Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 04:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_6f6c15776ba36aa313525b9dd941f83b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_6f6c15776ba36aa313525b9dd941f83b_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-14_6f6c15776ba36aa313525b9dd941f83b_elex_mafia.exe
- Size 524KB
- Sample260814-eraplavaph
- SHA256 8b812e4ae44fb1f7f9c31239c50259f6867748cae9a64354d1deb3e52acc0f58
- MD5 6f6c15776ba36aa313525b9dd941f83b
- SHA1 9e8bf35a9b6c7be9ea56e97b7c74cbc3e781d147
- SHA512 a074a8c50e65f41f2f725757db764ae47865270d3e93876b83b15a01053a33f7552d64be457efef70301b564cba3b0ef9fe7b6b6b7fff5794dbcc9d9ddd14786
- SSDEEP 12288:TRyZzqyL66TpSUyqheXr5xel4IkCJF8jUmb1NZ:TRyQylTUU9p420jU+N
- TLSH T1CFB4F1167588C032F69202364E59EB92993E7DB69B27A5C72B94362E2FF03D1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5520 B0F7.tmp 5976 B1F1.tmp 1220 B2DB.tmp 1248 B3E5.tmp 4548 B50E.tmp 6008 B58B.tmp 6100 B5F8.tmp 260 B656.tmp 5584 B80B.tmp 3140 B8E6.tmp 5972 B944.tmp 236 BA8C.tmp 2440 BB76.tmp 5612 BC70.tmp 1628 BD7A.tmp 1944 BE55.tmp 360 BF5E.tmp 1312 C058.tmp 5944 C181.tmp 1056 C2D9.tmp 448 C3F2.tmp 1564 C50B.tmp 688 C5F6.tmp 5952 C70F.tmp 5920 C857.tmp 6036 C9AF.tmp 2204 CB07.tmp 3236 CC01.tmp 6064 CD39.tmp 6108 CE33.tmp 2788 CF3D.tmp 3044 D075.tmp 4400 D1CD.tmp 3088 D2A8.tmp 3836 D363.tmp 4200 D41F.tmp 4160 D528.tmp 5496 D622.tmp 1108 D72C.tmp 1792 D845.tmp 3112 D920.tmp 3428 D9EB.tmp 3368 DAD6.tmp 3076 DBB0.tmp 4588 DCAA.tmp 4960 DD47.tmp 2516 DE31.tmp 4560 DEBE.tmp 3660 DF4A.tmp 4148 DFE6.tmp 4596 E083.tmp 6116 E10F.tmp 5644 E1AC.tmp 4556 E248.tmp 2860 E2D4.tmp 1152 E390.tmp 4356 E42C.tmp 4804 E4D8.tmp 5416 E574.tmp 3412 E5E2.tmp 2740 E67E.tmp 2864 E72A.tmp 1560 E797.tmp 3064 E833.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B382.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 494F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8161.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DE9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6112 wrote to memory of 5520 6112 2026-08-14_6f6c15776ba36aa313525b9dd941f83b_elex_mafia.exe 89 PID 5520 wrote to memory of 5976 5520 B0F7.tmp 90 PID 5976 wrote to memory of 1220 5976 B1F1.tmp 91 PID 1220 wrote to memory of 1248 1220 B2DB.tmp 92 PID 1248 wrote to memory of 4548 1248 B3E5.tmp 93 PID 4548 wrote to memory of 6008 4548 B50E.tmp 94 PID 6008 wrote to memory of 6100 6008 B58B.tmp 95 PID 6100 wrote to memory of 260 6100 B5F8.tmp 96 PID 260 wrote to memory of 5584 260 B656.tmp 97 PID 5584 wrote to memory of 3140 5584 B80B.tmp 98 PID 3140 wrote to memory of 5972 3140 B8E6.tmp 99 PID 5972 wrote to memory of 236 5972 B944.tmp 100 PID 236 wrote to memory of 2440 236 BA8C.tmp 101 PID 2440 wrote to memory of 5612 2440 BB76.tmp 102 PID 5612 wrote to memory of 1628 5612 BC70.tmp 103 PID 1628 wrote to memory of 1944 1628 BD7A.tmp 104 PID 1944 wrote to memory of 360 1944 BE55.tmp 105 PID 360 wrote to memory of 1312 360 BF5E.tmp 106 PID 1312 wrote to memory of 5944 1312 C058.tmp 107 PID 5944 wrote to memory of 1056 5944 C181.tmp 108 PID 1056 wrote to memory of 448 1056 C2D9.tmp 109 PID 448 wrote to memory of 1564 448 C3F2.tmp 110 PID 1564 wrote to memory of 688 1564 C50B.tmp 111 PID 688 wrote to memory of 5952 688 C5F6.tmp 112 PID 5952 wrote to memory of 5920 5952 C70F.tmp 113 PID 5920 wrote to memory of 6036 5920 C857.tmp 114 PID 6036 wrote to memory of 2204 6036 C9AF.tmp 115 PID 2204 wrote to memory of 3236 2204 CB07.tmp 116 PID 3236 wrote to memory of 6064 3236 CC01.tmp 117 PID 6064 wrote to memory of 6108 6064 CD39.tmp 118 PID 6108 wrote to memory of 2788 6108 CE33.tmp 119 PID 2788 wrote to memory of 3044 2788 CF3D.tmp 120 PID 3044 wrote to memory of 4400 3044 D075.tmp 121 PID 4400 wrote to memory of 3088 4400 D1CD.tmp 122 PID 3088 wrote to memory of 3836 3088 D2A8.tmp 123 PID 3836 wrote to memory of 4200 3836 D363.tmp 124 PID 4200 wrote to memory of 4160 4200 D41F.tmp 125 PID 4160 wrote to memory of 5496 4160 D528.tmp 126 PID 5496 wrote to memory of 1108 5496 D622.tmp 127 PID 1108 wrote to memory of 1792 1108 D72C.tmp 128 PID 1792 wrote to memory of 3112 1792 D845.tmp 129 PID 3112 wrote to memory of 3428 3112 D920.tmp 130 PID 3428 wrote to memory of 3368 3428 D9EB.tmp 131 PID 3368 wrote to memory of 3076 3368 DAD6.tmp 132 PID 3076 wrote to memory of 4588 3076 DBB0.tmp 133 PID 4588 wrote to memory of 4960 4588 DCAA.tmp 134 PID 4960 wrote to memory of 2516 4960 DD47.tmp 135 PID 2516 wrote to memory of 4560 2516 DE31.tmp 136 PID 4560 wrote to memory of 3660 4560 DEBE.tmp 137 PID 3660 wrote to memory of 4148 3660 DF4A.tmp 138 PID 4148 wrote to memory of 4596 4148 DFE6.tmp 139 PID 4596 wrote to memory of 6116 4596 E083.tmp 140 PID 6116 wrote to memory of 5644 6116 E10F.tmp 141 PID 5644 wrote to memory of 4556 5644 E1AC.tmp 142 PID 4556 wrote to memory of 2860 4556 E248.tmp 143 PID 2860 wrote to memory of 1152 2860 E2D4.tmp 144 PID 1152 wrote to memory of 4356 1152 E390.tmp 145 PID 4356 wrote to memory of 4804 4356 E42C.tmp 146 PID 4804 wrote to memory of 5416 4804 E4D8.tmp 147 PID 5416 wrote to memory of 3412 5416 E574.tmp 148 PID 3412 wrote to memory of 2740 3412 E5E2.tmp 149 PID 2740 wrote to memory of 2864 2740 E67E.tmp 150 PID 2864 wrote to memory of 1560 2864 E72A.tmp 151 PID 1560 wrote to memory of 3064 1560 E797.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_6f6c15776ba36aa313525b9dd941f83b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_6f6c15776ba36aa313525b9dd941f83b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\B58B.tmp"C:\Users\Admin\AppData\Local\Temp\B58B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\B80B.tmp"C:\Users\Admin\AppData\Local\Temp\B80B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"C:\Users\Admin\AppData\Local\Temp\BA8C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\BB76.tmp"C:\Users\Admin\AppData\Local\Temp\BB76.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\C058.tmp"C:\Users\Admin\AppData\Local\Temp\C058.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C181.tmp"C:\Users\Admin\AppData\Local\Temp\C181.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\C50B.tmp"C:\Users\Admin\AppData\Local\Temp\C50B.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\C70F.tmp"C:\Users\Admin\AppData\Local\Temp\C70F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"C:\Users\Admin\AppData\Local\Temp\C9AF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\CC01.tmp"C:\Users\Admin\AppData\Local\Temp\CC01.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\CD39.tmp"C:\Users\Admin\AppData\Local\Temp\CD39.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\CE33.tmp"C:\Users\Admin\AppData\Local\Temp\CE33.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"C:\Users\Admin\AppData\Local\Temp\CF3D.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"C:\Users\Admin\AppData\Local\Temp\D2A8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\D528.tmp"C:\Users\Admin\AppData\Local\Temp\D528.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\D622.tmp"C:\Users\Admin\AppData\Local\Temp\D622.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\E10F.tmp"C:\Users\Admin\AppData\Local\Temp\E10F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"C:\Users\Admin\AppData\Local\Temp\E1AC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\E2D4.tmp"C:\Users\Admin\AppData\Local\Temp\E2D4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\E574.tmp"C:\Users\Admin\AppData\Local\Temp\E574.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"65⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"66⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"67⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"C:\Users\Admin\AppData\Local\Temp\E9CA.tmp"68⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"70⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"71⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"72⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"73⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"74⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"75⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"76⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\EF77.tmp"C:\Users\Admin\AppData\Local\Temp\EF77.tmp"77⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"78⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"79⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"80⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"81⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\F226.tmp"C:\Users\Admin\AppData\Local\Temp\F226.tmp"82⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"83⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\F36E.tmp"C:\Users\Admin\AppData\Local\Temp\F36E.tmp"84⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\F42A.tmp"C:\Users\Admin\AppData\Local\Temp\F42A.tmp"85⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"86⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\F514.tmp"C:\Users\Admin\AppData\Local\Temp\F514.tmp"87⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"C:\Users\Admin\AppData\Local\Temp\F5D0.tmp"88⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"89⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"90⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\F756.tmp"C:\Users\Admin\AppData\Local\Temp\F756.tmp"91⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"92⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"93⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"94⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\F9B8.tmp"C:\Users\Admin\AppData\Local\Temp\F9B8.tmp"95⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\FA64.tmp"C:\Users\Admin\AppData\Local\Temp\FA64.tmp"96⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"97⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"99⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"100⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"C:\Users\Admin\AppData\Local\Temp\FCF4.tmp"101⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"102⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"103⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"104⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"105⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"106⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"107⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"108⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"109⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\1A7.tmp"C:\Users\Admin\AppData\Local\Temp\1A7.tmp"110⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\243.tmp"C:\Users\Admin\AppData\Local\Temp\243.tmp"111⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2E0.tmp"C:\Users\Admin\AppData\Local\Temp\2E0.tmp"112⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\34D.tmp"C:\Users\Admin\AppData\Local\Temp\34D.tmp"113⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\3CA.tmp"C:\Users\Admin\AppData\Local\Temp\3CA.tmp"114⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"115⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"116⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"117⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"118⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"119⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\793.tmp"C:\Users\Admin\AppData\Local\Temp\793.tmp"121⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"122⤵PID:3264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-