Analysis
- max time kernel
122s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe
- Size 524KB
- Sample260924-ddd97azv2j
- SHA256 1e6a35a1256774c89628a426c6584af98fb1112ef52219a69bbdee9dadf1e637
- MD5 d7556566870183e76e93ebaa1ea5cd97
- SHA1 7519e1c70048aba3633b1f054fb9d6f6fa5dc73f
- SHA512 3e37d671d30454147f8f1391bd697c3c9dc7ac080cb3f3a612cb3da8f31a5269a6024d8d87b7deb971108fe5bee53d03f6fcad7316a1390bf553b05d29e47ca4
- SSDEEP 12288:TRyZzqyL66Tz8jKGoGsSHb1jxi3Sb5tFbONZ:TRyQylTgGJG171l5FzbON
- TLSH T15EB4F126B585C032E29206764B25EBA15E3A7C76AB26A5C73BC4267D6FF03D1D374303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2760 618A.tmp 6128 6294.tmp 4212 6330.tmp 688 6439.tmp 616 6524.tmp 4048 664D.tmp 2592 66F9.tmp 3136 6821.tmp 3096 692B.tmp 4336 6A06.tmp 3080 6AD1.tmp 4992 6B9C.tmp 5124 6C77.tmp 5308 6D71.tmp 5152 6E2C.tmp 1512 6F26.tmp 960 6FF1.tmp 2000 70CC.tmp 5164 7197.tmp 3968 7272.tmp 3020 735C.tmp 1928 7437.tmp 4472 7502.tmp 1796 75DD.tmp 252 76C7.tmp 6112 7783.tmp 5084 786D.tmp 5044 7958.tmp 3928 7A32.tmp 1276 7ADE.tmp 2604 7C07.tmp 1764 7D01.tmp 784 7E3A.tmp 2888 7ED6.tmp 5804 7F63.tmp 4928 800E.tmp 3768 80AB.tmp 2388 8166.tmp 5888 81E3.tmp 2728 827F.tmp 4612 833B.tmp 4688 83C8.tmp 3048 8493.tmp 3708 855E.tmp 1900 8619.tmp 4072 86B6.tmp 4884 8790.tmp 5968 886B.tmp 5776 88F8.tmp 3328 8984.tmp 4312 89F2.tmp 4408 8A5F.tmp 464 8ADC.tmp 3716 8B3A.tmp 1492 8BB7.tmp 5668 8C34.tmp 3052 8CB1.tmp 3036 8D2E.tmp 4940 8D9B.tmp 3908 8E18.tmp 2652 8E95.tmp 5456 8F03.tmp 4604 8F80.tmp 4796 8FFD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B11C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6686.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6703.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E079.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 2760 4232 2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe 89 PID 2760 wrote to memory of 6128 2760 618A.tmp 90 PID 6128 wrote to memory of 4212 6128 6294.tmp 91 PID 4212 wrote to memory of 688 4212 6330.tmp 92 PID 688 wrote to memory of 616 688 6439.tmp 93 PID 616 wrote to memory of 4048 616 6524.tmp 94 PID 4048 wrote to memory of 2592 4048 664D.tmp 95 PID 2592 wrote to memory of 3136 2592 66F9.tmp 96 PID 3136 wrote to memory of 3096 3136 6821.tmp 97 PID 3096 wrote to memory of 4336 3096 692B.tmp 98 PID 4336 wrote to memory of 3080 4336 6A06.tmp 99 PID 3080 wrote to memory of 4992 3080 6AD1.tmp 100 PID 4992 wrote to memory of 5124 4992 6B9C.tmp 101 PID 5124 wrote to memory of 5308 5124 6C77.tmp 102 PID 5308 wrote to memory of 5152 5308 6D71.tmp 103 PID 5152 wrote to memory of 1512 5152 6E2C.tmp 104 PID 1512 wrote to memory of 960 1512 6F26.tmp 105 PID 960 wrote to memory of 2000 960 6FF1.tmp 106 PID 2000 wrote to memory of 5164 2000 70CC.tmp 107 PID 5164 wrote to memory of 3968 5164 7197.tmp 108 PID 3968 wrote to memory of 3020 3968 7272.tmp 109 PID 3020 wrote to memory of 1928 3020 735C.tmp 110 PID 1928 wrote to memory of 4472 1928 7437.tmp 111 PID 4472 wrote to memory of 1796 4472 7502.tmp 112 PID 1796 wrote to memory of 252 1796 75DD.tmp 113 PID 252 wrote to memory of 6112 252 76C7.tmp 114 PID 6112 wrote to memory of 5084 6112 7783.tmp 115 PID 5084 wrote to memory of 5044 5084 786D.tmp 116 PID 5044 wrote to memory of 3928 5044 7958.tmp 117 PID 3928 wrote to memory of 1276 3928 7A32.tmp 118 PID 1276 wrote to memory of 2604 1276 7ADE.tmp 119 PID 2604 wrote to memory of 1764 2604 7C07.tmp 120 PID 1764 wrote to memory of 784 1764 7D01.tmp 121 PID 784 wrote to memory of 2888 784 7E3A.tmp 122 PID 2888 wrote to memory of 5804 2888 7ED6.tmp 123 PID 5804 wrote to memory of 4928 5804 7F63.tmp 124 PID 4928 wrote to memory of 3768 4928 800E.tmp 125 PID 3768 wrote to memory of 2388 3768 80AB.tmp 126 PID 2388 wrote to memory of 5888 2388 8166.tmp 127 PID 5888 wrote to memory of 2728 5888 81E3.tmp 128 PID 2728 wrote to memory of 4612 2728 827F.tmp 129 PID 4612 wrote to memory of 4688 4612 833B.tmp 130 PID 4688 wrote to memory of 3048 4688 83C8.tmp 131 PID 3048 wrote to memory of 3708 3048 8493.tmp 132 PID 3708 wrote to memory of 1900 3708 855E.tmp 133 PID 1900 wrote to memory of 4072 1900 8619.tmp 134 PID 4072 wrote to memory of 4884 4072 86B6.tmp 135 PID 4884 wrote to memory of 5968 4884 8790.tmp 136 PID 5968 wrote to memory of 5776 5968 886B.tmp 137 PID 5776 wrote to memory of 3328 5776 88F8.tmp 138 PID 3328 wrote to memory of 4312 3328 8984.tmp 139 PID 4312 wrote to memory of 4408 4312 89F2.tmp 140 PID 4408 wrote to memory of 464 4408 8A5F.tmp 141 PID 464 wrote to memory of 3716 464 8ADC.tmp 142 PID 3716 wrote to memory of 1492 3716 8B3A.tmp 143 PID 1492 wrote to memory of 5668 1492 8BB7.tmp 144 PID 5668 wrote to memory of 3052 5668 8C34.tmp 145 PID 3052 wrote to memory of 3036 3052 8CB1.tmp 146 PID 3036 wrote to memory of 4940 3036 8D2E.tmp 147 PID 4940 wrote to memory of 3908 4940 8D9B.tmp 148 PID 3908 wrote to memory of 2652 3908 8E18.tmp 149 PID 2652 wrote to memory of 5456 2652 8E95.tmp 150 PID 5456 wrote to memory of 4604 5456 8F03.tmp 151 PID 4604 wrote to memory of 4796 4604 8F80.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_d7556566870183e76e93ebaa1ea5cd97_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\618A.tmp"C:\Users\Admin\AppData\Local\Temp\618A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\6294.tmp"C:\Users\Admin\AppData\Local\Temp\6294.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\6330.tmp"C:\Users\Admin\AppData\Local\Temp\6330.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\6439.tmp"C:\Users\Admin\AppData\Local\Temp\6439.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\6524.tmp"C:\Users\Admin\AppData\Local\Temp\6524.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\664D.tmp"C:\Users\Admin\AppData\Local\Temp\664D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\66F9.tmp"C:\Users\Admin\AppData\Local\Temp\66F9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\692B.tmp"C:\Users\Admin\AppData\Local\Temp\692B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\6A06.tmp"C:\Users\Admin\AppData\Local\Temp\6A06.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6C77.tmp"C:\Users\Admin\AppData\Local\Temp\6C77.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\6D71.tmp"C:\Users\Admin\AppData\Local\Temp\6D71.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\6F26.tmp"C:\Users\Admin\AppData\Local\Temp\6F26.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\70CC.tmp"C:\Users\Admin\AppData\Local\Temp\70CC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7437.tmp"C:\Users\Admin\AppData\Local\Temp\7437.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7502.tmp"C:\Users\Admin\AppData\Local\Temp\7502.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\75DD.tmp"C:\Users\Admin\AppData\Local\Temp\75DD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\76C7.tmp"C:\Users\Admin\AppData\Local\Temp\76C7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\786D.tmp"C:\Users\Admin\AppData\Local\Temp\786D.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\7958.tmp"C:\Users\Admin\AppData\Local\Temp\7958.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\7A32.tmp"C:\Users\Admin\AppData\Local\Temp\7A32.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\7ADE.tmp"C:\Users\Admin\AppData\Local\Temp\7ADE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\7C07.tmp"C:\Users\Admin\AppData\Local\Temp\7C07.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7D01.tmp"C:\Users\Admin\AppData\Local\Temp\7D01.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\800E.tmp"C:\Users\Admin\AppData\Local\Temp\800E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\80AB.tmp"C:\Users\Admin\AppData\Local\Temp\80AB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\81E3.tmp"C:\Users\Admin\AppData\Local\Temp\81E3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\827F.tmp"C:\Users\Admin\AppData\Local\Temp\827F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\833B.tmp"C:\Users\Admin\AppData\Local\Temp\833B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\83C8.tmp"C:\Users\Admin\AppData\Local\Temp\83C8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8493.tmp"C:\Users\Admin\AppData\Local\Temp\8493.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\855E.tmp"C:\Users\Admin\AppData\Local\Temp\855E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\8619.tmp"C:\Users\Admin\AppData\Local\Temp\8619.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\86B6.tmp"C:\Users\Admin\AppData\Local\Temp\86B6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8790.tmp"C:\Users\Admin\AppData\Local\Temp\8790.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\886B.tmp"C:\Users\Admin\AppData\Local\Temp\886B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\88F8.tmp"C:\Users\Admin\AppData\Local\Temp\88F8.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\8984.tmp"C:\Users\Admin\AppData\Local\Temp\8984.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\89F2.tmp"C:\Users\Admin\AppData\Local\Temp\89F2.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8B3A.tmp"C:\Users\Admin\AppData\Local\Temp\8B3A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\8C34.tmp"C:\Users\Admin\AppData\Local\Temp\8C34.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\8D9B.tmp"C:\Users\Admin\AppData\Local\Temp\8D9B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\8E18.tmp"C:\Users\Admin\AppData\Local\Temp\8E18.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\8E95.tmp"C:\Users\Admin\AppData\Local\Temp\8E95.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\8F03.tmp"C:\Users\Admin\AppData\Local\Temp\8F03.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\8F80.tmp"C:\Users\Admin\AppData\Local\Temp\8F80.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"65⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9089.tmp"C:\Users\Admin\AppData\Local\Temp\9089.tmp"66⤵PID:5268
-
C:\Users\Admin\AppData\Local\Temp\9106.tmp"C:\Users\Admin\AppData\Local\Temp\9106.tmp"67⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\9174.tmp"C:\Users\Admin\AppData\Local\Temp\9174.tmp"68⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\91D1.tmp"C:\Users\Admin\AppData\Local\Temp\91D1.tmp"69⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\923F.tmp"C:\Users\Admin\AppData\Local\Temp\923F.tmp"70⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\92BC.tmp"C:\Users\Admin\AppData\Local\Temp\92BC.tmp"71⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9329.tmp"C:\Users\Admin\AppData\Local\Temp\9329.tmp"72⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\93A6.tmp"C:\Users\Admin\AppData\Local\Temp\93A6.tmp"73⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\9433.tmp"C:\Users\Admin\AppData\Local\Temp\9433.tmp"74⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\94BF.tmp"C:\Users\Admin\AppData\Local\Temp\94BF.tmp"75⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\954C.tmp"C:\Users\Admin\AppData\Local\Temp\954C.tmp"76⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"77⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\9646.tmp"C:\Users\Admin\AppData\Local\Temp\9646.tmp"78⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"79⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"80⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"81⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\984A.tmp"C:\Users\Admin\AppData\Local\Temp\984A.tmp"82⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9963.tmp"C:\Users\Admin\AppData\Local\Temp\9963.tmp"84⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\99FF.tmp"C:\Users\Admin\AppData\Local\Temp\99FF.tmp"85⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\9A5D.tmp"C:\Users\Admin\AppData\Local\Temp\9A5D.tmp"86⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"87⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\9B47.tmp"C:\Users\Admin\AppData\Local\Temp\9B47.tmp"88⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\9BB5.tmp"C:\Users\Admin\AppData\Local\Temp\9BB5.tmp"89⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\9C32.tmp"C:\Users\Admin\AppData\Local\Temp\9C32.tmp"90⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\9CCE.tmp"C:\Users\Admin\AppData\Local\Temp\9CCE.tmp"91⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"92⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\9DB8.tmp"C:\Users\Admin\AppData\Local\Temp\9DB8.tmp"93⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9E35.tmp"C:\Users\Admin\AppData\Local\Temp\9E35.tmp"94⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"95⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\9F2F.tmp"C:\Users\Admin\AppData\Local\Temp\9F2F.tmp"96⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\9FAC.tmp"C:\Users\Admin\AppData\Local\Temp\9FAC.tmp"97⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\A029.tmp"C:\Users\Admin\AppData\Local\Temp\A029.tmp"98⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"C:\Users\Admin\AppData\Local\Temp\A0A6.tmp"99⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\A104.tmp"C:\Users\Admin\AppData\Local\Temp\A104.tmp"100⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A181.tmp"C:\Users\Admin\AppData\Local\Temp\A181.tmp"101⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\A1EE.tmp"C:\Users\Admin\AppData\Local\Temp\A1EE.tmp"102⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\A28B.tmp"C:\Users\Admin\AppData\Local\Temp\A28B.tmp"103⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\A2F8.tmp"C:\Users\Admin\AppData\Local\Temp\A2F8.tmp"104⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\A365.tmp"C:\Users\Admin\AppData\Local\Temp\A365.tmp"105⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\A3E2.tmp"C:\Users\Admin\AppData\Local\Temp\A3E2.tmp"106⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\A450.tmp"C:\Users\Admin\AppData\Local\Temp\A450.tmp"107⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\A4DC.tmp"C:\Users\Admin\AppData\Local\Temp\A4DC.tmp"108⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\A569.tmp"C:\Users\Admin\AppData\Local\Temp\A569.tmp"109⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\A5E6.tmp"C:\Users\Admin\AppData\Local\Temp\A5E6.tmp"110⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\A653.tmp"C:\Users\Admin\AppData\Local\Temp\A653.tmp"111⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\A6E0.tmp"C:\Users\Admin\AppData\Local\Temp\A6E0.tmp"112⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\A76D.tmp"C:\Users\Admin\AppData\Local\Temp\A76D.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\A809.tmp"C:\Users\Admin\AppData\Local\Temp\A809.tmp"114⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\A886.tmp"C:\Users\Admin\AppData\Local\Temp\A886.tmp"115⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A8F3.tmp"C:\Users\Admin\AppData\Local\Temp\A8F3.tmp"116⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\A980.tmp"C:\Users\Admin\AppData\Local\Temp\A980.tmp"117⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\A9FD.tmp"C:\Users\Admin\AppData\Local\Temp\A9FD.tmp"118⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\AA6A.tmp"C:\Users\Admin\AppData\Local\Temp\AA6A.tmp"119⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\AAF7.tmp"C:\Users\Admin\AppData\Local\Temp\AAF7.tmp"120⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\AB83.tmp"C:\Users\Admin\AppData\Local\Temp\AB83.tmp"121⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\AC20.tmp"C:\Users\Admin\AppData\Local\Temp\AC20.tmp"122⤵PID:5620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-