 PID 3928 wrote to memory of 5516 3928 DF69.tmp 113 PID 5516 wrote to memory of 5076 5516 E006.tmp 114 PID 5076 wrote to memory of 4728 5076 E0E0.tmp 115 PID 4728 wrote to memory of 1904 4728 E18C.tmp 116 PID 1904 wrote to memory of 2524 1904 E267.tmp 117 PID 2524 wrote to memory of 4724 2524 E313.tmp 118 PID 4724 wrote to memory of 2192 4724 E3AF.tmp 119 PID 2192 wrote to memory of 2384 2192 E47A.tmp 120 PID 2384 wrote to memory of 1104 2384 E536.tmp 121 PID 1104 wrote to memory of 3900 1104 E5B3.tmp 122 PID 3900 wrote to memory of 2572 3900 E64F.tmp 123 PID 2572 wrote to memory of 4184 2572 E6EB.tmp 124 PID 4184 wrote to memory of 1744 4184 E778.tmp 125 PID 1744 wrote to memory of 1712 1744 E805.tmp 126 PID 1712 wrote to memory of 2724 1712 E882.tmp 127 PID 2724 wrote to memory of 5972 2724 E90E.tmp 128 PID 5972 wrote to memory of 5816 5972 E9AA.tmp 129 PID 5816 wrote to memory of 2428 5816 EA47.tmp 130 PID 2428 wrote to memory of 1236 2428 EAB4.tmp 131 PID 1236 wrote to memory of 3064 1236 EB60.tmp 132 PID 3064 wrote to memory of 2992 3064 EBDD.tmp 133 PID 2992 wrote to memory of 3720 2992 EC5A.tmp 134 PID 3720 wrote to memory of 4604 3720 ECE7.tmp 135 PID 4604 wrote to memory of 2504 4604 ED64.tmp 136 PID 2504 wrote to memory of 1228 2504 EDF0.tmp 137 PID 1228 wrote to memory of 1348 1228 EE6D.tmp 138 PID 1348 wrote to memory of 3196 1348 EEFA.tmp 139 PID 3196 wrote to memory of 2512 3196 EF77.tmp 140 PID 2512 wrote to memory of 4668 2512 F003.tmp 141 PID 4668 wrote to memory of 6024 4668 F0BF.tmp 142 PID 5592 wrote to memory of 5776 5592 F1B9.tmp 144 PID 5776 wrote to memory of 2996 5776 F265.tmp 145 PID 2996 wrote to memory of 1516 2996 F2E2.tmp 146 PID 1516 wrote to memory of 2904 1516 F35F.tmp 147 PID 2904 wrote to memory of 5968 2904 F3EB.tmp 148 PID 5968 wrote to memory of 6132 5968 F459.tmp 149 PID 6132 wrote to memory of 4744 6132 F4F5.tmp 150 PID 4744 wrote to memory of 4276 4744 F591.tmp 151 PID 4276 wrote to memory of 3028 4276 F5FF.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_d70362d8bef2c6c6d492cae9e5ee52e2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_d70362d8bef2c6c6d492cae9e5ee52e2_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\CE52.tmp"C:\Users\Admin\AppData\Local\Temp\CE52.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"C:\Users\Admin\AppData\Local\Temp\D3F0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\D557.tmp"C:\Users\Admin\AppData\Local\Temp\D557.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\D816.tmp"C:\Users\Admin\AppData\Local\Temp\D816.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"C:\Users\Admin\AppData\Local\Temp\DBDF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"C:\Users\Admin\AppData\Local\Temp\DC8B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"C:\Users\Admin\AppData\Local\Temp\DDD3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\E006.tmp"C:\Users\Admin\AppData\Local\Temp\E006.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\E267.tmp"C:\Users\Admin\AppData\Local\Temp\E267.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\E47A.tmp"C:\Users\Admin\AppData\Local\Temp\E47A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\E536.tmp"C:\Users\Admin\AppData\Local\Temp\E536.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\E90E.tmp"C:\Users\Admin\AppData\Local\Temp\E90E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\EB60.tmp"C:\Users\Admin\AppData\Local\Temp\EB60.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\EF77.tmp"C:\Users\Admin\AppData\Local\Temp\EF77.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"56⤵
- Executes dropped EXE
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\F1B9.tmp"C:\Users\Admin\AppData\Local\Temp\F1B9.tmp"57⤵
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\F591.tmp"C:\Users\Admin\AppData\Local\Temp\F591.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"66⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"67⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"68⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"69⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"70⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"71⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\F989.tmp"C:\Users\Admin\AppData\Local\Temp\F989.tmp"72⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\FA06.tmp"C:\Users\Admin\AppData\Local\Temp\FA06.tmp"73⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\FA93.tmp"C:\Users\Admin\AppData\Local\Temp\FA93.tmp"74⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\FB10.tmp"C:\Users\Admin\AppData\Local\Temp\FB10.tmp"75⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"76⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\FC67.tmp"C:\Users\Admin\AppData\Local\Temp\FC67.tmp"77⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"78⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"79⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"80⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"81⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"82⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"83⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"84⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"85⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"86⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\1D6.tmp"C:\Users\Admin\AppData\Local\Temp\1D6.tmp"87⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\282.tmp"C:\Users\Admin\AppData\Local\Temp\282.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:708 -
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"90⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"91⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"92⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\58F.tmp"C:\Users\Admin\AppData\Local\Temp\58F.tmp"93⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"94⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\679.tmp"C:\Users\Admin\AppData\Local\Temp\679.tmp"95⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"96⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\793.tmp"C:\Users\Admin\AppData\Local\Temp\793.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\82F.tmp"C:\Users\Admin\AppData\Local\Temp\82F.tmp"98⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\89C.tmp"C:\Users\Admin\AppData\Local\Temp\89C.tmp"99⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"100⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"101⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\A33.tmp"C:\Users\Admin\AppData\Local\Temp\A33.tmp"102⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"103⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\B5B.tmp"C:\Users\Admin\AppData\Local\Temp\B5B.tmp"104⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\BE8.tmp"C:\Users\Admin\AppData\Local\Temp\BE8.tmp"105⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"106⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"107⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\D6F.tmp"C:\Users\Admin\AppData\Local\Temp\D6F.tmp"108⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\DEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEC.tmp"109⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"110⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\EF5.tmp"C:\Users\Admin\AppData\Local\Temp\EF5.tmp"111⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\F63.tmp"C:\Users\Admin\AppData\Local\Temp\F63.tmp"112⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\FEF.tmp"C:\Users\Admin\AppData\Local\Temp\FEF.tmp"113⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"114⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\10DA.tmp"C:\Users\Admin\AppData\Local\Temp\10DA.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"116⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\1270.tmp"C:\Users\Admin\AppData\Local\Temp\1270.tmp"118⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\12ED.tmp"C:\Users\Admin\AppData\Local\Temp\12ED.tmp"119⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\137A.tmp"C:\Users\Admin\AppData\Local\Temp\137A.tmp"120⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\13F7.tmp"C:\Users\Admin\AppData\Local\Temp\13F7.tmp"121⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"122⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-