Analysis
- max time kernel
117s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_7de3234c149e9f77fb56b74cd2a68a03_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_7de3234c149e9f77fb56b74cd2a68a03_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-24_7de3234c149e9f77fb56b74cd2a68a03_elex_mafia.exe
- Size 524KB
- Sample260924-dzd7bada38
- SHA256 d9f0fd5d7fe575c387dc8ca77abd59944568283af599b1ea706816f12af18b3c
- MD5 7de3234c149e9f77fb56b74cd2a68a03
- SHA1 3210fd5995f152d5f2f0bca1343e35fa0c585283
- SHA512 59346fbd41c9df4ee89a20ee1f1d90c0e5bad9162c9952821e019ae23a6916bc26136702cc0064bd38107ab69a72ff0c1d015eb112db21dfac428fd07aa6628c
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf725bEbmShJqJfgO+fOx3TzcD6DPUR57BEFO0bsz:TRyZzqyL66T218qJIO+CwmoRVz0gNZ
- TLSH T103B4F119B544C036F69201364A26EB925D7A7DB65B2BA4CB3BC4366D2FF03D1D2B8307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2904 6BDB.tmp 4564 6CD5.tmp 2328 6DCF.tmp 4880 6EE8.tmp 2876 6FA3.tmp 3316 70FB.tmp 3980 7168.tmp 2732 7262.tmp 5056 732E.tmp 1268 7408.tmp 4720 74F3.tmp 3448 75BE.tmp 4816 7699.tmp 3784 7754.tmp 5576 781F.tmp 2840 78EA.tmp 5664 79D5.tmp 5492 7A81.tmp 4728 7B2C.tmp 5956 7C26.tmp 3156 7CF2.tmp 2304 7DEC.tmp 1180 7EF5.tmp 6044 7FB1.tmp 4420 808B.tmp 5012 8166.tmp 4332 8231.tmp 4504 82FC.tmp 1524 83B8.tmp 1472 8464.tmp 2212 853F.tmp 1092 8629.tmp 1884 8704.tmp 1056 87B0.tmp 480 889A.tmp 2104 8927.tmp 388 89B3.tmp 1144 8A30.tmp 5328 8ACC.tmp 1184 8B59.tmp 4572 8C24.tmp 4496 8CA1.tmp 4440 8D0F.tmp 5784 8DCA.tmp 5504 8E66.tmp 3428 8F31.tmp 4424 8FED.tmp 4628 90A8.tmp 4848 91F1.tmp 1508 9656.tmp 2436 96C3.tmp 5892 9740.tmp 6012 97AD.tmp 2216 982A.tmp 4640 98A7.tmp 3344 9915.tmp 4444 9992.tmp 2340 9A2E.tmp 3560 9A8C.tmp 1900 9B18.tmp 4036 9BA5.tmp 2308 9C22.tmp 4832 9C8F.tmp 6096 9D0C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E636.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2235.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D127.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F643.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 343B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2581.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3521.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A535.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A610.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 490C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 702B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A40C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D03.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2904 2616 2026-09-24_7de3234c149e9f77fb56b74cd2a68a03_elex_mafia.exe 89 PID 2904 wrote to memory of 4564 2904 6BDB.tmp 90 PID 4564 wrote to memory of 2328 4564 6CD5.tmp 91 PID 2328 wrote to memory of 4880 2328 6DCF.tmp 92 PID 4880 wrote to memory of 2876 4880 6EE8.tmp 93 PID 2876 wrote to memory of 3316 2876 6FA3.tmp 94 PID 3316 wrote to memory of 3980 3316 70FB.tmp 95 PID 3980 wrote to memory of 2732 3980 7168.tmp 96 PID 2732 wrote to memory of 5056 2732 7262.tmp 97 PID 5056 wrote to memory of 1268 5056 732E.tmp 98 PID 1268 wrote to memory of 4720 1268 7408.tmp 99 PID 4720 wrote to memory of 3448 4720 74F3.tmp 100 PID 3448 wrote to memory of 4816 3448 75BE.tmp 101 PID 4816 wrote to memory of 3784 4816 7699.tmp 102 PID 3784 wrote to memory of 5576 3784 7754.tmp 103 PID 5576 wrote to memory of 2840 5576 781F.tmp 104 PID 2840 wrote to memory of 5664 2840 78EA.tmp 105 PID 5664 wrote to memory of 5492 5664 79D5.tmp 106 PID 5492 wrote to memory of 4728 5492 7A81.tmp 107 PID 4728 wrote to memory of 5956 4728 7B2C.tmp 108 PID 5956 wrote to memory of 3156 5956 7C26.tmp 109 PID 3156 wrote to memory of 2304 3156 7CF2.tmp 110 PID 2304 wrote to memory of 1180 2304 7DEC.tmp 111 PID 1180 wrote to memory of 6044 1180 7EF5.tmp 112 PID 6044 wrote to memory of 4420 6044 7FB1.tmp 113 PID 4420 wrote to memory of 5012 4420 808B.tmp 114 PID 5012 wrote to memory of 4332 5012 8166.tmp 115 PID 4332 wrote to memory of 4504 4332 8231.tmp 116 PID 4504 wrote to memory of 1524 4504 82FC.tmp 117 PID 1524 wrote to memory of 1472 1524 83B8.tmp 118 PID 1472 wrote to memory of 2212 1472 8464.tmp 119 PID 2212 wrote to memory of 1092 2212 853F.tmp 120 PID 1092 wrote to memory of 1884 1092 8629.tmp 121 PID 1884 wrote to memory of 1056 1884 8704.tmp 122 PID 1056 wrote to memory of 480 1056 87B0.tmp 123 PID 480 wrote to memory of 2104 480 889A.tmp 124 PID 2104 wrote to memory of 388 2104 8927.tmp 125 PID 388 wrote to memory of 1144 388 89B3.tmp 126 PID 1144 wrote to memory of 5328 1144 8A30.tmp 127 PID 5328 wrote to memory of 1184 5328 8ACC.tmp 128 PID 1184 wrote to memory of 4572 1184 8B59.tmp 129 PID 4572 wrote to memory of 4496 4572 8C24.tmp 130 PID 4496 wrote to memory of 4440 4496 8CA1.tmp 131 PID 4440 wrote to memory of 5784 4440 8D0F.tmp 132 PID 5784 wrote to memory of 5504 5784 8DCA.tmp 133 PID 5504 wrote to memory of 3428 5504 8E66.tmp 134 PID 3428 wrote to memory of 4424 3428 8F31.tmp 135 PID 4424 wrote to memory of 4628 4424 8FED.tmp 136 PID 5436 wrote to memory of 4848 5436 9145.tmp 138 PID 4848 wrote to memory of 1508 4848 91F1.tmp 139 PID 1508 wrote to memory of 2436 1508 9656.tmp 140 PID 2436 wrote to memory of 5892 2436 96C3.tmp 141 PID 5892 wrote to memory of 6012 5892 9740.tmp 142 PID 6012 wrote to memory of 2216 6012 97AD.tmp 143 PID 2216 wrote to memory of 4640 2216 982A.tmp 144 PID 4640 wrote to memory of 3344 4640 98A7.tmp 145 PID 3344 wrote to memory of 4444 3344 9915.tmp 146 PID 4444 wrote to memory of 2340 4444 9992.tmp 147 PID 2340 wrote to memory of 3560 2340 9A2E.tmp 148 PID 3560 wrote to memory of 1900 3560 9A8C.tmp 149 PID 1900 wrote to memory of 4036 1900 9B18.tmp 150 PID 4036 wrote to memory of 2308 4036 9BA5.tmp 151 PID 2308 wrote to memory of 4832 2308 9C22.tmp 152 PID 4832 wrote to memory of 6096 4832 9C8F.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_7de3234c149e9f77fb56b74cd2a68a03_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_7de3234c149e9f77fb56b74cd2a68a03_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6DCF.tmp"C:\Users\Admin\AppData\Local\Temp\6DCF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6EE8.tmp"C:\Users\Admin\AppData\Local\Temp\6EE8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\7168.tmp"C:\Users\Admin\AppData\Local\Temp\7168.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\732E.tmp"C:\Users\Admin\AppData\Local\Temp\732E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7408.tmp"C:\Users\Admin\AppData\Local\Temp\7408.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\74F3.tmp"C:\Users\Admin\AppData\Local\Temp\74F3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\75BE.tmp"C:\Users\Admin\AppData\Local\Temp\75BE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\7699.tmp"C:\Users\Admin\AppData\Local\Temp\7699.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\7754.tmp"C:\Users\Admin\AppData\Local\Temp\7754.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\781F.tmp"C:\Users\Admin\AppData\Local\Temp\781F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\78EA.tmp"C:\Users\Admin\AppData\Local\Temp\78EA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\7A81.tmp"C:\Users\Admin\AppData\Local\Temp\7A81.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"C:\Users\Admin\AppData\Local\Temp\7B2C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\7C26.tmp"C:\Users\Admin\AppData\Local\Temp\7C26.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"C:\Users\Admin\AppData\Local\Temp\7FB1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\808B.tmp"C:\Users\Admin\AppData\Local\Temp\808B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\8231.tmp"C:\Users\Admin\AppData\Local\Temp\8231.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\82FC.tmp"C:\Users\Admin\AppData\Local\Temp\82FC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\83B8.tmp"C:\Users\Admin\AppData\Local\Temp\83B8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\8464.tmp"C:\Users\Admin\AppData\Local\Temp\8464.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\853F.tmp"C:\Users\Admin\AppData\Local\Temp\853F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\8629.tmp"C:\Users\Admin\AppData\Local\Temp\8629.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\87B0.tmp"C:\Users\Admin\AppData\Local\Temp\87B0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\889A.tmp"C:\Users\Admin\AppData\Local\Temp\889A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\8927.tmp"C:\Users\Admin\AppData\Local\Temp\8927.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\89B3.tmp"C:\Users\Admin\AppData\Local\Temp\89B3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\8A30.tmp"C:\Users\Admin\AppData\Local\Temp\8A30.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\8B59.tmp"C:\Users\Admin\AppData\Local\Temp\8B59.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\8C24.tmp"C:\Users\Admin\AppData\Local\Temp\8C24.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"C:\Users\Admin\AppData\Local\Temp\8CA1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\8D0F.tmp"C:\Users\Admin\AppData\Local\Temp\8D0F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8DCA.tmp"C:\Users\Admin\AppData\Local\Temp\8DCA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\8E66.tmp"C:\Users\Admin\AppData\Local\Temp\8E66.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\8F31.tmp"C:\Users\Admin\AppData\Local\Temp\8F31.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\8FED.tmp"C:\Users\Admin\AppData\Local\Temp\8FED.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\90A8.tmp"C:\Users\Admin\AppData\Local\Temp\90A8.tmp"49⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\9145.tmp"C:\Users\Admin\AppData\Local\Temp\9145.tmp"50⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\91F1.tmp"C:\Users\Admin\AppData\Local\Temp\91F1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\9915.tmp"C:\Users\Admin\AppData\Local\Temp\9915.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\9992.tmp"C:\Users\Admin\AppData\Local\Temp\9992.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9A2E.tmp"C:\Users\Admin\AppData\Local\Temp\9A2E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9A8C.tmp"C:\Users\Admin\AppData\Local\Temp\9A8C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\9B18.tmp"C:\Users\Admin\AppData\Local\Temp\9B18.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\9C22.tmp"C:\Users\Admin\AppData\Local\Temp\9C22.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9C8F.tmp"C:\Users\Admin\AppData\Local\Temp\9C8F.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9D0C.tmp"C:\Users\Admin\AppData\Local\Temp\9D0C.tmp"66⤵
- Executes dropped EXE
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\9D99.tmp"C:\Users\Admin\AppData\Local\Temp\9D99.tmp"67⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\9E16.tmp"C:\Users\Admin\AppData\Local\Temp\9E16.tmp"68⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"C:\Users\Admin\AppData\Local\Temp\9EB2.tmp"69⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\9F20.tmp"C:\Users\Admin\AppData\Local\Temp\9F20.tmp"70⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\9FAC.tmp"C:\Users\Admin\AppData\Local\Temp\9FAC.tmp"71⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A029.tmp"C:\Users\Admin\AppData\Local\Temp\A029.tmp"72⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\A0B6.tmp"C:\Users\Admin\AppData\Local\Temp\A0B6.tmp"73⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\A152.tmp"C:\Users\Admin\AppData\Local\Temp\A152.tmp"74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\A1CF.tmp"C:\Users\Admin\AppData\Local\Temp\A1CF.tmp"75⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\A25C.tmp"C:\Users\Admin\AppData\Local\Temp\A25C.tmp"76⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\A308.tmp"C:\Users\Admin\AppData\Local\Temp\A308.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A394.tmp"C:\Users\Admin\AppData\Local\Temp\A394.tmp"78⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A450.tmp"C:\Users\Admin\AppData\Local\Temp\A450.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\A4CD.tmp"C:\Users\Admin\AppData\Local\Temp\A4CD.tmp"80⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\A54A.tmp"C:\Users\Admin\AppData\Local\Temp\A54A.tmp"81⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\A615.tmp"C:\Users\Admin\AppData\Local\Temp\A615.tmp"82⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\A6A1.tmp"C:\Users\Admin\AppData\Local\Temp\A6A1.tmp"83⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\A72E.tmp"C:\Users\Admin\AppData\Local\Temp\A72E.tmp"84⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\A7BB.tmp"C:\Users\Admin\AppData\Local\Temp\A7BB.tmp"85⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\A838.tmp"C:\Users\Admin\AppData\Local\Temp\A838.tmp"86⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"C:\Users\Admin\AppData\Local\Temp\A8B5.tmp"87⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\A932.tmp"C:\Users\Admin\AppData\Local\Temp\A932.tmp"88⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A9AF.tmp"C:\Users\Admin\AppData\Local\Temp\A9AF.tmp"89⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\AA2C.tmp"C:\Users\Admin\AppData\Local\Temp\AA2C.tmp"90⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\AA99.tmp"C:\Users\Admin\AppData\Local\Temp\AA99.tmp"91⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\AB16.tmp"C:\Users\Admin\AppData\Local\Temp\AB16.tmp"92⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"C:\Users\Admin\AppData\Local\Temp\ABA3.tmp"93⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\AC20.tmp"C:\Users\Admin\AppData\Local\Temp\AC20.tmp"94⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\AC9D.tmp"C:\Users\Admin\AppData\Local\Temp\AC9D.tmp"95⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"96⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\ADB6.tmp"C:\Users\Admin\AppData\Local\Temp\ADB6.tmp"97⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\AE23.tmp"C:\Users\Admin\AppData\Local\Temp\AE23.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\AEC0.tmp"C:\Users\Admin\AppData\Local\Temp\AEC0.tmp"99⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\AF4C.tmp"C:\Users\Admin\AppData\Local\Temp\AF4C.tmp"100⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\AFD9.tmp"C:\Users\Admin\AppData\Local\Temp\AFD9.tmp"101⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\B046.tmp"C:\Users\Admin\AppData\Local\Temp\B046.tmp"102⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\B0C3.tmp"C:\Users\Admin\AppData\Local\Temp\B0C3.tmp"103⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\B150.tmp"C:\Users\Admin\AppData\Local\Temp\B150.tmp"104⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\B1CD.tmp"C:\Users\Admin\AppData\Local\Temp\B1CD.tmp"105⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\B259.tmp"C:\Users\Admin\AppData\Local\Temp\B259.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B2D6.tmp"C:\Users\Admin\AppData\Local\Temp\B2D6.tmp"107⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\B363.tmp"C:\Users\Admin\AppData\Local\Temp\B363.tmp"108⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\B3E0.tmp"C:\Users\Admin\AppData\Local\Temp\B3E0.tmp"109⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\B46D.tmp"C:\Users\Admin\AppData\Local\Temp\B46D.tmp"110⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\B509.tmp"C:\Users\Admin\AppData\Local\Temp\B509.tmp"111⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\B5A5.tmp"C:\Users\Admin\AppData\Local\Temp\B5A5.tmp"112⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\B641.tmp"C:\Users\Admin\AppData\Local\Temp\B641.tmp"113⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\B6CE.tmp"C:\Users\Admin\AppData\Local\Temp\B6CE.tmp"114⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\B75B.tmp"C:\Users\Admin\AppData\Local\Temp\B75B.tmp"115⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\B807.tmp"C:\Users\Admin\AppData\Local\Temp\B807.tmp"116⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\B893.tmp"C:\Users\Admin\AppData\Local\Temp\B893.tmp"117⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\B920.tmp"C:\Users\Admin\AppData\Local\Temp\B920.tmp"118⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\B98D.tmp"C:\Users\Admin\AppData\Local\Temp\B98D.tmp"119⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\BA1A.tmp"C:\Users\Admin\AppData\Local\Temp\BA1A.tmp"120⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\BA97.tmp"C:\Users\Admin\AppData\Local\Temp\BA97.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\BB04.tmp"C:\Users\Admin\AppData\Local\Temp\BB04.tmp"122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-