Analysis
- max time kernel
133s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 11:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe
- Size 520KB
- Sample260815-nefjrawsat
- SHA256 d6a2348e3cf1a2614198f7339bfba31e303c3d7d55db85ff014af7a8cd62e06b
- MD5 3dcba67f970e455377fc1b36925cdf22
- SHA1 abcc8c5d802fe3a687a4458d8de41482cdf7fdb7
- SHA512 ced6e4ebb0ae0dbf953b140f48f528f7c9d31ebed0926ed06ace17d315633bf0c04e2cb0a07f5872ecde45c524d67e8fd4817e1d9868748aa9b5acb03268a106
- SSDEEP 12288:roRXOQjmOyDQFHUG810R/x3t5XabFiwxsXFYJKNZE:rogQ9yDULG0nvu3sF5N6
- TLSH T18BB4F1127589C036E59216314B26EFA2573E7D32473A52C73B883A2D6FF42C1E676387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6148 44CF.tmp 924 458B.tmp 1520 46A4.tmp 1868 47CD.tmp 6496 4888.tmp 3412 4963.tmp 5800 4A2E.tmp 932 4B28.tmp 684 4BB5.tmp 5980 4C70.tmp 6276 4D3C.tmp 4296 4E07.tmp 1440 4EE1.tmp 404 4FCC.tmp 248 5068.tmp 4868 5133.tmp 4696 51FE.tmp 2692 528B.tmp 6444 5327.tmp 4916 53E3.tmp 5208 54CD.tmp 1300 5598.tmp 4968 5654.tmp 4208 574E.tmp 2832 57EA.tmp 5632 58E4.tmp 6188 59AF.tmp 4632 5A7A.tmp 6272 5B55.tmp 6916 5BF1.tmp 4680 5CDC.tmp 3708 5DC6.tmp 6528 5EA1.tmp 6232 5F3D.tmp 2884 5FD9.tmp 4744 6066.tmp 4224 6102.tmp 1760 617F.tmp 428 621B.tmp 5384 6289.tmp 6224 6315.tmp 4412 6383.tmp 2820 640F.tmp 5928 649C.tmp 3296 6548.tmp 2696 65C5.tmp 3132 6651.tmp 696 66DE.tmp 3636 677A.tmp 360 67F7.tmp 6756 6894.tmp 6772 6911.tmp 6296 698E.tmp 5848 6A2A.tmp 1732 6A88.tmp 2304 6B14.tmp 5772 6BA1.tmp 1292 6C0E.tmp 1824 6C7C.tmp 6848 6D27.tmp 6860 6DA4.tmp 3436 6E21.tmp 1796 6EDD.tmp 5424 6F6A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D36E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7517.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 802E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F58D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 345F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 894B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 6148 4788 2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe 90 PID 6148 wrote to memory of 924 6148 44CF.tmp 91 PID 924 wrote to memory of 1520 924 458B.tmp 92 PID 1520 wrote to memory of 1868 1520 46A4.tmp 93 PID 1868 wrote to memory of 6496 1868 47CD.tmp 94 PID 6496 wrote to memory of 3412 6496 4888.tmp 95 PID 3412 wrote to memory of 5800 3412 4963.tmp 96 PID 5800 wrote to memory of 932 5800 4A2E.tmp 97 PID 932 wrote to memory of 684 932 4B28.tmp 98 PID 684 wrote to memory of 5980 684 4BB5.tmp 99 PID 5980 wrote to memory of 6276 5980 4C70.tmp 100 PID 6276 wrote to memory of 4296 6276 4D3C.tmp 101 PID 4296 wrote to memory of 1440 4296 4E07.tmp 102 PID 1440 wrote to memory of 404 1440 4EE1.tmp 103 PID 404 wrote to memory of 248 404 4FCC.tmp 104 PID 248 wrote to memory of 4868 248 5068.tmp 105 PID 4868 wrote to memory of 4696 4868 5133.tmp 106 PID 4696 wrote to memory of 2692 4696 51FE.tmp 107 PID 2692 wrote to memory of 6444 2692 528B.tmp 108 PID 6444 wrote to memory of 4916 6444 5327.tmp 109 PID 4916 wrote to memory of 5208 4916 53E3.tmp 110 PID 5208 wrote to memory of 1300 5208 54CD.tmp 111 PID 1300 wrote to memory of 4968 1300 5598.tmp 112 PID 4968 wrote to memory of 4208 4968 5654.tmp 113 PID 4208 wrote to memory of 2832 4208 574E.tmp 114 PID 2832 wrote to memory of 5632 2832 57EA.tmp 115 PID 5632 wrote to memory of 6188 5632 58E4.tmp 116 PID 6188 wrote to memory of 4632 6188 59AF.tmp 117 PID 4632 wrote to memory of 6272 4632 5A7A.tmp 118 PID 6272 wrote to memory of 6916 6272 5B55.tmp 119 PID 6916 wrote to memory of 4680 6916 5BF1.tmp 120 PID 4680 wrote to memory of 3708 4680 5CDC.tmp 121 PID 3708 wrote to memory of 6528 3708 5DC6.tmp 122 PID 6528 wrote to memory of 6232 6528 5EA1.tmp 123 PID 6232 wrote to memory of 2884 6232 5F3D.tmp 124 PID 2884 wrote to memory of 4744 2884 5FD9.tmp 125 PID 4744 wrote to memory of 4224 4744 6066.tmp 126 PID 4224 wrote to memory of 1760 4224 6102.tmp 127 PID 1760 wrote to memory of 428 1760 617F.tmp 128 PID 428 wrote to memory of 5384 428 621B.tmp 129 PID 5384 wrote to memory of 6224 5384 6289.tmp 130 PID 6224 wrote to memory of 4412 6224 6315.tmp 131 PID 4412 wrote to memory of 2820 4412 6383.tmp 132 PID 2820 wrote to memory of 5928 2820 640F.tmp 133 PID 5928 wrote to memory of 3296 5928 649C.tmp 134 PID 3296 wrote to memory of 2696 3296 6548.tmp 135 PID 2696 wrote to memory of 3132 2696 65C5.tmp 136 PID 3132 wrote to memory of 696 3132 6651.tmp 137 PID 696 wrote to memory of 3636 696 66DE.tmp 138 PID 3636 wrote to memory of 360 3636 677A.tmp 139 PID 360 wrote to memory of 6756 360 67F7.tmp 140 PID 6756 wrote to memory of 6772 6756 6894.tmp 141 PID 6772 wrote to memory of 6296 6772 6911.tmp 142 PID 6296 wrote to memory of 5848 6296 698E.tmp 143 PID 5848 wrote to memory of 1732 5848 6A2A.tmp 144 PID 1732 wrote to memory of 2304 1732 6A88.tmp 145 PID 2304 wrote to memory of 5772 2304 6B14.tmp 146 PID 5772 wrote to memory of 1292 5772 6BA1.tmp 147 PID 1292 wrote to memory of 1824 1292 6C0E.tmp 148 PID 1824 wrote to memory of 6848 1824 6C7C.tmp 149 PID 6848 wrote to memory of 6860 6848 6D27.tmp 150 PID 6860 wrote to memory of 3436 6860 6DA4.tmp 151 PID 3436 wrote to memory of 1796 3436 6E21.tmp 152 PID 1796 wrote to memory of 5424 1796 6EDD.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3dcba67f970e455377fc1b36925cdf22_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6148 -
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\46A4.tmp"C:\Users\Admin\AppData\Local\Temp\46A4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6496 -
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6276 -
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\5133.tmp"C:\Users\Admin\AppData\Local\Temp\5133.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\528B.tmp"C:\Users\Admin\AppData\Local\Temp\528B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6444 -
C:\Users\Admin\AppData\Local\Temp\53E3.tmp"C:\Users\Admin\AppData\Local\Temp\53E3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\574E.tmp"C:\Users\Admin\AppData\Local\Temp\574E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\57EA.tmp"C:\Users\Admin\AppData\Local\Temp\57EA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\59AF.tmp"C:\Users\Admin\AppData\Local\Temp\59AF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6188 -
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5B55.tmp"C:\Users\Admin\AppData\Local\Temp\5B55.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6272 -
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6916 -
C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6528 -
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6232 -
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\6066.tmp"C:\Users\Admin\AppData\Local\Temp\6066.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6102.tmp"C:\Users\Admin\AppData\Local\Temp\6102.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\621B.tmp"C:\Users\Admin\AppData\Local\Temp\621B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\6289.tmp"C:\Users\Admin\AppData\Local\Temp\6289.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\6315.tmp"C:\Users\Admin\AppData\Local\Temp\6315.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6224 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6756 -
C:\Users\Admin\AppData\Local\Temp\6911.tmp"C:\Users\Admin\AppData\Local\Temp\6911.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6772 -
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6296 -
C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6848 -
C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6860 -
C:\Users\Admin\AppData\Local\Temp\6E21.tmp"C:\Users\Admin\AppData\Local\Temp\6E21.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"65⤵
- Executes dropped EXE
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"66⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\7073.tmp"C:\Users\Admin\AppData\Local\Temp\7073.tmp"67⤵PID:6380
-
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"68⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"69⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"70⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\72E4.tmp"C:\Users\Admin\AppData\Local\Temp\72E4.tmp"71⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\7371.tmp"C:\Users\Admin\AppData\Local\Temp\7371.tmp"72⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"73⤵PID:7008
-
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"74⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:6928 -
C:\Users\Admin\AppData\Local\Temp\75C3.tmp"C:\Users\Admin\AppData\Local\Temp\75C3.tmp"76⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\764F.tmp"C:\Users\Admin\AppData\Local\Temp\764F.tmp"77⤵PID:7004
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"78⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\7759.tmp"C:\Users\Admin\AppData\Local\Temp\7759.tmp"79⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\77F5.tmp"C:\Users\Admin\AppData\Local\Temp\77F5.tmp"80⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\7882.tmp"C:\Users\Admin\AppData\Local\Temp\7882.tmp"81⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"82⤵PID:6440
-
C:\Users\Admin\AppData\Local\Temp\799B.tmp"C:\Users\Admin\AppData\Local\Temp\799B.tmp"83⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"84⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"85⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\7B50.tmp"C:\Users\Admin\AppData\Local\Temp\7B50.tmp"86⤵PID:6324
-
C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"87⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"88⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:6976 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"90⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"91⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"92⤵PID:6240
-
C:\Users\Admin\AppData\Local\Temp\7F48.tmp"C:\Users\Admin\AppData\Local\Temp\7F48.tmp"93⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:760 -
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"95⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"96⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"97⤵PID:7116
-
C:\Users\Admin\AppData\Local\Temp\8207.tmp"C:\Users\Admin\AppData\Local\Temp\8207.tmp"98⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"99⤵PID:6508
-
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"100⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"101⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"102⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8514.tmp"C:\Users\Admin\AppData\Local\Temp\8514.tmp"103⤵PID:6640
-
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"104⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"105⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\86DA.tmp"C:\Users\Admin\AppData\Local\Temp\86DA.tmp"106⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"107⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"108⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"109⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"110⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"112⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"113⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"114⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"115⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"116⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"117⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"118⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\8D52.tmp"C:\Users\Admin\AppData\Local\Temp\8D52.tmp"119⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"120⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"121⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\8F07.tmp"C:\Users\Admin\AppData\Local\Temp\8F07.tmp"122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-