Analysis
- max time kernel
120s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_27192022d33465e8d989bd0b487536fa_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_27192022d33465e8d989bd0b487536fa_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-18_27192022d33465e8d989bd0b487536fa_elex_mafia.exe
- Size 520KB
- Sample260718-bj9beabv5k
- SHA256 020a72d68a4eddb4a174da6b81ddc8dec25a2997a689546dae622b18fcc92960
- MD5 27192022d33465e8d989bd0b487536fa
- SHA1 bb5dac1d19f0ec407cc7b0cd8e528b29222126f2
- SHA512 b689a81407c121199475e7d217a10b1019d5878d2c8541e622e93470ef037267b9d098367b9d5bc3f80aafed851b5895ad798d9d4cf197880b4c2380be70f5ae
- SSDEEP 12288:gj8fuxR21t5i8f+IZpCRVk71NZiEL/MNZ:gj8fuK1GY+ITCR673yN
- TLSH T14CB4F112B949C032E9E211304BA6DB921BBE7D759B2691C737C036AD6FB52D1D73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1188 4BE4.tmp 3824 4C90.tmp 4316 4DA9.tmp 3128 4F9D.tmp 5296 5058.tmp 4992 50E5.tmp 5004 5191.tmp 5128 524C.tmp 6092 5318.tmp 2928 53B4.tmp 2864 547F.tmp 1940 550C.tmp 4600 55D7.tmp 3288 5683.tmp 1312 573E.tmp 1292 57DA.tmp 3240 5877.tmp 1964 5913.tmp 4832 59AF.tmp 800 5A6B.tmp 4724 5AD8.tmp 2400 5B93.tmp 1536 5C4F.tmp 3428 5CEB.tmp 1060 5D97.tmp 1436 5E24.tmp 1648 5EC0.tmp 1104 5F4D.tmp 3728 5FF8.tmp 5708 6095.tmp 3088 6121.tmp 548 61BE.tmp 2664 625A.tmp 4804 62D7.tmp 1440 6344.tmp 3308 63B2.tmp 2916 644E.tmp 4480 64DA.tmp 4516 6557.tmp 5832 65C5.tmp 5156 6632.tmp 2852 66AF.tmp 4884 673C.tmp 1944 67A9.tmp 3228 6817.tmp 2780 6894.tmp 5756 6911.tmp 2548 69AD.tmp 1084 6A39.tmp 4836 6AB6.tmp 1200 6B43.tmp 3780 6BC0.tmp 4816 6C2D.tmp 4700 6CBA.tmp 4560 6D56.tmp 3524 6DD3.tmp 2244 6E50.tmp 5332 6EED.tmp 5552 6F79.tmp 952 6FE7.tmp 5056 7054.tmp 4848 70C1.tmp 5792 712F.tmp 3716 71AC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 159C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F51F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 550C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B56B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1188 1856 2026-07-18_27192022d33465e8d989bd0b487536fa_elex_mafia.exe 89 PID 1188 wrote to memory of 3824 1188 4BE4.tmp 90 PID 3824 wrote to memory of 4316 3824 4C90.tmp 91 PID 4316 wrote to memory of 3128 4316 4DA9.tmp 92 PID 3128 wrote to memory of 5296 3128 4F9D.tmp 93 PID 5296 wrote to memory of 4992 5296 5058.tmp 94 PID 4992 wrote to memory of 5004 4992 50E5.tmp 95 PID 5004 wrote to memory of 5128 5004 5191.tmp 96 PID 5128 wrote to memory of 6092 5128 524C.tmp 97 PID 6092 wrote to memory of 2928 6092 5318.tmp 98 PID 2928 wrote to memory of 2864 2928 53B4.tmp 99 PID 2864 wrote to memory of 1940 2864 547F.tmp 100 PID 1940 wrote to memory of 4600 1940 550C.tmp 101 PID 4600 wrote to memory of 3288 4600 55D7.tmp 102 PID 3288 wrote to memory of 1312 3288 5683.tmp 103 PID 1312 wrote to memory of 1292 1312 573E.tmp 104 PID 1292 wrote to memory of 3240 1292 57DA.tmp 105 PID 3240 wrote to memory of 1964 3240 5877.tmp 106 PID 1964 wrote to memory of 4832 1964 5913.tmp 107 PID 4832 wrote to memory of 800 4832 59AF.tmp 108 PID 800 wrote to memory of 4724 800 5A6B.tmp 109 PID 4724 wrote to memory of 2400 4724 5AD8.tmp 110 PID 2400 wrote to memory of 1536 2400 5B93.tmp 111 PID 1536 wrote to memory of 3428 1536 5C4F.tmp 112 PID 3428 wrote to memory of 1060 3428 5CEB.tmp 113 PID 1060 wrote to memory of 1436 1060 5D97.tmp 114 PID 1436 wrote to memory of 1648 1436 5E24.tmp 115 PID 1648 wrote to memory of 1104 1648 5EC0.tmp 116 PID 1104 wrote to memory of 3728 1104 5F4D.tmp 117 PID 3728 wrote to memory of 5708 3728 5FF8.tmp 118 PID 5708 wrote to memory of 3088 5708 6095.tmp 119 PID 3088 wrote to memory of 548 3088 6121.tmp 120 PID 548 wrote to memory of 2664 548 61BE.tmp 121 PID 2664 wrote to memory of 4804 2664 625A.tmp 122 PID 4804 wrote to memory of 1440 4804 62D7.tmp 123 PID 1440 wrote to memory of 3308 1440 6344.tmp 124 PID 3308 wrote to memory of 2916 3308 63B2.tmp 125 PID 2916 wrote to memory of 4480 2916 644E.tmp 126 PID 4480 wrote to memory of 4516 4480 64DA.tmp 127 PID 4516 wrote to memory of 5832 4516 6557.tmp 128 PID 5832 wrote to memory of 5156 5832 65C5.tmp 129 PID 5156 wrote to memory of 2852 5156 6632.tmp 130 PID 2852 wrote to memory of 4884 2852 66AF.tmp 131 PID 4884 wrote to memory of 1944 4884 673C.tmp 132 PID 1944 wrote to memory of 3228 1944 67A9.tmp 133 PID 3228 wrote to memory of 2780 3228 6817.tmp 134 PID 2780 wrote to memory of 5756 2780 6894.tmp 135 PID 5756 wrote to memory of 2548 5756 6911.tmp 136 PID 2548 wrote to memory of 1084 2548 69AD.tmp 137 PID 1084 wrote to memory of 4836 1084 6A39.tmp 138 PID 4836 wrote to memory of 1200 4836 6AB6.tmp 139 PID 1200 wrote to memory of 3780 1200 6B43.tmp 140 PID 3780 wrote to memory of 4816 3780 6BC0.tmp 141 PID 4816 wrote to memory of 4700 4816 6C2D.tmp 142 PID 4700 wrote to memory of 4560 4700 6CBA.tmp 143 PID 4560 wrote to memory of 3524 4560 6D56.tmp 144 PID 3524 wrote to memory of 2244 3524 6DD3.tmp 145 PID 2244 wrote to memory of 5332 2244 6E50.tmp 146 PID 5332 wrote to memory of 5552 5332 6EED.tmp 147 PID 5552 wrote to memory of 952 5552 6F79.tmp 148 PID 952 wrote to memory of 5056 952 6FE7.tmp 149 PID 5056 wrote to memory of 4848 5056 7054.tmp 150 PID 4848 wrote to memory of 5792 4848 70C1.tmp 151 PID 5792 wrote to memory of 3716 5792 712F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_27192022d33465e8d989bd0b487536fa_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_27192022d33465e8d989bd0b487536fa_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\50E5.tmp"C:\Users\Admin\AppData\Local\Temp\50E5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\524C.tmp"C:\Users\Admin\AppData\Local\Temp\524C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\5318.tmp"C:\Users\Admin\AppData\Local\Temp\5318.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\53B4.tmp"C:\Users\Admin\AppData\Local\Temp\53B4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\55D7.tmp"C:\Users\Admin\AppData\Local\Temp\55D7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5683.tmp"C:\Users\Admin\AppData\Local\Temp\5683.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5913.tmp"C:\Users\Admin\AppData\Local\Temp\5913.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\59AF.tmp"C:\Users\Admin\AppData\Local\Temp\59AF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\5AD8.tmp"C:\Users\Admin\AppData\Local\Temp\5AD8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\5EC0.tmp"C:\Users\Admin\AppData\Local\Temp\5EC0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5F4D.tmp"C:\Users\Admin\AppData\Local\Temp\5F4D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\6121.tmp"C:\Users\Admin\AppData\Local\Temp\6121.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\61BE.tmp"C:\Users\Admin\AppData\Local\Temp\61BE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\62D7.tmp"C:\Users\Admin\AppData\Local\Temp\62D7.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\6344.tmp"C:\Users\Admin\AppData\Local\Temp\6344.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\63B2.tmp"C:\Users\Admin\AppData\Local\Temp\63B2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\673C.tmp"C:\Users\Admin\AppData\Local\Temp\673C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6817.tmp"C:\Users\Admin\AppData\Local\Temp\6817.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6911.tmp"C:\Users\Admin\AppData\Local\Temp\6911.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6B43.tmp"C:\Users\Admin\AppData\Local\Temp\6B43.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6D56.tmp"C:\Users\Admin\AppData\Local\Temp\6D56.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\6E50.tmp"C:\Users\Admin\AppData\Local\Temp\6E50.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\6EED.tmp"C:\Users\Admin\AppData\Local\Temp\6EED.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\6F79.tmp"C:\Users\Admin\AppData\Local\Temp\6F79.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"65⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"66⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\72C5.tmp"C:\Users\Admin\AppData\Local\Temp\72C5.tmp"67⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\7371.tmp"C:\Users\Admin\AppData\Local\Temp\7371.tmp"68⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"70⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"71⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"72⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"73⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\766E.tmp"C:\Users\Admin\AppData\Local\Temp\766E.tmp"74⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"75⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\7788.tmp"C:\Users\Admin\AppData\Local\Temp\7788.tmp"76⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\7805.tmp"C:\Users\Admin\AppData\Local\Temp\7805.tmp"77⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"78⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"79⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"80⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\79D9.tmp"C:\Users\Admin\AppData\Local\Temp\79D9.tmp"81⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"82⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"83⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"84⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"85⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"86⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"89⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"90⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"91⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"92⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"93⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"94⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\80EE.tmp"C:\Users\Admin\AppData\Local\Temp\80EE.tmp"95⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"96⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\8207.tmp"C:\Users\Admin\AppData\Local\Temp\8207.tmp"97⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\8275.tmp"C:\Users\Admin\AppData\Local\Temp\8275.tmp"98⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"100⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"101⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\8488.tmp"C:\Users\Admin\AppData\Local\Temp\8488.tmp"102⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"103⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"104⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\85FF.tmp"C:\Users\Admin\AppData\Local\Temp\85FF.tmp"105⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"106⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"107⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"108⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"109⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"110⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"111⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"112⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"113⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8A25.tmp"C:\Users\Admin\AppData\Local\Temp\8A25.tmp"114⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"115⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"116⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"117⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"118⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"119⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"120⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"121⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"122⤵PID:1568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-