Analysis
- max time kernel
124s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_6c5b381b954ae2de4cc4f8d975880114_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_6c5b381b954ae2de4cc4f8d975880114_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-24_6c5b381b954ae2de4cc4f8d975880114_elex_mafia.exe
- Size 520KB
- Sample260924-d5kw2sdb74
- SHA256 5a5f2375fd4c916ea80d4a5b9b54068c4c16ad2e5771177cb3bc6ac5021e1edb
- MD5 6c5b381b954ae2de4cc4f8d975880114
- SHA1 8f7f636ccf66f476f0375b489c109af518290cef
- SHA512 c44b9fd70f3f4ee3fa1c68674569035348472530c00a7e91346f7df403c4d98b269f7163a8277e843b37b6b99e7ae9ce62b3c261b6940049780c2bf3178c36ca
- SSDEEP 12288:gj8fuxR21t5i8fQXrFZF1cSdO2CDh0zUMNZ:gj8fuK1GYuZFCkK0zUMN
- TLSH T186B4F111B648C033E9A715308A55DBA11BBE7C765B3686C73BC036AD6FB62C1D63831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1452 67F7.tmp 5176 6901.tmp 3560 6A2A.tmp 5732 6AD6.tmp 2620 6B53.tmp 3824 6C0E.tmp 1992 6C8B.tmp 4960 6D27.tmp 280 6DF3.tmp 2432 6E8F.tmp 2892 6F2B.tmp 4536 6FA8.tmp 2716 7054.tmp 5092 70E1.tmp 5756 717D.tmp 696 7229.tmp 4412 72D5.tmp 4920 7380.tmp 4364 742C.tmp 1264 74D8.tmp 420 75A3.tmp 5924 7620.tmp 1456 769D.tmp 804 7749.tmp 3104 77E5.tmp 2988 7872.tmp 3364 78EF.tmp 3548 797C.tmp 2712 7A18.tmp 5748 7A95.tmp 1420 7B31.tmp 3436 7C2B.tmp 2612 7CC7.tmp 4300 7D54.tmp 936 7DB2.tmp 6104 7E1F.tmp 2592 7E9C.tmp 572 7F0A.tmp 5172 7F67.tmp 2600 7FE4.tmp 4160 8061.tmp 3160 80EE.tmp 3336 817B.tmp 1152 81E8.tmp 5816 8265.tmp 2668 82F2.tmp 5768 836F.tmp 6080 841A.tmp 4740 8469.tmp 2064 84E6.tmp 4608 8553.tmp 1040 85E0.tmp 720 867C.tmp 2876 86F9.tmp 4356 8776.tmp 3000 87E3.tmp 2056 8860.tmp 5696 88ED.tmp 4672 896A.tmp 1516 89F6.tmp 3608 8A93.tmp 4944 8B00.tmp 4892 8B7D.tmp 1912 8C29.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5787.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F07C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 611D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 841A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3BD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4264 wrote to memory of 1452 4264 2026-09-24_6c5b381b954ae2de4cc4f8d975880114_elex_mafia.exe 89 PID 1452 wrote to memory of 5176 1452 67F7.tmp 90 PID 5176 wrote to memory of 3560 5176 6901.tmp 91 PID 3560 wrote to memory of 5732 3560 6A2A.tmp 92 PID 5732 wrote to memory of 2620 5732 6AD6.tmp 93 PID 2620 wrote to memory of 3824 2620 6B53.tmp 94 PID 3824 wrote to memory of 1992 3824 6C0E.tmp 95 PID 1992 wrote to memory of 4960 1992 6C8B.tmp 96 PID 4960 wrote to memory of 280 4960 6D27.tmp 97 PID 280 wrote to memory of 2432 280 6DF3.tmp 98 PID 2432 wrote to memory of 2892 2432 6E8F.tmp 99 PID 2892 wrote to memory of 4536 2892 6F2B.tmp 100 PID 4536 wrote to memory of 2716 4536 6FA8.tmp 101 PID 2716 wrote to memory of 5092 2716 7054.tmp 102 PID 5092 wrote to memory of 5756 5092 70E1.tmp 103 PID 5756 wrote to memory of 696 5756 717D.tmp 104 PID 696 wrote to memory of 4412 696 7229.tmp 105 PID 4412 wrote to memory of 4920 4412 72D5.tmp 106 PID 4920 wrote to memory of 4364 4920 7380.tmp 107 PID 4364 wrote to memory of 1264 4364 742C.tmp 108 PID 1264 wrote to memory of 420 1264 74D8.tmp 109 PID 420 wrote to memory of 5924 420 75A3.tmp 110 PID 5924 wrote to memory of 1456 5924 7620.tmp 111 PID 1456 wrote to memory of 804 1456 769D.tmp 112 PID 804 wrote to memory of 3104 804 7749.tmp 113 PID 3104 wrote to memory of 2988 3104 77E5.tmp 114 PID 2988 wrote to memory of 3364 2988 7872.tmp 115 PID 3364 wrote to memory of 3548 3364 78EF.tmp 116 PID 3548 wrote to memory of 2712 3548 797C.tmp 117 PID 2712 wrote to memory of 5748 2712 7A18.tmp 118 PID 5748 wrote to memory of 1420 5748 7A95.tmp 119 PID 1420 wrote to memory of 3436 1420 7B31.tmp 120 PID 3436 wrote to memory of 2612 3436 7C2B.tmp 121 PID 2612 wrote to memory of 4300 2612 7CC7.tmp 122 PID 4300 wrote to memory of 936 4300 7D54.tmp 123 PID 936 wrote to memory of 6104 936 7DB2.tmp 124 PID 6104 wrote to memory of 2592 6104 7E1F.tmp 125 PID 2592 wrote to memory of 572 2592 7E9C.tmp 126 PID 572 wrote to memory of 5172 572 7F0A.tmp 127 PID 5172 wrote to memory of 2600 5172 7F67.tmp 128 PID 2600 wrote to memory of 4160 2600 7FE4.tmp 129 PID 4160 wrote to memory of 3160 4160 8061.tmp 130 PID 3160 wrote to memory of 3336 3160 80EE.tmp 131 PID 3336 wrote to memory of 1152 3336 817B.tmp 132 PID 1152 wrote to memory of 5816 1152 81E8.tmp 133 PID 5816 wrote to memory of 2668 5816 8265.tmp 134 PID 2668 wrote to memory of 5768 2668 82F2.tmp 135 PID 5768 wrote to memory of 6080 5768 836F.tmp 136 PID 6080 wrote to memory of 4740 6080 841A.tmp 137 PID 4740 wrote to memory of 2064 4740 8469.tmp 138 PID 2064 wrote to memory of 4608 2064 84E6.tmp 139 PID 4608 wrote to memory of 1040 4608 8553.tmp 140 PID 1040 wrote to memory of 720 1040 85E0.tmp 141 PID 720 wrote to memory of 2876 720 867C.tmp 142 PID 2876 wrote to memory of 4356 2876 86F9.tmp 143 PID 4356 wrote to memory of 3000 4356 8776.tmp 144 PID 3000 wrote to memory of 2056 3000 87E3.tmp 145 PID 2056 wrote to memory of 5696 2056 8860.tmp 146 PID 5696 wrote to memory of 4672 5696 88ED.tmp 147 PID 4672 wrote to memory of 1516 4672 896A.tmp 148 PID 1516 wrote to memory of 3608 1516 89F6.tmp 149 PID 3608 wrote to memory of 4944 3608 8A93.tmp 150 PID 4944 wrote to memory of 4892 4944 8B00.tmp 151 PID 4892 wrote to memory of 1912 4892 8B7D.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_6c5b381b954ae2de4cc4f8d975880114_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_6c5b381b954ae2de4cc4f8d975880114_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\6B53.tmp"C:\Users\Admin\AppData\Local\Temp\6B53.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\70E1.tmp"C:\Users\Admin\AppData\Local\Temp\70E1.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\7380.tmp"C:\Users\Admin\AppData\Local\Temp\7380.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\742C.tmp"C:\Users\Admin\AppData\Local\Temp\742C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\75A3.tmp"C:\Users\Admin\AppData\Local\Temp\75A3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\769D.tmp"C:\Users\Admin\AppData\Local\Temp\769D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\7A95.tmp"C:\Users\Admin\AppData\Local\Temp\7A95.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\80EE.tmp"C:\Users\Admin\AppData\Local\Temp\80EE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\81E8.tmp"C:\Users\Admin\AppData\Local\Temp\81E8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\841A.tmp"C:\Users\Admin\AppData\Local\Temp\841A.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\8553.tmp"C:\Users\Admin\AppData\Local\Temp\8553.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\8776.tmp"C:\Users\Admin\AppData\Local\Temp\8776.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\896A.tmp"C:\Users\Admin\AppData\Local\Temp\896A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\89F6.tmp"C:\Users\Admin\AppData\Local\Temp\89F6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"65⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"66⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"68⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"69⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"70⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"71⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"72⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"73⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\90CC.tmp"C:\Users\Admin\AppData\Local\Temp\90CC.tmp"74⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"75⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"76⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\9253.tmp"C:\Users\Admin\AppData\Local\Temp\9253.tmp"77⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\92D0.tmp"C:\Users\Admin\AppData\Local\Temp\92D0.tmp"78⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\933D.tmp"C:\Users\Admin\AppData\Local\Temp\933D.tmp"79⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"80⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\9428.tmp"C:\Users\Admin\AppData\Local\Temp\9428.tmp"81⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"82⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"83⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"84⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\961C.tmp"C:\Users\Admin\AppData\Local\Temp\961C.tmp"85⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"86⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\97A2.tmp"C:\Users\Admin\AppData\Local\Temp\97A2.tmp"88⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"89⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"91⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\9977.tmp"C:\Users\Admin\AppData\Local\Temp\9977.tmp"92⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"93⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"94⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"95⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"96⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"97⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"98⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"99⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"100⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"C:\Users\Admin\AppData\Local\Temp\9DBD.tmp"101⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"102⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"103⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"104⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"105⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"106⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"107⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"108⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\A222.tmp"C:\Users\Admin\AppData\Local\Temp\A222.tmp"109⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:780 -
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"111⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"112⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\A416.tmp"C:\Users\Admin\AppData\Local\Temp\A416.tmp"113⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"114⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\A520.tmp"C:\Users\Admin\AppData\Local\Temp\A520.tmp"115⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"116⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"117⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\A658.tmp"C:\Users\Admin\AppData\Local\Temp\A658.tmp"118⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"119⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\A733.tmp"C:\Users\Admin\AppData\Local\Temp\A733.tmp"120⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"121⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\A80E.tmp"C:\Users\Admin\AppData\Local\Temp\A80E.tmp"122⤵PID:6116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-