Analysis
- max time kernel
134s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-10_0e006e5a909e8ad3f144be97a519e6fb_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_0e006e5a909e8ad3f144be97a519e6fb_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-10_0e006e5a909e8ad3f144be97a519e6fb_elex_mafia.exe
- Size 816KB
- Sample261110-ltxepsed56
- SHA256 50cc07792e9a88ee89777028b2a01beff0b77ef60d0c3b2bbdaa2ebe85ccf52e
- MD5 0e006e5a909e8ad3f144be97a519e6fb
- SHA1 66d9e08e1e8ae9fb44dfc113e565125125eab656
- SHA512 f998e44a09be2edace83f807665df7aacb04fac24a32a4fde4d134ed9ad58616d543340bed915567b07c2d1ce29c4d19cc02870225ebbecb81e02e924c3f2db9
- SSDEEP 12288:wBpZmrt1+9prqRXGSwrVwVFRxPgVGu3Z:wBKrS95//aVFRxPPu3
- TLSH T14105E1217689C432E6D201344A26DB52197ABC295B29B4C73FE43A7E7FB92C1D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2408 61E8.tmp 2968 62B3.tmp 5072 639D.tmp 4820 6488.tmp 4856 6524.tmp 5780 661E.tmp 3716 6AA2.tmp 2592 6B7D.tmp 5668 6C58.tmp 3096 6D23.tmp 4084 6DDE.tmp 5452 6EB9.tmp 4452 6F94.tmp 4476 705F.tmp 4680 7168.tmp 3356 7224.tmp 1904 72FF.tmp 4556 73CA.tmp 760 7485.tmp 5300 7522.tmp 3616 75FC.tmp 812 76F6.tmp 668 77F0.tmp 2596 78CB.tmp 3020 7987.tmp 4568 7A52.tmp 3776 7B7B.tmp 4684 7C46.tmp 360 7D20.tmp 1740 7DDC.tmp 4656 7E88.tmp 3704 7F53.tmp 2148 801E.tmp 4804 80DA.tmp 3628 8185.tmp 3252 8222.tmp 1864 829F.tmp 3844 833B.tmp 1520 8399.tmp 1764 8435.tmp 1644 84D1.tmp 5736 856D.tmp 1284 85EA.tmp 5804 8677.tmp 2176 8713.tmp 1812 87A0.tmp 1324 883C.tmp 3636 88C9.tmp 5888 8955.tmp 1116 89D2.tmp 4060 8A6F.tmp 4404 8AFB.tmp 4552 8B88.tmp 1820 8C34.tmp 1760 8CB1.tmp 3436 8D4D.tmp 4072 8DCA.tmp 6104 8E66.tmp 1800 8EF3.tmp 5580 8F70.tmp 4232 8FED.tmp 3452 9099.tmp 2412 9116.tmp 1084 91C2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5427.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 508D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D926.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A70F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D80D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5309.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4657.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4703.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 649D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B32F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F549.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5968 wrote to memory of 2408 5968 2026-11-10_0e006e5a909e8ad3f144be97a519e6fb_elex_mafia.exe 88 PID 2408 wrote to memory of 2968 2408 61E8.tmp 90 PID 2968 wrote to memory of 5072 2968 62B3.tmp 91 PID 5072 wrote to memory of 4820 5072 639D.tmp 92 PID 4820 wrote to memory of 4856 4820 6488.tmp 93 PID 4856 wrote to memory of 5780 4856 6524.tmp 94 PID 5780 wrote to memory of 3716 5780 661E.tmp 95 PID 3716 wrote to memory of 2592 3716 6AA2.tmp 96 PID 2592 wrote to memory of 5668 2592 6B7D.tmp 97 PID 5668 wrote to memory of 3096 5668 6C58.tmp 98 PID 3096 wrote to memory of 4084 3096 6D23.tmp 99 PID 4084 wrote to memory of 5452 4084 6DDE.tmp 100 PID 5452 wrote to memory of 4452 5452 6EB9.tmp 101 PID 4452 wrote to memory of 4476 4452 6F94.tmp 102 PID 4476 wrote to memory of 4680 4476 705F.tmp 103 PID 4680 wrote to memory of 3356 4680 7168.tmp 104 PID 3356 wrote to memory of 1904 3356 7224.tmp 105 PID 1904 wrote to memory of 4556 1904 72FF.tmp 106 PID 4556 wrote to memory of 760 4556 73CA.tmp 107 PID 760 wrote to memory of 5300 760 7485.tmp 108 PID 5300 wrote to memory of 3616 5300 7522.tmp 109 PID 3616 wrote to memory of 812 3616 75FC.tmp 110 PID 812 wrote to memory of 668 812 76F6.tmp 111 PID 668 wrote to memory of 2596 668 77F0.tmp 112 PID 2596 wrote to memory of 3020 2596 78CB.tmp 113 PID 3020 wrote to memory of 4568 3020 7987.tmp 114 PID 4568 wrote to memory of 3776 4568 7A52.tmp 115 PID 3776 wrote to memory of 4684 3776 7B7B.tmp 116 PID 4684 wrote to memory of 360 4684 7C46.tmp 117 PID 360 wrote to memory of 1740 360 7D20.tmp 118 PID 1740 wrote to memory of 4656 1740 7DDC.tmp 119 PID 4656 wrote to memory of 3704 4656 7E88.tmp 120 PID 3704 wrote to memory of 2148 3704 7F53.tmp 121 PID 2148 wrote to memory of 4804 2148 801E.tmp 122 PID 4804 wrote to memory of 3628 4804 80DA.tmp 123 PID 3628 wrote to memory of 3252 3628 8185.tmp 124 PID 3252 wrote to memory of 1864 3252 8222.tmp 125 PID 1864 wrote to memory of 3844 1864 829F.tmp 126 PID 3844 wrote to memory of 1520 3844 833B.tmp 127 PID 1520 wrote to memory of 1764 1520 8399.tmp 128 PID 1764 wrote to memory of 1644 1764 8435.tmp 129 PID 1644 wrote to memory of 5736 1644 84D1.tmp 130 PID 5736 wrote to memory of 1284 5736 856D.tmp 131 PID 1284 wrote to memory of 5804 1284 85EA.tmp 132 PID 5804 wrote to memory of 2176 5804 8677.tmp 133 PID 2176 wrote to memory of 1812 2176 8713.tmp 134 PID 1812 wrote to memory of 1324 1812 87A0.tmp 135 PID 1324 wrote to memory of 3636 1324 883C.tmp 136 PID 3636 wrote to memory of 5888 3636 88C9.tmp 137 PID 5888 wrote to memory of 1116 5888 8955.tmp 138 PID 1116 wrote to memory of 4060 1116 89D2.tmp 139 PID 4060 wrote to memory of 4404 4060 8A6F.tmp 140 PID 4404 wrote to memory of 4552 4404 8AFB.tmp 141 PID 4552 wrote to memory of 1820 4552 8B88.tmp 142 PID 1820 wrote to memory of 1760 1820 8C34.tmp 143 PID 1760 wrote to memory of 3436 1760 8CB1.tmp 144 PID 3436 wrote to memory of 4072 3436 8D4D.tmp 145 PID 4072 wrote to memory of 6104 4072 8DCA.tmp 146 PID 6104 wrote to memory of 1800 6104 8E66.tmp 147 PID 1800 wrote to memory of 5580 1800 8EF3.tmp 148 PID 5580 wrote to memory of 4232 5580 8F70.tmp 149 PID 4232 wrote to memory of 3452 4232 8FED.tmp 150 PID 3452 wrote to memory of 2412 3452 9099.tmp 151 PID 2412 wrote to memory of 1084 2412 9116.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_0e006e5a909e8ad3f144be97a519e6fb_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_0e006e5a909e8ad3f144be97a519e6fb_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\61E8.tmp"C:\Users\Admin\AppData\Local\Temp\61E8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\62B3.tmp"C:\Users\Admin\AppData\Local\Temp\62B3.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\639D.tmp"C:\Users\Admin\AppData\Local\Temp\639D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\6488.tmp"C:\Users\Admin\AppData\Local\Temp\6488.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\6524.tmp"C:\Users\Admin\AppData\Local\Temp\6524.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\661E.tmp"C:\Users\Admin\AppData\Local\Temp\661E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\6AA2.tmp"C:\Users\Admin\AppData\Local\Temp\6AA2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\6B7D.tmp"C:\Users\Admin\AppData\Local\Temp\6B7D.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\6C58.tmp"C:\Users\Admin\AppData\Local\Temp\6C58.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\6D23.tmp"C:\Users\Admin\AppData\Local\Temp\6D23.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\6F94.tmp"C:\Users\Admin\AppData\Local\Temp\6F94.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\7168.tmp"C:\Users\Admin\AppData\Local\Temp\7168.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\72FF.tmp"C:\Users\Admin\AppData\Local\Temp\72FF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\73CA.tmp"C:\Users\Admin\AppData\Local\Temp\73CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7485.tmp"C:\Users\Admin\AppData\Local\Temp\7485.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\7522.tmp"C:\Users\Admin\AppData\Local\Temp\7522.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\75FC.tmp"C:\Users\Admin\AppData\Local\Temp\75FC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\76F6.tmp"C:\Users\Admin\AppData\Local\Temp\76F6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\77F0.tmp"C:\Users\Admin\AppData\Local\Temp\77F0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\78CB.tmp"C:\Users\Admin\AppData\Local\Temp\78CB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7987.tmp"C:\Users\Admin\AppData\Local\Temp\7987.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7A52.tmp"C:\Users\Admin\AppData\Local\Temp\7A52.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\7B7B.tmp"C:\Users\Admin\AppData\Local\Temp\7B7B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7C46.tmp"C:\Users\Admin\AppData\Local\Temp\7C46.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\7DDC.tmp"C:\Users\Admin\AppData\Local\Temp\7DDC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7E88.tmp"C:\Users\Admin\AppData\Local\Temp\7E88.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\7F53.tmp"C:\Users\Admin\AppData\Local\Temp\7F53.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\801E.tmp"C:\Users\Admin\AppData\Local\Temp\801E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\80DA.tmp"C:\Users\Admin\AppData\Local\Temp\80DA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\829F.tmp"C:\Users\Admin\AppData\Local\Temp\829F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\833B.tmp"C:\Users\Admin\AppData\Local\Temp\833B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\8399.tmp"C:\Users\Admin\AppData\Local\Temp\8399.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\84D1.tmp"C:\Users\Admin\AppData\Local\Temp\84D1.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\856D.tmp"C:\Users\Admin\AppData\Local\Temp\856D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\85EA.tmp"C:\Users\Admin\AppData\Local\Temp\85EA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\8677.tmp"C:\Users\Admin\AppData\Local\Temp\8677.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\8713.tmp"C:\Users\Admin\AppData\Local\Temp\8713.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\87A0.tmp"C:\Users\Admin\AppData\Local\Temp\87A0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\883C.tmp"C:\Users\Admin\AppData\Local\Temp\883C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\88C9.tmp"C:\Users\Admin\AppData\Local\Temp\88C9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\8955.tmp"C:\Users\Admin\AppData\Local\Temp\8955.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\89D2.tmp"C:\Users\Admin\AppData\Local\Temp\89D2.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\8C34.tmp"C:\Users\Admin\AppData\Local\Temp\8C34.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"C:\Users\Admin\AppData\Local\Temp\8D4D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\8DCA.tmp"C:\Users\Admin\AppData\Local\Temp\8DCA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8E66.tmp"C:\Users\Admin\AppData\Local\Temp\8E66.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8F70.tmp"C:\Users\Admin\AppData\Local\Temp\8F70.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\8FED.tmp"C:\Users\Admin\AppData\Local\Temp\8FED.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\9099.tmp"C:\Users\Admin\AppData\Local\Temp\9099.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\9116.tmp"C:\Users\Admin\AppData\Local\Temp\9116.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\91C2.tmp"C:\Users\Admin\AppData\Local\Temp\91C2.tmp"65⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\923F.tmp"C:\Users\Admin\AppData\Local\Temp\923F.tmp"66⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\930A.tmp"C:\Users\Admin\AppData\Local\Temp\930A.tmp"67⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\9387.tmp"C:\Users\Admin\AppData\Local\Temp\9387.tmp"68⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\9413.tmp"C:\Users\Admin\AppData\Local\Temp\9413.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\94B0.tmp"C:\Users\Admin\AppData\Local\Temp\94B0.tmp"70⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\954C.tmp"C:\Users\Admin\AppData\Local\Temp\954C.tmp"71⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\95C9.tmp"C:\Users\Admin\AppData\Local\Temp\95C9.tmp"72⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\9665.tmp"C:\Users\Admin\AppData\Local\Temp\9665.tmp"73⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\96E2.tmp"C:\Users\Admin\AppData\Local\Temp\96E2.tmp"74⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"75⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"76⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"77⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"78⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\99C1.tmp"C:\Users\Admin\AppData\Local\Temp\99C1.tmp"79⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\9A4D.tmp"C:\Users\Admin\AppData\Local\Temp\9A4D.tmp"80⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"81⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\9B47.tmp"C:\Users\Admin\AppData\Local\Temp\9B47.tmp"82⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9BE3.tmp"C:\Users\Admin\AppData\Local\Temp\9BE3.tmp"83⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\9C60.tmp"C:\Users\Admin\AppData\Local\Temp\9C60.tmp"84⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"C:\Users\Admin\AppData\Local\Temp\9CFD.tmp"85⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\9D6A.tmp"C:\Users\Admin\AppData\Local\Temp\9D6A.tmp"86⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\9E16.tmp"C:\Users\Admin\AppData\Local\Temp\9E16.tmp"87⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\9E93.tmp"C:\Users\Admin\AppData\Local\Temp\9E93.tmp"88⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9F2F.tmp"C:\Users\Admin\AppData\Local\Temp\9F2F.tmp"89⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\9F9D.tmp"C:\Users\Admin\AppData\Local\Temp\9F9D.tmp"90⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\A029.tmp"C:\Users\Admin\AppData\Local\Temp\A029.tmp"91⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"92⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\A123.tmp"C:\Users\Admin\AppData\Local\Temp\A123.tmp"93⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\A1B0.tmp"C:\Users\Admin\AppData\Local\Temp\A1B0.tmp"94⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\A25C.tmp"C:\Users\Admin\AppData\Local\Temp\A25C.tmp"95⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A2D9.tmp"C:\Users\Admin\AppData\Local\Temp\A2D9.tmp"96⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\A365.tmp"C:\Users\Admin\AppData\Local\Temp\A365.tmp"97⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\A3E2.tmp"C:\Users\Admin\AppData\Local\Temp\A3E2.tmp"98⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\A45F.tmp"C:\Users\Admin\AppData\Local\Temp\A45F.tmp"99⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\A4EC.tmp"C:\Users\Admin\AppData\Local\Temp\A4EC.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\A559.tmp"C:\Users\Admin\AppData\Local\Temp\A559.tmp"101⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\A5D6.tmp"C:\Users\Admin\AppData\Local\Temp\A5D6.tmp"102⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\A682.tmp"C:\Users\Admin\AppData\Local\Temp\A682.tmp"103⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A70F.tmp"C:\Users\Admin\AppData\Local\Temp\A70F.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\A79B.tmp"C:\Users\Admin\AppData\Local\Temp\A79B.tmp"105⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\A828.tmp"C:\Users\Admin\AppData\Local\Temp\A828.tmp"106⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"107⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\A932.tmp"C:\Users\Admin\AppData\Local\Temp\A932.tmp"108⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\A9AF.tmp"C:\Users\Admin\AppData\Local\Temp\A9AF.tmp"109⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"C:\Users\Admin\AppData\Local\Temp\AA3B.tmp"110⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"C:\Users\Admin\AppData\Local\Temp\AAE7.tmp"111⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"112⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\AC10.tmp"C:\Users\Admin\AppData\Local\Temp\AC10.tmp"113⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\AC9D.tmp"C:\Users\Admin\AppData\Local\Temp\AC9D.tmp"114⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"115⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\ADA6.tmp"C:\Users\Admin\AppData\Local\Temp\ADA6.tmp"116⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\AE23.tmp"C:\Users\Admin\AppData\Local\Temp\AE23.tmp"117⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\AE91.tmp"C:\Users\Admin\AppData\Local\Temp\AE91.tmp"118⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\AF4C.tmp"C:\Users\Admin\AppData\Local\Temp\AF4C.tmp"119⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\AFC9.tmp"C:\Users\Admin\AppData\Local\Temp\AFC9.tmp"120⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\B046.tmp"C:\Users\Admin\AppData\Local\Temp\B046.tmp"121⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\B0F2.tmp"C:\Users\Admin\AppData\Local\Temp\B0F2.tmp"122⤵PID:1292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-