Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_d2fcae71f9bae8e325d7068e2496b27f_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_d2fcae71f9bae8e325d7068e2496b27f_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_d2fcae71f9bae8e325d7068e2496b27f_elex_mafia.exe
- Size 560KB
- Sample260930-jgfkbayeld
- SHA256 ddf055da9bc0b85dfb71923f5d06acf485dac782cc689a3f5a75a7cfc1ac397d
- MD5 d2fcae71f9bae8e325d7068e2496b27f
- SHA1 7773b0cacbf937bc21ab6ad49326367ee50516e7
- SHA512 0a5b9076104e606bc547abec3d751d797c853b4d0cbe969cde7cbc25d2c18c9b2889c492683dee31ab92e6e6c34779081f3f028a6c3bdb8bdc83d9dca60a71d6
- SSDEEP 12288:MlFXOQUDmrC8S3jFY52zahpJZJrQpY5y3PRen8GIFdIZxV:MlUQbC8SzFglrJa48dIR
- TLSH T1E7C4F0127284C0B3E6D301304A56DB625B3B7C725B3A61C77B94266EAFB43D1EA7434B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4932 3F8B.tmp 668 4085.tmp 6068 41BD.tmp 5584 42E6.tmp 2776 4392.tmp 5876 440F.tmp 1084 45A5.tmp 824 4799.tmp 3304 48D2.tmp 4968 49CC.tmp 5688 4AA7.tmp 1400 4BB0.tmp 3060 4CAA.tmp 4192 4DC3.tmp 5516 4EEC.tmp 5576 4FE6.tmp 3712 511F.tmp 2280 52B5.tmp 4876 53DE.tmp 3440 54F7.tmp 5972 5620.tmp 3468 5739.tmp 3476 5824.tmp 4532 591E.tmp 4636 59E9.tmp 4572 5B50.tmp 5208 5C69.tmp 1944 5DA2.tmp 3392 5E9C.tmp 5324 5F96.tmp 3428 60CE.tmp 2784 6207.tmp 2108 633F.tmp 4736 63CC.tmp 4304 6488.tmp 5840 6533.tmp 828 661E.tmp 1124 66BA.tmp 1420 6795.tmp 4276 6C67.tmp 5048 6D52.tmp 4308 6E3C.tmp 564 6F17.tmp 5524 6FF1.tmp 2892 70FB.tmp 3580 71A7.tmp 2972 7262.tmp 5984 736C.tmp 5452 7418.tmp 5344 74C4.tmp 764 7550.tmp 5152 75CD.tmp 3296 765A.tmp 4496 76E7.tmp 2800 7764.tmp 2900 7800.tmp 1044 787D.tmp 6016 78EA.tmp 4052 7967.tmp 4364 79F4.tmp 4352 7A81.tmp 4712 7B0D.tmp 756 7BC9.tmp 2680 7C84.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 269F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F32B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 265C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 487F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B65C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 568 wrote to memory of 4932 568 2026-09-30_d2fcae71f9bae8e325d7068e2496b27f_elex_mafia.exe 90 PID 4932 wrote to memory of 668 4932 3F8B.tmp 91 PID 668 wrote to memory of 6068 668 4085.tmp 92 PID 6068 wrote to memory of 5584 6068 41BD.tmp 93 PID 5584 wrote to memory of 2776 5584 42E6.tmp 94 PID 2776 wrote to memory of 5876 2776 4392.tmp 95 PID 5876 wrote to memory of 1084 5876 440F.tmp 96 PID 1084 wrote to memory of 824 1084 45A5.tmp 97 PID 824 wrote to memory of 3304 824 4799.tmp 98 PID 3304 wrote to memory of 4968 3304 48D2.tmp 99 PID 4968 wrote to memory of 5688 4968 49CC.tmp 100 PID 5688 wrote to memory of 1400 5688 4AA7.tmp 101 PID 1400 wrote to memory of 3060 1400 4BB0.tmp 102 PID 3060 wrote to memory of 4192 3060 4CAA.tmp 103 PID 4192 wrote to memory of 5516 4192 4DC3.tmp 104 PID 5516 wrote to memory of 5576 5516 4EEC.tmp 105 PID 5576 wrote to memory of 3712 5576 4FE6.tmp 106 PID 3712 wrote to memory of 2280 3712 511F.tmp 107 PID 2280 wrote to memory of 4876 2280 52B5.tmp 108 PID 4876 wrote to memory of 3440 4876 53DE.tmp 109 PID 3440 wrote to memory of 5972 3440 54F7.tmp 110 PID 5972 wrote to memory of 3468 5972 5620.tmp 111 PID 3468 wrote to memory of 3476 3468 5739.tmp 112 PID 3476 wrote to memory of 4532 3476 5824.tmp 113 PID 4532 wrote to memory of 4636 4532 591E.tmp 114 PID 4636 wrote to memory of 4572 4636 59E9.tmp 115 PID 4572 wrote to memory of 5208 4572 5B50.tmp 116 PID 5208 wrote to memory of 1944 5208 5C69.tmp 117 PID 1944 wrote to memory of 3392 1944 5DA2.tmp 118 PID 3392 wrote to memory of 5324 3392 5E9C.tmp 119 PID 5324 wrote to memory of 3428 5324 5F96.tmp 120 PID 3428 wrote to memory of 2784 3428 60CE.tmp 121 PID 2784 wrote to memory of 2108 2784 6207.tmp 122 PID 2108 wrote to memory of 4736 2108 633F.tmp 123 PID 4736 wrote to memory of 4304 4736 63CC.tmp 124 PID 4304 wrote to memory of 5840 4304 6488.tmp 125 PID 5840 wrote to memory of 828 5840 6533.tmp 126 PID 828 wrote to memory of 1124 828 661E.tmp 127 PID 1124 wrote to memory of 1420 1124 66BA.tmp 128 PID 1420 wrote to memory of 4276 1420 6795.tmp 129 PID 4276 wrote to memory of 5048 4276 6C67.tmp 130 PID 5048 wrote to memory of 4308 5048 6D52.tmp 131 PID 4308 wrote to memory of 564 4308 6E3C.tmp 132 PID 564 wrote to memory of 5524 564 6F17.tmp 133 PID 5524 wrote to memory of 2892 5524 6FF1.tmp 134 PID 2892 wrote to memory of 3580 2892 70FB.tmp 135 PID 3580 wrote to memory of 2972 3580 71A7.tmp 136 PID 2972 wrote to memory of 5984 2972 7262.tmp 137 PID 5984 wrote to memory of 5452 5984 736C.tmp 138 PID 5452 wrote to memory of 5344 5452 7418.tmp 139 PID 5344 wrote to memory of 764 5344 74C4.tmp 140 PID 764 wrote to memory of 5152 764 7550.tmp 141 PID 5152 wrote to memory of 3296 5152 75CD.tmp 142 PID 3296 wrote to memory of 4496 3296 765A.tmp 143 PID 4496 wrote to memory of 2800 4496 76E7.tmp 144 PID 2800 wrote to memory of 2900 2800 7764.tmp 145 PID 2900 wrote to memory of 1044 2900 7800.tmp 146 PID 1044 wrote to memory of 6016 1044 787D.tmp 147 PID 6016 wrote to memory of 4052 6016 78EA.tmp 148 PID 4052 wrote to memory of 4364 4052 7967.tmp 149 PID 4364 wrote to memory of 4352 4364 79F4.tmp 150 PID 4352 wrote to memory of 4712 4352 7A81.tmp 151 PID 4712 wrote to memory of 756 4712 7B0D.tmp 152 PID 756 wrote to memory of 2680 756 7BC9.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_d2fcae71f9bae8e325d7068e2496b27f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_d2fcae71f9bae8e325d7068e2496b27f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4085.tmp"C:\Users\Admin\AppData\Local\Temp\4085.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\41BD.tmp"C:\Users\Admin\AppData\Local\Temp\41BD.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\4392.tmp"C:\Users\Admin\AppData\Local\Temp\4392.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\440F.tmp"C:\Users\Admin\AppData\Local\Temp\440F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\45A5.tmp"C:\Users\Admin\AppData\Local\Temp\45A5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\4799.tmp"C:\Users\Admin\AppData\Local\Temp\4799.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\48D2.tmp"C:\Users\Admin\AppData\Local\Temp\48D2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4DC3.tmp"C:\Users\Admin\AppData\Local\Temp\4DC3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4EEC.tmp"C:\Users\Admin\AppData\Local\Temp\4EEC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"C:\Users\Admin\AppData\Local\Temp\4FE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\511F.tmp"C:\Users\Admin\AppData\Local\Temp\511F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\52B5.tmp"C:\Users\Admin\AppData\Local\Temp\52B5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\53DE.tmp"C:\Users\Admin\AppData\Local\Temp\53DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\54F7.tmp"C:\Users\Admin\AppData\Local\Temp\54F7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\5620.tmp"C:\Users\Admin\AppData\Local\Temp\5620.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\5739.tmp"C:\Users\Admin\AppData\Local\Temp\5739.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\5824.tmp"C:\Users\Admin\AppData\Local\Temp\5824.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\591E.tmp"C:\Users\Admin\AppData\Local\Temp\591E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\59E9.tmp"C:\Users\Admin\AppData\Local\Temp\59E9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5B50.tmp"C:\Users\Admin\AppData\Local\Temp\5B50.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\5C69.tmp"C:\Users\Admin\AppData\Local\Temp\5C69.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5F96.tmp"C:\Users\Admin\AppData\Local\Temp\5F96.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\60CE.tmp"C:\Users\Admin\AppData\Local\Temp\60CE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\6207.tmp"C:\Users\Admin\AppData\Local\Temp\6207.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\633F.tmp"C:\Users\Admin\AppData\Local\Temp\633F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\63CC.tmp"C:\Users\Admin\AppData\Local\Temp\63CC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6488.tmp"C:\Users\Admin\AppData\Local\Temp\6488.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\6533.tmp"C:\Users\Admin\AppData\Local\Temp\6533.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\661E.tmp"C:\Users\Admin\AppData\Local\Temp\661E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\66BA.tmp"C:\Users\Admin\AppData\Local\Temp\66BA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\6795.tmp"C:\Users\Admin\AppData\Local\Temp\6795.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\6C67.tmp"C:\Users\Admin\AppData\Local\Temp\6C67.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\6D52.tmp"C:\Users\Admin\AppData\Local\Temp\6D52.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6F17.tmp"C:\Users\Admin\AppData\Local\Temp\6F17.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\736C.tmp"C:\Users\Admin\AppData\Local\Temp\736C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\7418.tmp"C:\Users\Admin\AppData\Local\Temp\7418.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\74C4.tmp"C:\Users\Admin\AppData\Local\Temp\74C4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\7550.tmp"C:\Users\Admin\AppData\Local\Temp\7550.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\75CD.tmp"C:\Users\Admin\AppData\Local\Temp\75CD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\765A.tmp"C:\Users\Admin\AppData\Local\Temp\765A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\76E7.tmp"C:\Users\Admin\AppData\Local\Temp\76E7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\7764.tmp"C:\Users\Admin\AppData\Local\Temp\7764.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\7800.tmp"C:\Users\Admin\AppData\Local\Temp\7800.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\787D.tmp"C:\Users\Admin\AppData\Local\Temp\787D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\78EA.tmp"C:\Users\Admin\AppData\Local\Temp\78EA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\7967.tmp"C:\Users\Admin\AppData\Local\Temp\7967.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\79F4.tmp"C:\Users\Admin\AppData\Local\Temp\79F4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7A81.tmp"C:\Users\Admin\AppData\Local\Temp\7A81.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"C:\Users\Admin\AppData\Local\Temp\7BC9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\7C84.tmp"C:\Users\Admin\AppData\Local\Temp\7C84.tmp"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\7D11.tmp"C:\Users\Admin\AppData\Local\Temp\7D11.tmp"66⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"67⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"68⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"69⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\7F43.tmp"C:\Users\Admin\AppData\Local\Temp\7F43.tmp"70⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"71⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\803D.tmp"C:\Users\Admin\AppData\Local\Temp\803D.tmp"72⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\80E9.tmp"C:\Users\Admin\AppData\Local\Temp\80E9.tmp"73⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\8176.tmp"C:\Users\Admin\AppData\Local\Temp\8176.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\81E3.tmp"C:\Users\Admin\AppData\Local\Temp\81E3.tmp"75⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\827F.tmp"C:\Users\Admin\AppData\Local\Temp\827F.tmp"76⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\82FC.tmp"C:\Users\Admin\AppData\Local\Temp\82FC.tmp"77⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\8389.tmp"C:\Users\Admin\AppData\Local\Temp\8389.tmp"78⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\8425.tmp"C:\Users\Admin\AppData\Local\Temp\8425.tmp"79⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\84D1.tmp"C:\Users\Admin\AppData\Local\Temp\84D1.tmp"80⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\856D.tmp"C:\Users\Admin\AppData\Local\Temp\856D.tmp"81⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\85EA.tmp"C:\Users\Admin\AppData\Local\Temp\85EA.tmp"82⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\8687.tmp"C:\Users\Admin\AppData\Local\Temp\8687.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"84⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\8790.tmp"C:\Users\Admin\AppData\Local\Temp\8790.tmp"85⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\882D.tmp"C:\Users\Admin\AppData\Local\Temp\882D.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:868 -
C:\Users\Admin\AppData\Local\Temp\88C9.tmp"C:\Users\Admin\AppData\Local\Temp\88C9.tmp"87⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\8965.tmp"C:\Users\Admin\AppData\Local\Temp\8965.tmp"88⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\89F2.tmp"C:\Users\Admin\AppData\Local\Temp\89F2.tmp"89⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"C:\Users\Admin\AppData\Local\Temp\8A6F.tmp"90⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"C:\Users\Admin\AppData\Local\Temp\8ADC.tmp"91⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"92⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\8C34.tmp"C:\Users\Admin\AppData\Local\Temp\8C34.tmp"93⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\8CD0.tmp"C:\Users\Admin\AppData\Local\Temp\8CD0.tmp"94⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\8D5D.tmp"C:\Users\Admin\AppData\Local\Temp\8D5D.tmp"95⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"96⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\8E47.tmp"C:\Users\Admin\AppData\Local\Temp\8E47.tmp"97⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"99⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8FDD.tmp"C:\Users\Admin\AppData\Local\Temp\8FDD.tmp"100⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\905A.tmp"C:\Users\Admin\AppData\Local\Temp\905A.tmp"101⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\90E7.tmp"C:\Users\Admin\AppData\Local\Temp\90E7.tmp"102⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\9183.tmp"C:\Users\Admin\AppData\Local\Temp\9183.tmp"103⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\91F1.tmp"C:\Users\Admin\AppData\Local\Temp\91F1.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\926E.tmp"C:\Users\Admin\AppData\Local\Temp\926E.tmp"105⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\930A.tmp"C:\Users\Admin\AppData\Local\Temp\930A.tmp"106⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\9387.tmp"C:\Users\Admin\AppData\Local\Temp\9387.tmp"107⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\9423.tmp"C:\Users\Admin\AppData\Local\Temp\9423.tmp"108⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\94A0.tmp"C:\Users\Admin\AppData\Local\Temp\94A0.tmp"109⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\951D.tmp"C:\Users\Admin\AppData\Local\Temp\951D.tmp"110⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\959A.tmp"C:\Users\Admin\AppData\Local\Temp\959A.tmp"111⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"112⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\96B3.tmp"C:\Users\Admin\AppData\Local\Temp\96B3.tmp"113⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"114⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"115⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"116⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"117⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"118⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"119⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"120⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\9AF9.tmp"C:\Users\Admin\AppData\Local\Temp\9AF9.tmp"121⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\9B66.tmp"C:\Users\Admin\AppData\Local\Temp\9B66.tmp"122⤵PID:4156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-