Analysis
- max time kernel
118s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 02:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_9af9d4d2357e45a2e9b8951b65c9f875_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_9af9d4d2357e45a2e9b8951b65c9f875_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_9af9d4d2357e45a2e9b8951b65c9f875_elex_mafia.exe
- Size 561KB
- Sample260803-cvs91aaq3v
- SHA256 387a3993b36a595dbb1666430d8387710c643b986894d041b835110e5d006669
- MD5 9af9d4d2357e45a2e9b8951b65c9f875
- SHA1 c99fd75c4d9f3f7746239e9b0d569c4994fec577
- SHA512 de210cfe7d55f7d1d7167d52c8e4ed0fef4093dab0a7a7af49e93cbdc58ec001f6f7fbb336c7975965a4010e90a1b20aa154346bf75a3c65c2512f10fb6564d2
- SSDEEP 12288:VuelPWET0yhToE/Kx5nkogAHBnCFCl2RDHDZuL:8eEEvhToE/V2xOjlDoL
- TLSH T142C4D021B2C4C835F1F31A385AF5D7A2097B7D219B31D8CB2784166E6EB12D0EA79713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4048 4ADA.tmp 3704 4B86.tmp 4316 4C22.tmp 2004 4D1C.tmp 5016 4EF1.tmp 4232 4F8D.tmp 5032 501A.tmp 3136 50D5.tmp 2656 5191.tmp 3444 527B.tmp 3672 5337.tmp 264 5402.tmp 4564 54CD.tmp 4636 5589.tmp 4348 5644.tmp 4876 570F.tmp 3420 57FA.tmp 5000 5886.tmp 896 5951.tmp 5752 59EE.tmp 3800 5AB9.tmp 1296 5B36.tmp 4528 5BA3.tmp 5904 5C6E.tmp 1248 5D1A.tmp 3832 5DA7.tmp 5912 5E43.tmp 4576 5EDF.tmp 4500 5F6C.tmp 3332 6008.tmp 6036 60A4.tmp 5908 6131.tmp 2436 61EC.tmp 5432 6269.tmp 4744 6306.tmp 3268 6392.tmp 3696 640F.tmp 4220 648C.tmp 5256 6509.tmp 4976 6596.tmp 5128 6613.tmp 5768 66A0.tmp 5192 671D.tmp 3376 679A.tmp 2624 6836.tmp 5816 68B3.tmp 4824 693F.tmp 2772 69BC.tmp 1724 6A49.tmp 4968 6AC6.tmp 5276 6B33.tmp 4928 6BB0.tmp 1376 6C3D.tmp 3260 6CBA.tmp 6016 6D27.tmp 5744 6DD3.tmp 5584 6E41.tmp 1224 6EBE.tmp 3928 6F4A.tmp 5588 6FB8.tmp 752 7054.tmp 3844 70C1.tmp 2524 713E.tmp 4332 71BB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 736C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D23A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 987D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F34F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D998.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4048 4456 2026-08-03_9af9d4d2357e45a2e9b8951b65c9f875_elex_mafia.exe 89 PID 4048 wrote to memory of 3704 4048 4ADA.tmp 90 PID 3704 wrote to memory of 4316 3704 4B86.tmp 91 PID 4316 wrote to memory of 2004 4316 4C22.tmp 92 PID 2004 wrote to memory of 5016 2004 4D1C.tmp 93 PID 5016 wrote to memory of 4232 5016 4EF1.tmp 94 PID 4232 wrote to memory of 5032 4232 4F8D.tmp 95 PID 5032 wrote to memory of 3136 5032 501A.tmp 96 PID 3136 wrote to memory of 2656 3136 50D5.tmp 97 PID 2656 wrote to memory of 3444 2656 5191.tmp 98 PID 3444 wrote to memory of 3672 3444 527B.tmp 99 PID 3672 wrote to memory of 264 3672 5337.tmp 100 PID 264 wrote to memory of 4564 264 5402.tmp 101 PID 4564 wrote to memory of 4636 4564 54CD.tmp 102 PID 4636 wrote to memory of 4348 4636 5589.tmp 103 PID 4348 wrote to memory of 4876 4348 5644.tmp 104 PID 4876 wrote to memory of 3420 4876 570F.tmp 105 PID 3420 wrote to memory of 5000 3420 57FA.tmp 106 PID 5000 wrote to memory of 896 5000 5886.tmp 107 PID 896 wrote to memory of 5752 896 5951.tmp 108 PID 5752 wrote to memory of 3800 5752 59EE.tmp 109 PID 3800 wrote to memory of 1296 3800 5AB9.tmp 110 PID 1296 wrote to memory of 4528 1296 5B36.tmp 111 PID 4528 wrote to memory of 5904 4528 5BA3.tmp 112 PID 5904 wrote to memory of 1248 5904 5C6E.tmp 113 PID 1248 wrote to memory of 3832 1248 5D1A.tmp 114 PID 3832 wrote to memory of 5912 3832 5DA7.tmp 115 PID 5912 wrote to memory of 4576 5912 5E43.tmp 116 PID 4576 wrote to memory of 4500 4576 5EDF.tmp 117 PID 4500 wrote to memory of 3332 4500 5F6C.tmp 118 PID 3332 wrote to memory of 6036 3332 6008.tmp 119 PID 6036 wrote to memory of 5908 6036 60A4.tmp 120 PID 5908 wrote to memory of 2436 5908 6131.tmp 121 PID 2436 wrote to memory of 5432 2436 61EC.tmp 122 PID 5432 wrote to memory of 4744 5432 6269.tmp 123 PID 4744 wrote to memory of 3268 4744 6306.tmp 124 PID 3268 wrote to memory of 3696 3268 6392.tmp 125 PID 3696 wrote to memory of 4220 3696 640F.tmp 126 PID 4220 wrote to memory of 5256 4220 648C.tmp 127 PID 5256 wrote to memory of 4976 5256 6509.tmp 128 PID 4976 wrote to memory of 5128 4976 6596.tmp 129 PID 5128 wrote to memory of 5768 5128 6613.tmp 130 PID 5768 wrote to memory of 5192 5768 66A0.tmp 131 PID 5192 wrote to memory of 3376 5192 671D.tmp 132 PID 3376 wrote to memory of 2624 3376 679A.tmp 133 PID 2624 wrote to memory of 5816 2624 6836.tmp 134 PID 5816 wrote to memory of 4824 5816 68B3.tmp 135 PID 4824 wrote to memory of 2772 4824 693F.tmp 136 PID 2772 wrote to memory of 1724 2772 69BC.tmp 137 PID 1724 wrote to memory of 4968 1724 6A49.tmp 138 PID 4968 wrote to memory of 5276 4968 6AC6.tmp 139 PID 5276 wrote to memory of 4928 5276 6B33.tmp 140 PID 4928 wrote to memory of 1376 4928 6BB0.tmp 141 PID 1376 wrote to memory of 3260 1376 6C3D.tmp 142 PID 3260 wrote to memory of 6016 3260 6CBA.tmp 143 PID 6016 wrote to memory of 5744 6016 6D27.tmp 144 PID 5744 wrote to memory of 5584 5744 6DD3.tmp 145 PID 5584 wrote to memory of 1224 5584 6E41.tmp 146 PID 1224 wrote to memory of 3928 1224 6EBE.tmp 147 PID 3928 wrote to memory of 5588 3928 6F4A.tmp 148 PID 5588 wrote to memory of 752 5588 6FB8.tmp 149 PID 752 wrote to memory of 3844 752 7054.tmp 150 PID 3844 wrote to memory of 2524 3844 70C1.tmp 151 PID 2524 wrote to memory of 4332 2524 713E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_9af9d4d2357e45a2e9b8951b65c9f875_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9af9d4d2357e45a2e9b8951b65c9f875_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4C22.tmp"C:\Users\Admin\AppData\Local\Temp\4C22.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\50D5.tmp"C:\Users\Admin\AppData\Local\Temp\50D5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5337.tmp"C:\Users\Admin\AppData\Local\Temp\5337.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\5589.tmp"C:\Users\Admin\AppData\Local\Temp\5589.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5644.tmp"C:\Users\Admin\AppData\Local\Temp\5644.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5886.tmp"C:\Users\Admin\AppData\Local\Temp\5886.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\5AB9.tmp"C:\Users\Admin\AppData\Local\Temp\5AB9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\5B36.tmp"C:\Users\Admin\AppData\Local\Temp\5B36.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5E43.tmp"C:\Users\Admin\AppData\Local\Temp\5E43.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\6131.tmp"C:\Users\Admin\AppData\Local\Temp\6131.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\61EC.tmp"C:\Users\Admin\AppData\Local\Temp\61EC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\6269.tmp"C:\Users\Admin\AppData\Local\Temp\6269.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6509.tmp"C:\Users\Admin\AppData\Local\Temp\6509.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\66A0.tmp"C:\Users\Admin\AppData\Local\Temp\66A0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\679A.tmp"C:\Users\Admin\AppData\Local\Temp\679A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\68B3.tmp"C:\Users\Admin\AppData\Local\Temp\68B3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\69BC.tmp"C:\Users\Admin\AppData\Local\Temp\69BC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"C:\Users\Admin\AppData\Local\Temp\6DD3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\6E41.tmp"C:\Users\Admin\AppData\Local\Temp\6E41.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\6EBE.tmp"C:\Users\Admin\AppData\Local\Temp\6EBE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\71BB.tmp"C:\Users\Admin\AppData\Local\Temp\71BB.tmp"65⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\72B5.tmp"C:\Users\Admin\AppData\Local\Temp\72B5.tmp"67⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\7361.tmp"C:\Users\Admin\AppData\Local\Temp\7361.tmp"68⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"69⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"70⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"71⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\75A3.tmp"C:\Users\Admin\AppData\Local\Temp\75A3.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\7630.tmp"C:\Users\Admin\AppData\Local\Temp\7630.tmp"73⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\769D.tmp"C:\Users\Admin\AppData\Local\Temp\769D.tmp"74⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"75⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"76⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\7814.tmp"C:\Users\Admin\AppData\Local\Temp\7814.tmp"77⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\7882.tmp"C:\Users\Admin\AppData\Local\Temp\7882.tmp"78⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"79⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\799B.tmp"C:\Users\Admin\AppData\Local\Temp\799B.tmp"80⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"81⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"82⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"83⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"84⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7C89.tmp"C:\Users\Admin\AppData\Local\Temp\7C89.tmp"85⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"86⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"87⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"88⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"89⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"90⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"91⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"92⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"93⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\80DE.tmp"C:\Users\Admin\AppData\Local\Temp\80DE.tmp"94⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\815B.tmp"C:\Users\Admin\AppData\Local\Temp\815B.tmp"95⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"96⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"97⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"98⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"99⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"100⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8449.tmp"C:\Users\Admin\AppData\Local\Temp\8449.tmp"101⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"102⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:436 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"104⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"105⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"106⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\8737.tmp"C:\Users\Admin\AppData\Local\Temp\8737.tmp"107⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"108⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"109⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"110⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\88FC.tmp"C:\Users\Admin\AppData\Local\Temp\88FC.tmp"111⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\896A.tmp"C:\Users\Admin\AppData\Local\Temp\896A.tmp"112⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"113⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"114⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"115⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"116⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"117⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"118⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"119⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"121⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"122⤵PID:3112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-