Analysis
- max time kernel
128s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 12:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_30487f70241cd3097484bf0288eb390f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_30487f70241cd3097484bf0288eb390f_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_30487f70241cd3097484bf0288eb390f_elex_mafia.exe
- Size 561KB
- Sample260810-ph23laga33
- SHA256 4635d171c0074a65dd1ce9aa6d9471b7a98583a394b585904caa3a4be03a67cd
- MD5 30487f70241cd3097484bf0288eb390f
- SHA1 2361dfda39453ccf014932e9d95132c864ab12b0
- SHA512 df33391bf30ec83ffd07943c3615a84cdfada1cf3efe9be1488e2b5a2423c5f9c75ab949cbb0480629546ec46284b56b2eaffc0e3d848bad705874f91a6a24ba
- SSDEEP 12288:VuelPWET0yhXK8NU28qMd87FbiAiNvF1GDZuL:8eEEvhxcCRWNvFEDoL
- TLSH T18DC4DF11B2C8C835F1F31A344AF59B610D7BBC619B35E8CB2B84562E5EB02D1EA79713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5220 5412.tmp 4928 5579.tmp 4724 55F6.tmp 2404 5692.tmp 432 573E.tmp 6700 5828.tmp 6188 5913.tmp 1640 59BF.tmp 4136 5A99.tmp 4304 5B26.tmp 1208 5BA3.tmp 2628 5C6E.tmp 6452 5D2A.tmp 244 5DC6.tmp 936 5E72.tmp 4520 5F1E.tmp 6604 6027.tmp 4684 60B4.tmp 2068 616F.tmp 7152 620C.tmp 2440 62A8.tmp 760 6392.tmp 3712 642F.tmp 6080 64BB.tmp 3696 6557.tmp 3104 6613.tmp 6408 66BF.tmp 4180 674B.tmp 3656 67D8.tmp 5144 6884.tmp 5172 697E.tmp 3648 6A68.tmp 2776 6B14.tmp 3536 6B91.tmp 2348 6C0E.tmp 4828 6C9B.tmp 5032 6D18.tmp 5732 6D95.tmp 4884 6E21.tmp 6696 6E9E.tmp 988 6F2B.tmp 1940 6FB8.tmp 3816 7025.tmp 6656 7092.tmp 7100 711F.tmp 6308 718C.tmp 2124 7209.tmp 7112 7277.tmp 1504 7313.tmp 5892 73A0.tmp 1708 741D.tmp 360 749A.tmp 2596 7526.tmp 3000 75A3.tmp 8 7640.tmp 2016 76EB.tmp 3976 7778.tmp 4488 7814.tmp 5584 78C0.tmp 2252 794D.tmp 4632 79F9.tmp 6268 7A95.tmp 792 7B31.tmp 1684 7BAE.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 203B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E18C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2636.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D41A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E66A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F03D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 498D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8781.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 5220 2032 2026-08-10_30487f70241cd3097484bf0288eb390f_elex_mafia.exe 91 PID 5220 wrote to memory of 4928 5220 5412.tmp 92 PID 4928 wrote to memory of 4724 4928 5579.tmp 93 PID 4724 wrote to memory of 2404 4724 55F6.tmp 94 PID 2404 wrote to memory of 432 2404 5692.tmp 95 PID 432 wrote to memory of 6700 432 573E.tmp 96 PID 6700 wrote to memory of 6188 6700 5828.tmp 97 PID 6188 wrote to memory of 1640 6188 5913.tmp 98 PID 1640 wrote to memory of 4136 1640 59BF.tmp 99 PID 4136 wrote to memory of 4304 4136 5A99.tmp 100 PID 4304 wrote to memory of 1208 4304 5B26.tmp 101 PID 1208 wrote to memory of 2628 1208 5BA3.tmp 102 PID 2628 wrote to memory of 6452 2628 5C6E.tmp 103 PID 6452 wrote to memory of 244 6452 5D2A.tmp 104 PID 244 wrote to memory of 936 244 5DC6.tmp 105 PID 936 wrote to memory of 4520 936 5E72.tmp 106 PID 4520 wrote to memory of 6604 4520 5F1E.tmp 107 PID 6604 wrote to memory of 4684 6604 6027.tmp 108 PID 4684 wrote to memory of 2068 4684 60B4.tmp 109 PID 2068 wrote to memory of 7152 2068 616F.tmp 110 PID 7152 wrote to memory of 2440 7152 620C.tmp 111 PID 2440 wrote to memory of 760 2440 62A8.tmp 112 PID 760 wrote to memory of 3712 760 6392.tmp 113 PID 3712 wrote to memory of 6080 3712 642F.tmp 114 PID 6080 wrote to memory of 3696 6080 64BB.tmp 115 PID 3696 wrote to memory of 3104 3696 6557.tmp 116 PID 3104 wrote to memory of 6408 3104 6613.tmp 117 PID 6408 wrote to memory of 4180 6408 66BF.tmp 118 PID 4180 wrote to memory of 3656 4180 674B.tmp 119 PID 3656 wrote to memory of 5144 3656 67D8.tmp 120 PID 5144 wrote to memory of 5172 5144 6884.tmp 121 PID 5172 wrote to memory of 3648 5172 697E.tmp 122 PID 3648 wrote to memory of 2776 3648 6A68.tmp 123 PID 2776 wrote to memory of 3536 2776 6B14.tmp 124 PID 3536 wrote to memory of 2348 3536 6B91.tmp 125 PID 2348 wrote to memory of 4828 2348 6C0E.tmp 126 PID 4828 wrote to memory of 5032 4828 6C9B.tmp 127 PID 5032 wrote to memory of 5732 5032 6D18.tmp 128 PID 5732 wrote to memory of 4884 5732 6D95.tmp 129 PID 4884 wrote to memory of 6696 4884 6E21.tmp 130 PID 6696 wrote to memory of 988 6696 6E9E.tmp 131 PID 988 wrote to memory of 1940 988 6F2B.tmp 132 PID 1940 wrote to memory of 3816 1940 6FB8.tmp 133 PID 3816 wrote to memory of 6656 3816 7025.tmp 134 PID 6656 wrote to memory of 7100 6656 7092.tmp 135 PID 7100 wrote to memory of 6308 7100 711F.tmp 136 PID 6308 wrote to memory of 2124 6308 718C.tmp 137 PID 2124 wrote to memory of 7112 2124 7209.tmp 138 PID 7112 wrote to memory of 1504 7112 7277.tmp 139 PID 1504 wrote to memory of 5892 1504 7313.tmp 140 PID 5892 wrote to memory of 1708 5892 73A0.tmp 141 PID 1708 wrote to memory of 360 1708 741D.tmp 142 PID 360 wrote to memory of 2596 360 749A.tmp 143 PID 2596 wrote to memory of 3000 2596 7526.tmp 144 PID 3000 wrote to memory of 8 3000 75A3.tmp 145 PID 8 wrote to memory of 2016 8 7640.tmp 146 PID 2016 wrote to memory of 3976 2016 76EB.tmp 147 PID 3976 wrote to memory of 4488 3976 7778.tmp 148 PID 4488 wrote to memory of 5584 4488 7814.tmp 149 PID 5584 wrote to memory of 2252 5584 78C0.tmp 150 PID 2252 wrote to memory of 4632 2252 794D.tmp 151 PID 4632 wrote to memory of 6268 4632 79F9.tmp 152 PID 6268 wrote to memory of 792 6268 7A95.tmp 153 PID 792 wrote to memory of 1684 792 7B31.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_30487f70241cd3097484bf0288eb390f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_30487f70241cd3097484bf0288eb390f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5412.tmp"C:\Users\Admin\AppData\Local\Temp\5412.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\5579.tmp"C:\Users\Admin\AppData\Local\Temp\5579.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\55F6.tmp"C:\Users\Admin\AppData\Local\Temp\55F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\5828.tmp"C:\Users\Admin\AppData\Local\Temp\5828.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6700 -
C:\Users\Admin\AppData\Local\Temp\5913.tmp"C:\Users\Admin\AppData\Local\Temp\5913.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6188 -
C:\Users\Admin\AppData\Local\Temp\59BF.tmp"C:\Users\Admin\AppData\Local\Temp\59BF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6452 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\5E72.tmp"C:\Users\Admin\AppData\Local\Temp\5E72.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6604 -
C:\Users\Admin\AppData\Local\Temp\60B4.tmp"C:\Users\Admin\AppData\Local\Temp\60B4.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\620C.tmp"C:\Users\Admin\AppData\Local\Temp\620C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7152 -
C:\Users\Admin\AppData\Local\Temp\62A8.tmp"C:\Users\Admin\AppData\Local\Temp\62A8.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\64BB.tmp"C:\Users\Admin\AppData\Local\Temp\64BB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6408 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\67D8.tmp"C:\Users\Admin\AppData\Local\Temp\67D8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\6884.tmp"C:\Users\Admin\AppData\Local\Temp\6884.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\6A68.tmp"C:\Users\Admin\AppData\Local\Temp\6A68.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\6D18.tmp"C:\Users\Admin\AppData\Local\Temp\6D18.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\6D95.tmp"C:\Users\Admin\AppData\Local\Temp\6D95.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\6E21.tmp"C:\Users\Admin\AppData\Local\Temp\6E21.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6696 -
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6656 -
C:\Users\Admin\AppData\Local\Temp\711F.tmp"C:\Users\Admin\AppData\Local\Temp\711F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7100 -
C:\Users\Admin\AppData\Local\Temp\718C.tmp"C:\Users\Admin\AppData\Local\Temp\718C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6308 -
C:\Users\Admin\AppData\Local\Temp\7209.tmp"C:\Users\Admin\AppData\Local\Temp\7209.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7112 -
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\75A3.tmp"C:\Users\Admin\AppData\Local\Temp\75A3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\76EB.tmp"C:\Users\Admin\AppData\Local\Temp\76EB.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\7814.tmp"C:\Users\Admin\AppData\Local\Temp\7814.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\794D.tmp"C:\Users\Admin\AppData\Local\Temp\794D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7A95.tmp"C:\Users\Admin\AppData\Local\Temp\7A95.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6268 -
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"65⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"66⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"67⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:7128 -
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"69⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"70⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"71⤵PID:7084
-
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"72⤵PID:6856
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"73⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"74⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\8052.tmp"C:\Users\Admin\AppData\Local\Temp\8052.tmp"75⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\80CF.tmp"C:\Users\Admin\AppData\Local\Temp\80CF.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"77⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"78⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:6552 -
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"80⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"81⤵PID:6768
-
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"82⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"83⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\8505.tmp"C:\Users\Admin\AppData\Local\Temp\8505.tmp"84⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"85⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"86⤵PID:6960
-
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"88⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"89⤵PID:6556
-
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"90⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"91⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\896A.tmp"C:\Users\Admin\AppData\Local\Temp\896A.tmp"92⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"93⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\8A64.tmp"C:\Users\Admin\AppData\Local\Temp\8A64.tmp"94⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"95⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"96⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"97⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"98⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"99⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"100⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"101⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"102⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\8ED8.tmp"C:\Users\Admin\AppData\Local\Temp\8ED8.tmp"103⤵PID:6448
-
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"104⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"105⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\90CC.tmp"C:\Users\Admin\AppData\Local\Temp\90CC.tmp"107⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"108⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"109⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"110⤵PID:6760
-
C:\Users\Admin\AppData\Local\Temp\92C0.tmp"C:\Users\Admin\AppData\Local\Temp\92C0.tmp"111⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"112⤵PID:6632
-
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"113⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\9428.tmp"C:\Users\Admin\AppData\Local\Temp\9428.tmp"114⤵PID:7140
-
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"115⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"116⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"117⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:248 -
C:\Users\Admin\AppData\Local\Temp\9699.tmp"C:\Users\Admin\AppData\Local\Temp\9699.tmp"119⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"120⤵PID:6396
-
C:\Users\Admin\AppData\Local\Temp\97A2.tmp"C:\Users\Admin\AppData\Local\Temp\97A2.tmp"121⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\9800.tmp"C:\Users\Admin\AppData\Local\Temp\9800.tmp"122⤵PID:3772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-