Analysis
- max time kernel
130s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_7ff32e413107ab060f389372f8437e1c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_7ff32e413107ab060f389372f8437e1c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_7ff32e413107ab060f389372f8437e1c_elex_mafia.exe
- Size 520KB
- Sample260718-dpkakset8p
- SHA256 f80865d9619cef7c7ae848431c1e15336cab7e56d27124aa23a207ca668267f2
- MD5 7ff32e413107ab060f389372f8437e1c
- SHA1 272371a5d02e70b978877d7afaf0de5b1c8b6cc5
- SHA512 47d19fa154ded47debfc55f2b029947f2ef7d010dabf5a2ed228dabaadad39ff73af68f86d15ba2af66f91697b29ee0779c9bc91ca59b21084898d51df25aec3
- SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbtQnslFUAwbhe43gLbxi955JvxxBYhE0L6:gj8fuxR21t5i8fZJcjLbxiHdYN/h+NZ
- TLSH T15AB4F0167945C433E9E206304B65DB620BBE7D659B2692C73BC036BDAEB42C1D77830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 692 6EED.tmp 2608 6FC7.tmp 2044 7092.tmp 5468 715E.tmp 4708 7219.tmp 5076 72A6.tmp 2244 7332.tmp 5252 73EE.tmp 2528 748A.tmp 364 7584.tmp 248 767E.tmp 1096 770B.tmp 1396 77E5.tmp 1796 7862.tmp 4416 790E.tmp 1076 79AB.tmp 5560 7A47.tmp 5388 7B02.tmp 5496 7B8F.tmp 3692 7C5A.tmp 5984 7CE7.tmp 1172 7DD1.tmp 5472 7E7D.tmp 2360 7F48.tmp 296 7FF4.tmp 3484 8090.tmp 5876 813C.tmp 5828 81C9.tmp 6084 8284.tmp 1412 8311.tmp 1740 83EC.tmp 1360 84A7.tmp 3324 8534.tmp 3652 85B1.tmp 4704 860E.tmp 2732 868B.tmp 3608 8718.tmp 4144 87B4.tmp 6028 8831.tmp 3856 88DD.tmp 5500 894B.tmp 552 89D7.tmp 3372 8A54.tmp 4112 8AC2.tmp 5640 8B3F.tmp 1392 8BCB.tmp 5192 8C77.tmp 2776 8CF4.tmp 5352 8D61.tmp 5740 8DDE.tmp 1196 8E4C.tmp 5564 8EB9.tmp 3784 8F36.tmp 2432 8FC3.tmp 4880 9040.tmp 3448 90CC.tmp 1504 9149.tmp 4820 91B7.tmp 2484 9224.tmp 1688 92B1.tmp 1240 931E.tmp 3172 939B.tmp 5400 9418.tmp 5300 9486.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 252D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E42C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B21B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 894B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 951D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A34B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 152A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D92B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 392D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6444.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 156E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6042.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 692 3632 2026-07-17_7ff32e413107ab060f389372f8437e1c_elex_mafia.exe 89 PID 692 wrote to memory of 2608 692 6EED.tmp 90 PID 2608 wrote to memory of 2044 2608 6FC7.tmp 91 PID 2044 wrote to memory of 5468 2044 7092.tmp 92 PID 5468 wrote to memory of 4708 5468 715E.tmp 93 PID 4708 wrote to memory of 5076 4708 7219.tmp 94 PID 5076 wrote to memory of 2244 5076 72A6.tmp 95 PID 2244 wrote to memory of 5252 2244 7332.tmp 96 PID 5252 wrote to memory of 2528 5252 73EE.tmp 97 PID 2528 wrote to memory of 364 2528 748A.tmp 98 PID 364 wrote to memory of 248 364 7584.tmp 99 PID 248 wrote to memory of 1096 248 767E.tmp 100 PID 1096 wrote to memory of 1396 1096 770B.tmp 101 PID 1396 wrote to memory of 1796 1396 77E5.tmp 102 PID 1796 wrote to memory of 4416 1796 7862.tmp 103 PID 4416 wrote to memory of 1076 4416 790E.tmp 104 PID 1076 wrote to memory of 5560 1076 79AB.tmp 105 PID 5560 wrote to memory of 5388 5560 7A47.tmp 106 PID 5388 wrote to memory of 5496 5388 7B02.tmp 107 PID 5496 wrote to memory of 3692 5496 7B8F.tmp 108 PID 3692 wrote to memory of 5984 3692 7C5A.tmp 109 PID 5984 wrote to memory of 1172 5984 7CE7.tmp 110 PID 1172 wrote to memory of 5472 1172 7DD1.tmp 111 PID 5472 wrote to memory of 2360 5472 7E7D.tmp 112 PID 2360 wrote to memory of 296 2360 7F48.tmp 113 PID 296 wrote to memory of 3484 296 7FF4.tmp 114 PID 3484 wrote to memory of 5876 3484 8090.tmp 115 PID 5876 wrote to memory of 5828 5876 813C.tmp 116 PID 5828 wrote to memory of 6084 5828 81C9.tmp 117 PID 6084 wrote to memory of 1412 6084 8284.tmp 118 PID 1412 wrote to memory of 1740 1412 8311.tmp 119 PID 1740 wrote to memory of 1360 1740 83EC.tmp 120 PID 1360 wrote to memory of 3324 1360 84A7.tmp 121 PID 3324 wrote to memory of 3652 3324 8534.tmp 122 PID 3652 wrote to memory of 4704 3652 85B1.tmp 123 PID 4704 wrote to memory of 2732 4704 860E.tmp 124 PID 2732 wrote to memory of 3608 2732 868B.tmp 125 PID 3608 wrote to memory of 4144 3608 8718.tmp 126 PID 4144 wrote to memory of 6028 4144 87B4.tmp 127 PID 6028 wrote to memory of 3856 6028 8831.tmp 128 PID 3856 wrote to memory of 5500 3856 88DD.tmp 129 PID 5500 wrote to memory of 552 5500 894B.tmp 130 PID 552 wrote to memory of 3372 552 89D7.tmp 131 PID 3372 wrote to memory of 4112 3372 8A54.tmp 132 PID 4112 wrote to memory of 5640 4112 8AC2.tmp 133 PID 5640 wrote to memory of 1392 5640 8B3F.tmp 134 PID 1392 wrote to memory of 5192 1392 8BCB.tmp 135 PID 5192 wrote to memory of 2776 5192 8C77.tmp 136 PID 2776 wrote to memory of 5352 2776 8CF4.tmp 137 PID 5352 wrote to memory of 5740 5352 8D61.tmp 138 PID 5740 wrote to memory of 1196 5740 8DDE.tmp 139 PID 1196 wrote to memory of 5564 1196 8E4C.tmp 140 PID 5564 wrote to memory of 3784 5564 8EB9.tmp 141 PID 3784 wrote to memory of 2432 3784 8F36.tmp 142 PID 2432 wrote to memory of 4880 2432 8FC3.tmp 143 PID 4880 wrote to memory of 3448 4880 9040.tmp 144 PID 3448 wrote to memory of 1504 3448 90CC.tmp 145 PID 1504 wrote to memory of 4820 1504 9149.tmp 146 PID 4820 wrote to memory of 2484 4820 91B7.tmp 147 PID 2484 wrote to memory of 1688 2484 9224.tmp 148 PID 1688 wrote to memory of 1240 1688 92B1.tmp 149 PID 1240 wrote to memory of 3172 1240 931E.tmp 150 PID 3172 wrote to memory of 5400 3172 939B.tmp 151 PID 5400 wrote to memory of 5300 5400 9418.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_7ff32e413107ab060f389372f8437e1c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_7ff32e413107ab060f389372f8437e1c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\6EED.tmp"C:\Users\Admin\AppData\Local\Temp\6EED.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\715E.tmp"C:\Users\Admin\AppData\Local\Temp\715E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\7332.tmp"C:\Users\Admin\AppData\Local\Temp\7332.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7584.tmp"C:\Users\Admin\AppData\Local\Temp\7584.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\767E.tmp"C:\Users\Admin\AppData\Local\Temp\767E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\770B.tmp"C:\Users\Admin\AppData\Local\Temp\770B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\7862.tmp"C:\Users\Admin\AppData\Local\Temp\7862.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\7A47.tmp"C:\Users\Admin\AppData\Local\Temp\7A47.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\7B02.tmp"C:\Users\Admin\AppData\Local\Temp\7B02.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\7C5A.tmp"C:\Users\Admin\AppData\Local\Temp\7C5A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\7F48.tmp"C:\Users\Admin\AppData\Local\Temp\7F48.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\81C9.tmp"C:\Users\Admin\AppData\Local\Temp\81C9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\8284.tmp"C:\Users\Admin\AppData\Local\Temp\8284.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\860E.tmp"C:\Users\Admin\AppData\Local\Temp\860E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\87B4.tmp"C:\Users\Admin\AppData\Local\Temp\87B4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\88DD.tmp"C:\Users\Admin\AppData\Local\Temp\88DD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\90CC.tmp"C:\Users\Admin\AppData\Local\Temp\90CC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9149.tmp"C:\Users\Admin\AppData\Local\Temp\9149.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\9486.tmp"C:\Users\Admin\AppData\Local\Temp\9486.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\9503.tmp"C:\Users\Admin\AppData\Local\Temp\9503.tmp"66⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\958F.tmp"C:\Users\Admin\AppData\Local\Temp\958F.tmp"67⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\961C.tmp"C:\Users\Admin\AppData\Local\Temp\961C.tmp"68⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"69⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\9735.tmp"C:\Users\Admin\AppData\Local\Temp\9735.tmp"70⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\97B2.tmp"C:\Users\Admin\AppData\Local\Temp\97B2.tmp"71⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"72⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"73⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"74⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\99C5.tmp"C:\Users\Admin\AppData\Local\Temp\99C5.tmp"75⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"76⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"78⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"79⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"80⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"82⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"83⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"84⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"C:\Users\Admin\AppData\Local\Temp\9EC7.tmp"85⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"86⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"87⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"88⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"89⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"90⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"91⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"92⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"93⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\A34B.tmp"C:\Users\Admin\AppData\Local\Temp\A34B.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"95⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"96⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"97⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"98⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"99⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\A658.tmp"C:\Users\Admin\AppData\Local\Temp\A658.tmp"100⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"101⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"102⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"103⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A83C.tmp"C:\Users\Admin\AppData\Local\Temp\A83C.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"105⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"106⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"107⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\AA40.tmp"C:\Users\Admin\AppData\Local\Temp\AA40.tmp"108⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"109⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"110⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"111⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\AC63.tmp"C:\Users\Admin\AppData\Local\Temp\AC63.tmp"112⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"113⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"114⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"115⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"116⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"117⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"118⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"119⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\B01C.tmp"C:\Users\Admin\AppData\Local\Temp\B01C.tmp"120⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\B099.tmp"C:\Users\Admin\AppData\Local\Temp\B099.tmp"121⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"122⤵PID:3716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-