Analysis
- max time kernel
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_da00d3f60891e9c0c1c2c02194613bb8_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_da00d3f60891e9c0c1c2c02194613bb8_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_da00d3f60891e9c0c1c2c02194613bb8_elex_mafia.exe
- Size 518KB
- Sample261023-v9flkadc82
- SHA256 476cc39550241b4850e98116e62499a8919ed8795c85aa94ea7b4b16e34ac142
- MD5 da00d3f60891e9c0c1c2c02194613bb8
- SHA1 bcd9ef8a5e7f535db9a46550bbcbe18fddf87dad
- SHA512 1c348be45f01afb4a699e181dc8e6c10589fa8d8e09686937e9e31840fe1f9a409b4b48602c1d3c30ce3f897b9d8ebba9cb8fc34352808cd3160f16457f841b0
- SSDEEP 12288:anTpha1Jvu4nHl03k5nIddXXlvtNS8XlwMNZ:any1E4HFpIdNlvt9lhN
- TLSH T1A7B4F121B945C032F5D200394B69EB61583E7D719B2AA4C77BD4327E6FB62C0E6B530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2560 53E3.tmp 3584 54BD.tmp 5036 554A.tmp 2416 55F6.tmp 4400 5683.tmp 1700 570F.tmp 5624 57BB.tmp 1616 5838.tmp 1332 5903.tmp 2532 5971.tmp 3940 5A2C.tmp 5796 5B26.tmp 4100 5C20.tmp 1120 5CAD.tmp 4084 5D39.tmp 4808 5DC6.tmp 4952 5E81.tmp 5664 5F1E.tmp 4996 6008.tmp 4708 6095.tmp 4936 6141.tmp 5852 61CD.tmp 2860 625A.tmp 2996 62F6.tmp 3136 63A2.tmp 1280 645D.tmp 5660 6529.tmp 4304 65E4.tmp 1500 6642.tmp 2656 66CE.tmp 2312 674B.tmp 2524 6817.tmp 4652 68C2.tmp 1040 693F.tmp 3452 69CC.tmp 2108 6A49.tmp 2764 6AB6.tmp 5996 6B33.tmp 3008 6BC0.tmp 5840 6C3D.tmp 5872 6CAA.tmp 5732 6D27.tmp 3656 6D85.tmp 2412 6DF3.tmp 4968 6E70.tmp 3184 6EDD.tmp 5844 6F4A.tmp 4276 6FD7.tmp 6120 7054.tmp 4680 70D1.tmp 4132 714E.tmp 1416 71BB.tmp 5596 7238.tmp 1656 72A6.tmp 4696 7323.tmp 6108 73A0.tmp 4456 740D.tmp 2204 748A.tmp 4676 74F7.tmp 4656 7565.tmp 5500 75F1.tmp 3484 766E.tmp 4800 76DC.tmp 2128 7749.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 674B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6817.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 2560 4844 2026-10-22_da00d3f60891e9c0c1c2c02194613bb8_elex_mafia.exe 89 PID 2560 wrote to memory of 3584 2560 53E3.tmp 90 PID 3584 wrote to memory of 5036 3584 54BD.tmp 91 PID 5036 wrote to memory of 2416 5036 554A.tmp 92 PID 2416 wrote to memory of 4400 2416 55F6.tmp 93 PID 4400 wrote to memory of 1700 4400 5683.tmp 94 PID 1700 wrote to memory of 5624 1700 570F.tmp 95 PID 5624 wrote to memory of 1616 5624 57BB.tmp 96 PID 1616 wrote to memory of 1332 1616 5838.tmp 97 PID 1332 wrote to memory of 2532 1332 5903.tmp 98 PID 2532 wrote to memory of 3940 2532 5971.tmp 99 PID 3940 wrote to memory of 5796 3940 5A2C.tmp 100 PID 5796 wrote to memory of 4100 5796 5B26.tmp 101 PID 4100 wrote to memory of 1120 4100 5C20.tmp 102 PID 1120 wrote to memory of 4084 1120 5CAD.tmp 103 PID 4084 wrote to memory of 4808 4084 5D39.tmp 104 PID 4808 wrote to memory of 4952 4808 5DC6.tmp 105 PID 4952 wrote to memory of 5664 4952 5E81.tmp 106 PID 5664 wrote to memory of 4996 5664 5F1E.tmp 107 PID 4996 wrote to memory of 4708 4996 6008.tmp 108 PID 4708 wrote to memory of 4936 4708 6095.tmp 109 PID 4936 wrote to memory of 5852 4936 6141.tmp 110 PID 5852 wrote to memory of 2860 5852 61CD.tmp 111 PID 2860 wrote to memory of 2996 2860 625A.tmp 112 PID 2996 wrote to memory of 3136 2996 62F6.tmp 113 PID 3136 wrote to memory of 1280 3136 63A2.tmp 114 PID 1280 wrote to memory of 5660 1280 645D.tmp 115 PID 5660 wrote to memory of 4304 5660 6529.tmp 116 PID 4304 wrote to memory of 1500 4304 65E4.tmp 117 PID 1500 wrote to memory of 2656 1500 6642.tmp 118 PID 2656 wrote to memory of 2312 2656 66CE.tmp 119 PID 2312 wrote to memory of 2524 2312 674B.tmp 120 PID 2524 wrote to memory of 4652 2524 6817.tmp 121 PID 4652 wrote to memory of 1040 4652 68C2.tmp 122 PID 1040 wrote to memory of 3452 1040 693F.tmp 123 PID 3452 wrote to memory of 2108 3452 69CC.tmp 124 PID 2108 wrote to memory of 2764 2108 6A49.tmp 125 PID 2764 wrote to memory of 5996 2764 6AB6.tmp 126 PID 5996 wrote to memory of 3008 5996 6B33.tmp 127 PID 3008 wrote to memory of 5840 3008 6BC0.tmp 128 PID 5840 wrote to memory of 5872 5840 6C3D.tmp 129 PID 5872 wrote to memory of 5732 5872 6CAA.tmp 130 PID 5732 wrote to memory of 3656 5732 6D27.tmp 131 PID 3656 wrote to memory of 2412 3656 6D85.tmp 132 PID 2412 wrote to memory of 4968 2412 6DF3.tmp 133 PID 4968 wrote to memory of 3184 4968 6E70.tmp 134 PID 3184 wrote to memory of 5844 3184 6EDD.tmp 135 PID 5844 wrote to memory of 4276 5844 6F4A.tmp 136 PID 4276 wrote to memory of 6120 4276 6FD7.tmp 137 PID 6120 wrote to memory of 4680 6120 7054.tmp 138 PID 4680 wrote to memory of 4132 4680 70D1.tmp 139 PID 4132 wrote to memory of 1416 4132 714E.tmp 140 PID 1416 wrote to memory of 5596 1416 71BB.tmp 141 PID 5596 wrote to memory of 1656 5596 7238.tmp 142 PID 1656 wrote to memory of 4696 1656 72A6.tmp 143 PID 4696 wrote to memory of 6108 4696 7323.tmp 144 PID 6108 wrote to memory of 4456 6108 73A0.tmp 145 PID 4456 wrote to memory of 2204 4456 740D.tmp 146 PID 2204 wrote to memory of 4676 2204 748A.tmp 147 PID 4676 wrote to memory of 4656 4676 74F7.tmp 148 PID 4656 wrote to memory of 5500 4656 7565.tmp 149 PID 5500 wrote to memory of 3484 5500 75F1.tmp 150 PID 3484 wrote to memory of 4800 3484 766E.tmp 151 PID 4800 wrote to memory of 2128 4800 76DC.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_da00d3f60891e9c0c1c2c02194613bb8_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_da00d3f60891e9c0c1c2c02194613bb8_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\53E3.tmp"C:\Users\Admin\AppData\Local\Temp\53E3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\54BD.tmp"C:\Users\Admin\AppData\Local\Temp\54BD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\55F6.tmp"C:\Users\Admin\AppData\Local\Temp\55F6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\5683.tmp"C:\Users\Admin\AppData\Local\Temp\5683.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\5838.tmp"C:\Users\Admin\AppData\Local\Temp\5838.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5903.tmp"C:\Users\Admin\AppData\Local\Temp\5903.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5A2C.tmp"C:\Users\Admin\AppData\Local\Temp\5A2C.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\5C20.tmp"C:\Users\Admin\AppData\Local\Temp\5C20.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\5D39.tmp"C:\Users\Admin\AppData\Local\Temp\5D39.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5E81.tmp"C:\Users\Admin\AppData\Local\Temp\5E81.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\61CD.tmp"C:\Users\Admin\AppData\Local\Temp\61CD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\62F6.tmp"C:\Users\Admin\AppData\Local\Temp\62F6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\63A2.tmp"C:\Users\Admin\AppData\Local\Temp\63A2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\645D.tmp"C:\Users\Admin\AppData\Local\Temp\645D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6817.tmp"C:\Users\Admin\AppData\Local\Temp\6817.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\68C2.tmp"C:\Users\Admin\AppData\Local\Temp\68C2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\69CC.tmp"C:\Users\Admin\AppData\Local\Temp\69CC.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\6D85.tmp"C:\Users\Admin\AppData\Local\Temp\6D85.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\714E.tmp"C:\Users\Admin\AppData\Local\Temp\714E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\71BB.tmp"C:\Users\Admin\AppData\Local\Temp\71BB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7323.tmp"C:\Users\Admin\AppData\Local\Temp\7323.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\740D.tmp"C:\Users\Admin\AppData\Local\Temp\740D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\766E.tmp"C:\Users\Admin\AppData\Local\Temp\766E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\76DC.tmp"C:\Users\Admin\AppData\Local\Temp\76DC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"65⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\77B7.tmp"C:\Users\Admin\AppData\Local\Temp\77B7.tmp"66⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7824.tmp"C:\Users\Admin\AppData\Local\Temp\7824.tmp"67⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\78B1.tmp"C:\Users\Admin\AppData\Local\Temp\78B1.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\792E.tmp"C:\Users\Admin\AppData\Local\Temp\792E.tmp"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"70⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"71⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"72⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"73⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"74⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"75⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"76⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"77⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"78⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"79⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"80⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"81⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"82⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"83⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"84⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\8052.tmp"C:\Users\Admin\AppData\Local\Temp\8052.tmp"85⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"86⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\812C.tmp"C:\Users\Admin\AppData\Local\Temp\812C.tmp"87⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\8294.tmp"C:\Users\Admin\AppData\Local\Temp\8294.tmp"90⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"91⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\837E.tmp"C:\Users\Admin\AppData\Local\Temp\837E.tmp"92⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\83FB.tmp"C:\Users\Admin\AppData\Local\Temp\83FB.tmp"93⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"94⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"95⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"96⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"97⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"98⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"99⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\8795.tmp"C:\Users\Admin\AppData\Local\Temp\8795.tmp"100⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"101⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\887F.tmp"C:\Users\Admin\AppData\Local\Temp\887F.tmp"102⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"104⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"105⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"107⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"108⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"109⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"111⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\8D04.tmp"C:\Users\Admin\AppData\Local\Temp\8D04.tmp"112⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"113⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"114⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"115⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"116⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"117⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"118⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"119⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"120⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"121⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"122⤵PID:708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-