Analysis
- max time kernel
128s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_a3e512c3df53ab5682954be3d55e4b56_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_a3e512c3df53ab5682954be3d55e4b56_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_a3e512c3df53ab5682954be3d55e4b56_elex_mafia.exe
- Size 524KB
- Sample260730-dln5csah53
- SHA256 3e51f3218987018106c0c3f1958806794c8a74f715d515b9b8d35f141ee31cf9
- MD5 a3e512c3df53ab5682954be3d55e4b56
- SHA1 6477d7a0299d26e699d7eecc6e6d2f7bdfae334e
- SHA512 4471d1d913ea18651bb96abdfc771cdef977c64a673bc409f0bddaaa1f0a447afc6dadfb47366c5044507679a8c6c3e246355f2b259071678817523665c7494c
- SSDEEP 12288:TRyZzqyL66TgojBHEHCGPeCZU709gdQUOHHDDR7NZ:TRyQylTgskiCeJjJOnDDR7N
- TLSH T1CBB4F006B584C032F69211368E15EB95593E7D75AB27A4CB3BC42A2E6FF03E197B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4608 A500.tmp 4700 A668.tmp 1428 A994.tmp 1732 AADC.tmp 1916 AC15.tmp 5968 AD9B.tmp 4512 AEB5.tmp 2848 AFBE.tmp 5656 B099.tmp 5052 B174.tmp 3144 B25E.tmp 3796 B368.tmp 4456 B481.tmp 2768 B5BA.tmp 4308 B6F2.tmp 2832 B83A.tmp 3348 B953.tmp 5788 BA4D.tmp 1208 BBE4.tmp 3272 BD1C.tmp 5768 BE64.tmp 2784 BF7E.tmp 4936 C087.tmp 1868 C1C0.tmp 2920 C308.tmp 3996 C3F2.tmp 2900 C4FC.tmp 1408 C654.tmp 5892 C7AB.tmp 2380 C961.tmp 572 CAB9.tmp 5460 CBD2.tmp 5448 CCCC.tmp 4672 CDB6.tmp 5632 CE72.tmp 1844 CF3D.tmp 4336 D046.tmp 4364 D0F2.tmp 904 D1BD.tmp 4104 D2B7.tmp 2556 D3A2.tmp 2820 D45D.tmp 2864 D548.tmp 5592 D613.tmp 1500 D70D.tmp 3960 D826.tmp 3052 D910.tmp 1376 D9CC.tmp 5552 DA68.tmp 1272 DB04.tmp 4132 DB91.tmp 5440 DC3D.tmp 52 DCCA.tmp 932 DD47.tmp 1112 DDE3.tmp 2696 DE6F.tmp 3292 DEDD.tmp 2700 DF69.tmp 2500 DFE6.tmp 2560 E092.tmp 5800 E14E.tmp 3428 E1DA.tmp 3552 E277.tmp 4292 E2F4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E65F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 640B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E81F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D022.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 449C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5541.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5292 wrote to memory of 4608 5292 2026-07-30_a3e512c3df53ab5682954be3d55e4b56_elex_mafia.exe 89 PID 4608 wrote to memory of 4700 4608 A500.tmp 90 PID 4700 wrote to memory of 1428 4700 A668.tmp 91 PID 1428 wrote to memory of 1732 1428 A994.tmp 92 PID 1732 wrote to memory of 1916 1732 AADC.tmp 93 PID 1916 wrote to memory of 5968 1916 AC15.tmp 94 PID 5968 wrote to memory of 4512 5968 AD9B.tmp 95 PID 4512 wrote to memory of 2848 4512 AEB5.tmp 96 PID 2848 wrote to memory of 5656 2848 AFBE.tmp 97 PID 5656 wrote to memory of 5052 5656 B099.tmp 98 PID 5052 wrote to memory of 3144 5052 B174.tmp 99 PID 3144 wrote to memory of 3796 3144 B25E.tmp 100 PID 3796 wrote to memory of 4456 3796 B368.tmp 101 PID 4456 wrote to memory of 2768 4456 B481.tmp 102 PID 2768 wrote to memory of 4308 2768 B5BA.tmp 103 PID 4308 wrote to memory of 2832 4308 B6F2.tmp 104 PID 2832 wrote to memory of 3348 2832 B83A.tmp 105 PID 3348 wrote to memory of 5788 3348 B953.tmp 106 PID 5788 wrote to memory of 1208 5788 BA4D.tmp 107 PID 1208 wrote to memory of 3272 1208 BBE4.tmp 108 PID 3272 wrote to memory of 5768 3272 BD1C.tmp 109 PID 5768 wrote to memory of 2784 5768 BE64.tmp 110 PID 2784 wrote to memory of 4936 2784 BF7E.tmp 111 PID 4936 wrote to memory of 1868 4936 C087.tmp 112 PID 1868 wrote to memory of 2920 1868 C1C0.tmp 113 PID 2920 wrote to memory of 3996 2920 C308.tmp 114 PID 3996 wrote to memory of 2900 3996 C3F2.tmp 115 PID 2900 wrote to memory of 1408 2900 C4FC.tmp 116 PID 1408 wrote to memory of 5892 1408 C654.tmp 117 PID 5892 wrote to memory of 2380 5892 C7AB.tmp 118 PID 2380 wrote to memory of 572 2380 C961.tmp 119 PID 572 wrote to memory of 5460 572 CAB9.tmp 120 PID 5460 wrote to memory of 5448 5460 CBD2.tmp 121 PID 5448 wrote to memory of 4672 5448 CCCC.tmp 122 PID 4672 wrote to memory of 5632 4672 CDB6.tmp 123 PID 5632 wrote to memory of 1844 5632 CE72.tmp 124 PID 1844 wrote to memory of 4336 1844 CF3D.tmp 125 PID 4336 wrote to memory of 4364 4336 D046.tmp 126 PID 4364 wrote to memory of 904 4364 D0F2.tmp 127 PID 904 wrote to memory of 4104 904 D1BD.tmp 128 PID 4104 wrote to memory of 2556 4104 D2B7.tmp 129 PID 2556 wrote to memory of 2820 2556 D3A2.tmp 130 PID 2820 wrote to memory of 2864 2820 D45D.tmp 131 PID 2864 wrote to memory of 5592 2864 D548.tmp 132 PID 5592 wrote to memory of 1500 5592 D613.tmp 133 PID 1500 wrote to memory of 3960 1500 D70D.tmp 134 PID 3960 wrote to memory of 3052 3960 D826.tmp 135 PID 3052 wrote to memory of 1376 3052 D910.tmp 136 PID 1376 wrote to memory of 5552 1376 D9CC.tmp 137 PID 5552 wrote to memory of 1272 5552 DA68.tmp 138 PID 1272 wrote to memory of 4132 1272 DB04.tmp 139 PID 4132 wrote to memory of 5440 4132 DB91.tmp 140 PID 5440 wrote to memory of 52 5440 DC3D.tmp 141 PID 52 wrote to memory of 932 52 DCCA.tmp 142 PID 932 wrote to memory of 1112 932 DD47.tmp 143 PID 1112 wrote to memory of 2696 1112 DDE3.tmp 144 PID 2696 wrote to memory of 3292 2696 DE6F.tmp 145 PID 3292 wrote to memory of 2700 3292 DEDD.tmp 146 PID 2700 wrote to memory of 2500 2700 DF69.tmp 147 PID 2500 wrote to memory of 2560 2500 DFE6.tmp 148 PID 2560 wrote to memory of 5800 2560 E092.tmp 149 PID 5800 wrote to memory of 3428 5800 E14E.tmp 150 PID 3428 wrote to memory of 3552 3428 E1DA.tmp 151 PID 3552 wrote to memory of 4292 3552 E277.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_a3e512c3df53ab5682954be3d55e4b56_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a3e512c3df53ab5682954be3d55e4b56_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\A500.tmp"C:\Users\Admin\AppData\Local\Temp\A500.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A994.tmp"C:\Users\Admin\AppData\Local\Temp\A994.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\AC15.tmp"C:\Users\Admin\AppData\Local\Temp\AC15.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\B099.tmp"C:\Users\Admin\AppData\Local\Temp\B099.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\B368.tmp"C:\Users\Admin\AppData\Local\Temp\B368.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\B481.tmp"C:\Users\Admin\AppData\Local\Temp\B481.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"C:\Users\Admin\AppData\Local\Temp\BBE4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\BE64.tmp"C:\Users\Admin\AppData\Local\Temp\BE64.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\C308.tmp"C:\Users\Admin\AppData\Local\Temp\C308.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C654.tmp"C:\Users\Admin\AppData\Local\Temp\C654.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"C:\Users\Admin\AppData\Local\Temp\C7AB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\C961.tmp"C:\Users\Admin\AppData\Local\Temp\C961.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCCC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"C:\Users\Admin\AppData\Local\Temp\CDB6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"C:\Users\Admin\AppData\Local\Temp\D3A2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\DB04.tmp"C:\Users\Admin\AppData\Local\Temp\DB04.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\DB91.tmp"C:\Users\Admin\AppData\Local\Temp\DB91.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\DC3D.tmp"C:\Users\Admin\AppData\Local\Temp\DC3D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"65⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"66⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"C:\Users\Admin\AppData\Local\Temp\E3FD.tmp"67⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"68⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"69⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"72⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"73⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\E814.tmp"C:\Users\Admin\AppData\Local\Temp\E814.tmp"74⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"75⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"76⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"C:\Users\Admin\AppData\Local\Temp\E9AA.tmp"77⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\EA37.tmp"C:\Users\Admin\AppData\Local\Temp\EA37.tmp"78⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"79⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"80⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"81⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\EC98.tmp"C:\Users\Admin\AppData\Local\Temp\EC98.tmp"82⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\ED35.tmp"C:\Users\Admin\AppData\Local\Temp\ED35.tmp"83⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"84⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"85⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\EECB.tmp"C:\Users\Admin\AppData\Local\Temp\EECB.tmp"86⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"87⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"88⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\F061.tmp"C:\Users\Admin\AppData\Local\Temp\F061.tmp"89⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"90⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"91⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"92⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\F265.tmp"C:\Users\Admin\AppData\Local\Temp\F265.tmp"93⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"94⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"95⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"96⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F505.tmp"C:\Users\Admin\AppData\Local\Temp\F505.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\F582.tmp"C:\Users\Admin\AppData\Local\Temp\F582.tmp"99⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"100⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"101⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"102⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"103⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\F841.tmp"C:\Users\Admin\AppData\Local\Temp\F841.tmp"104⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"105⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"106⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\FA93.tmp"C:\Users\Admin\AppData\Local\Temp\FA93.tmp"108⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\FB00.tmp"C:\Users\Admin\AppData\Local\Temp\FB00.tmp"109⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"110⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\FC29.tmp"C:\Users\Admin\AppData\Local\Temp\FC29.tmp"111⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"112⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\FD23.tmp"C:\Users\Admin\AppData\Local\Temp\FD23.tmp"113⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"116⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"117⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"118⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\8E.tmp"C:\Users\Admin\AppData\Local\Temp\8E.tmp"119⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"120⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"121⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-