Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe
- Size 524KB
- Sample260730-eeccnasvgt
- SHA256 6a47c3dc7e2067a39029add4448ab2b49a27e18c2ea37851619b942fb50d7b27
- MD5 1f1677ce8c27488621f5f712b5c625f0
- SHA1 638b2e53c857657b169d45ade1273f2e1137a407
- SHA512 19f4ba394279b3c3986359c8b7aec0c768bec2868f02aa3bef35a966a6a4c042936b92eb1ab30037a64272e813ea1baf8ad3a5d4f0c00840aadd76ca5c7487b7
- SSDEEP 12288:TRyZzqyL66T6DL86hpt3k7DI30jnKo/CmCJF4jNZ:TRyQylT65pUI6nKo6TMN
- TLSH T1C9B4F025BA85C032F19205768A26EB62597F7CB55B27A4CB3B95363D2FB03D1E274303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3820 B155.tmp 3000 B25E.tmp 2952 B3A6.tmp 1248 B4EE.tmp 4596 B627.tmp 4320 B740.tmp 2572 B879.tmp 2668 B8F6.tmp 1260 BA3E.tmp 5892 BACA.tmp 4884 BB28.tmp 616 BBF3.tmp 2488 BC51.tmp 1880 BD2C.tmp 4800 BDC8.tmp 1716 BE45.tmp 2724 BEE1.tmp 4896 BF6E.tmp 4620 C029.tmp 1624 C097.tmp 2604 C133.tmp 2736 C1DF.tmp 1564 C26C.tmp 2636 C308.tmp 2932 C394.tmp 4916 C3F2.tmp 760 C48E.tmp 1996 C4FC.tmp 5392 C588.tmp 4524 C615.tmp 1304 C6C1.tmp 2092 C76D.tmp 5748 C7EA.tmp 4084 C867.tmp 5552 C913.tmp 4752 C99F.tmp 3188 CA1C.tmp 1216 CAB9.tmp 4472 CB26.tmp 3468 CBD2.tmp 244 CC4F.tmp 5284 CD1A.tmp 4936 CDA7.tmp 4572 CE62.tmp 5376 CF3D.tmp 5856 D008.tmp 4960 D0A4.tmp 1960 D16F.tmp 5752 D21B.tmp 4220 D279.tmp 3956 D2F6.tmp 4148 D373.tmp 5164 D400.tmp 4208 D49C.tmp 1060 D519.tmp 4528 D596.tmp 4336 D603.tmp 4796 D690.tmp 3336 D71C.tmp 6084 D7A9.tmp 4804 D816.tmp 2652 D8B3.tmp 2740 D93F.tmp 3060 D9AD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 157D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 804D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F55E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D13C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B879.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D71C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7456.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5796 wrote to memory of 3820 5796 2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe 89 PID 3820 wrote to memory of 3000 3820 B155.tmp 90 PID 3000 wrote to memory of 2952 3000 B25E.tmp 91 PID 2952 wrote to memory of 1248 2952 B3A6.tmp 92 PID 1248 wrote to memory of 4596 1248 B4EE.tmp 93 PID 4596 wrote to memory of 4320 4596 B627.tmp 94 PID 4320 wrote to memory of 2572 4320 B740.tmp 95 PID 2572 wrote to memory of 2668 2572 B879.tmp 96 PID 2668 wrote to memory of 1260 2668 B8F6.tmp 97 PID 1260 wrote to memory of 5892 1260 BA3E.tmp 98 PID 5892 wrote to memory of 4884 5892 BACA.tmp 99 PID 4884 wrote to memory of 616 4884 BB28.tmp 100 PID 616 wrote to memory of 2488 616 BBF3.tmp 101 PID 2488 wrote to memory of 1880 2488 BC51.tmp 102 PID 1880 wrote to memory of 4800 1880 BD2C.tmp 103 PID 4800 wrote to memory of 1716 4800 BDC8.tmp 104 PID 1716 wrote to memory of 2724 1716 BE45.tmp 105 PID 2724 wrote to memory of 4896 2724 BEE1.tmp 106 PID 4896 wrote to memory of 4620 4896 BF6E.tmp 107 PID 4620 wrote to memory of 1624 4620 C029.tmp 108 PID 1624 wrote to memory of 2604 1624 C097.tmp 109 PID 2604 wrote to memory of 2736 2604 C133.tmp 110 PID 2736 wrote to memory of 1564 2736 C1DF.tmp 111 PID 1564 wrote to memory of 2636 1564 C26C.tmp 112 PID 2636 wrote to memory of 2932 2636 C308.tmp 113 PID 2932 wrote to memory of 4916 2932 C394.tmp 114 PID 4916 wrote to memory of 760 4916 C3F2.tmp 115 PID 760 wrote to memory of 1996 760 C48E.tmp 116 PID 1996 wrote to memory of 5392 1996 C4FC.tmp 117 PID 5392 wrote to memory of 4524 5392 C588.tmp 118 PID 4524 wrote to memory of 1304 4524 C615.tmp 119 PID 1304 wrote to memory of 2092 1304 C6C1.tmp 120 PID 2092 wrote to memory of 5748 2092 C76D.tmp 121 PID 5748 wrote to memory of 4084 5748 C7EA.tmp 122 PID 4084 wrote to memory of 5552 4084 C867.tmp 123 PID 5552 wrote to memory of 4752 5552 C913.tmp 124 PID 4752 wrote to memory of 3188 4752 C99F.tmp 125 PID 3188 wrote to memory of 1216 3188 CA1C.tmp 126 PID 1216 wrote to memory of 4472 1216 CAB9.tmp 127 PID 4472 wrote to memory of 3468 4472 CB26.tmp 128 PID 3468 wrote to memory of 244 3468 CBD2.tmp 129 PID 244 wrote to memory of 5284 244 CC4F.tmp 130 PID 5284 wrote to memory of 4936 5284 CD1A.tmp 131 PID 4936 wrote to memory of 4572 4936 CDA7.tmp 132 PID 4572 wrote to memory of 5376 4572 CE62.tmp 133 PID 5376 wrote to memory of 5856 5376 CF3D.tmp 134 PID 5856 wrote to memory of 4960 5856 D008.tmp 135 PID 4960 wrote to memory of 1960 4960 D0A4.tmp 136 PID 1960 wrote to memory of 5752 1960 D16F.tmp 137 PID 5752 wrote to memory of 4220 5752 D21B.tmp 138 PID 4220 wrote to memory of 3956 4220 D279.tmp 139 PID 3956 wrote to memory of 4148 3956 D2F6.tmp 140 PID 4148 wrote to memory of 5164 4148 D373.tmp 141 PID 5164 wrote to memory of 4208 5164 D400.tmp 142 PID 4208 wrote to memory of 1060 4208 D49C.tmp 143 PID 1060 wrote to memory of 4528 1060 D519.tmp 144 PID 4528 wrote to memory of 4336 4528 D596.tmp 145 PID 4336 wrote to memory of 4796 4336 D603.tmp 146 PID 4796 wrote to memory of 3336 4796 D690.tmp 147 PID 3336 wrote to memory of 6084 3336 D71C.tmp 148 PID 6084 wrote to memory of 4804 6084 D7A9.tmp 149 PID 4804 wrote to memory of 2652 4804 D816.tmp 150 PID 2652 wrote to memory of 2740 2652 D8B3.tmp 151 PID 2740 wrote to memory of 3060 2740 D93F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\B740.tmp"C:\Users\Admin\AppData\Local\Temp\B740.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\B879.tmp"C:\Users\Admin\AppData\Local\Temp\B879.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\BB28.tmp"C:\Users\Admin\AppData\Local\Temp\BB28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\C029.tmp"C:\Users\Admin\AppData\Local\Temp\C029.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\C26C.tmp"C:\Users\Admin\AppData\Local\Temp\C26C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C308.tmp"C:\Users\Admin\AppData\Local\Temp\C308.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C394.tmp"C:\Users\Admin\AppData\Local\Temp\C394.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"C:\Users\Admin\AppData\Local\Temp\C4FC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\C588.tmp"C:\Users\Admin\AppData\Local\Temp\C588.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\C615.tmp"C:\Users\Admin\AppData\Local\Temp\C615.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"C:\Users\Admin\AppData\Local\Temp\C7EA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\C867.tmp"C:\Users\Admin\AppData\Local\Temp\C867.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"C:\Users\Admin\AppData\Local\Temp\CA1C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"C:\Users\Admin\AppData\Local\Temp\CDA7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\D279.tmp"C:\Users\Admin\AppData\Local\Temp\D279.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\D373.tmp"C:\Users\Admin\AppData\Local\Temp\D373.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\D400.tmp"C:\Users\Admin\AppData\Local\Temp\D400.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\D519.tmp"C:\Users\Admin\AppData\Local\Temp\D519.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D596.tmp"C:\Users\Admin\AppData\Local\Temp\D596.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\D603.tmp"C:\Users\Admin\AppData\Local\Temp\D603.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\D71C.tmp"C:\Users\Admin\AppData\Local\Temp\D71C.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\D816.tmp"C:\Users\Admin\AppData\Local\Temp\D816.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"65⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"66⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"67⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"68⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\DB81.tmp"C:\Users\Admin\AppData\Local\Temp\DB81.tmp"69⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"70⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"71⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"C:\Users\Admin\AppData\Local\Temp\DDA4.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"75⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"76⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"77⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"78⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"79⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"80⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"81⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"82⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"83⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"84⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"85⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"86⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"87⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\E584.tmp"C:\Users\Admin\AppData\Local\Temp\E584.tmp"88⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"90⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"91⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"92⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\E843.tmp"C:\Users\Admin\AppData\Local\Temp\E843.tmp"93⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"C:\Users\Admin\AppData\Local\Temp\E8D0.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\E95C.tmp"C:\Users\Admin\AppData\Local\Temp\E95C.tmp"95⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"96⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"97⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"98⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\EB60.tmp"C:\Users\Admin\AppData\Local\Temp\EB60.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"100⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"101⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"102⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"103⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"104⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"105⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"106⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"107⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\F013.tmp"C:\Users\Admin\AppData\Local\Temp\F013.tmp"108⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"109⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"110⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"111⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\F226.tmp"C:\Users\Admin\AppData\Local\Temp\F226.tmp"112⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"113⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\F36E.tmp"C:\Users\Admin\AppData\Local\Temp\F36E.tmp"114⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"115⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F468.tmp"C:\Users\Admin\AppData\Local\Temp\F468.tmp"116⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"C:\Users\Admin\AppData\Local\Temp\F4D6.tmp"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\F562.tmp"C:\Users\Admin\AppData\Local\Temp\F562.tmp"118⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"119⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\F64D.tmp"C:\Users\Admin\AppData\Local\Temp\F64D.tmp"120⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"121⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-