Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-04_8e53c78a7a4943a17cc4851460bb146b_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_8e53c78a7a4943a17cc4851460bb146b_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-04_8e53c78a7a4943a17cc4851460bb146b_elex_mafia.exe
- Size 560KB
- Sample260504-weeapadt2m
- SHA256 50db447ad048062733977c03a2015d5049b57ea1cdae394e551d25b2d0a8d885
- MD5 8e53c78a7a4943a17cc4851460bb146b
- SHA1 5fc1f5a064d34893fc5b7ef81e889f7a752f9542
- SHA512 679f8f409e57badbbe046ca4b3c52d4ccddd0a53562ddee9ed81d82b7bfbe50b37672af59037d28a3136ef67926a88b08fbfbf9bcade69309ca63a79a30fbb62
- SSDEEP 12288:MlFXOQUDmrC8SIhlaUcTh+fesVhb/SfIZxV:MlUQbC8SYl9cYPDSfIR
- TLSH T14DC4E0227544C0B3E69210310B52CB962B3F7D759B2AA5D73B94266DAFB03C1DB7834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4648 F54D.tmp 5992 F5BA.tmp 2208 F608.tmp 1592 F760.tmp 4948 F81B.tmp 5032 F8D7.tmp 5112 F9A2.tmp 4992 FA9C.tmp 2568 FB67.tmp 3312 FC52.tmp 5784 FD0D.tmp 5216 FE07.tmp 6104 FF11.tmp 5656 FFDC.tmp 3320 A7.tmp 3216 172.tmp 3156 21E.tmp 3860 2CA.tmp 4956 3A5.tmp 2840 460.tmp 1904 54A.tmp 2152 625.tmp 2952 6F0.tmp 2652 79C.tmp 4372 858.tmp 2180 913.tmp 4152 A0D.tmp 876 AF8.tmp 2640 BC3.tmp 2852 C6F.tmp 5640 D1A.tmp 3172 DB7.tmp 3964 EA1.tmp 1760 F3D.tmp 1840 FBA.tmp 1484 1047.tmp 2104 10C4.tmp 5828 1151.tmp 2816 11CE.tmp 4308 123B.tmp 5472 12D7.tmp 4804 1325.tmp 4428 13A2.tmp 6016 142F.tmp 4304 14CB.tmp 4236 1567.tmp 3200 15F4.tmp 6108 1661.tmp 3384 16BF.tmp 3752 170D.tmp 2928 176B.tmp 5384 17B9.tmp 2572 1807.tmp 5672 1855.tmp 2664 18A4.tmp 568 18F2.tmp 4500 1940.tmp 1964 198E.tmp 5348 19DC.tmp 5948 1A2A.tmp 224 1A88.tmp 3520 1AD6.tmp 5408 1B24.tmp 952 1B72.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 422F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 656C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 850A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E24D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A91C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 523D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 388B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 4648 4640 2026-05-04_8e53c78a7a4943a17cc4851460bb146b_elex_mafia.exe 79 PID 4648 wrote to memory of 5992 4648 F54D.tmp 80 PID 5992 wrote to memory of 2208 5992 F5BA.tmp 81 PID 2208 wrote to memory of 1592 2208 F608.tmp 82 PID 1592 wrote to memory of 4948 1592 F760.tmp 83 PID 4948 wrote to memory of 5032 4948 F81B.tmp 84 PID 5032 wrote to memory of 5112 5032 F8D7.tmp 85 PID 5112 wrote to memory of 4992 5112 F9A2.tmp 86 PID 4992 wrote to memory of 2568 4992 FA9C.tmp 87 PID 2568 wrote to memory of 3312 2568 FB67.tmp 88 PID 3312 wrote to memory of 5784 3312 FC52.tmp 89 PID 5784 wrote to memory of 5216 5784 FD0D.tmp 90 PID 5216 wrote to memory of 6104 5216 FE07.tmp 91 PID 6104 wrote to memory of 5656 6104 FF11.tmp 92 PID 5656 wrote to memory of 3320 5656 FFDC.tmp 93 PID 3320 wrote to memory of 3216 3320 A7.tmp 94 PID 3216 wrote to memory of 3156 3216 172.tmp 95 PID 3156 wrote to memory of 3860 3156 21E.tmp 96 PID 3860 wrote to memory of 4956 3860 2CA.tmp 97 PID 4956 wrote to memory of 2840 4956 3A5.tmp 98 PID 2840 wrote to memory of 1904 2840 460.tmp 99 PID 1904 wrote to memory of 2152 1904 54A.tmp 100 PID 2152 wrote to memory of 2952 2152 625.tmp 101 PID 2952 wrote to memory of 2652 2952 6F0.tmp 102 PID 2652 wrote to memory of 4372 2652 79C.tmp 103 PID 4372 wrote to memory of 2180 4372 858.tmp 104 PID 2180 wrote to memory of 4152 2180 913.tmp 105 PID 4152 wrote to memory of 876 4152 A0D.tmp 106 PID 876 wrote to memory of 2640 876 AF8.tmp 107 PID 2640 wrote to memory of 2852 2640 BC3.tmp 108 PID 2852 wrote to memory of 5640 2852 C6F.tmp 109 PID 5640 wrote to memory of 3172 5640 D1A.tmp 110 PID 3172 wrote to memory of 3964 3172 DB7.tmp 111 PID 3964 wrote to memory of 1760 3964 EA1.tmp 112 PID 1760 wrote to memory of 1840 1760 F3D.tmp 113 PID 1840 wrote to memory of 1484 1840 FBA.tmp 114 PID 1484 wrote to memory of 2104 1484 1047.tmp 115 PID 2104 wrote to memory of 5828 2104 10C4.tmp 116 PID 5828 wrote to memory of 2816 5828 1151.tmp 117 PID 2816 wrote to memory of 4308 2816 11CE.tmp 118 PID 4308 wrote to memory of 5472 4308 123B.tmp 119 PID 5472 wrote to memory of 4804 5472 12D7.tmp 120 PID 4804 wrote to memory of 4428 4804 1325.tmp 121 PID 4428 wrote to memory of 6016 4428 13A2.tmp 122 PID 6016 wrote to memory of 4304 6016 142F.tmp 123 PID 4304 wrote to memory of 4236 4304 14CB.tmp 124 PID 4236 wrote to memory of 3200 4236 1567.tmp 125 PID 3200 wrote to memory of 6108 3200 15F4.tmp 126 PID 6108 wrote to memory of 3384 6108 1661.tmp 127 PID 3384 wrote to memory of 3752 3384 16BF.tmp 128 PID 3752 wrote to memory of 2928 3752 170D.tmp 129 PID 2928 wrote to memory of 5384 2928 176B.tmp 130 PID 5384 wrote to memory of 2572 5384 17B9.tmp 131 PID 2572 wrote to memory of 5672 2572 1807.tmp 132 PID 5672 wrote to memory of 2664 5672 1855.tmp 133 PID 2664 wrote to memory of 568 2664 18A4.tmp 134 PID 568 wrote to memory of 4500 568 18F2.tmp 135 PID 4500 wrote to memory of 1964 4500 1940.tmp 136 PID 1964 wrote to memory of 5348 1964 198E.tmp 137 PID 5348 wrote to memory of 5948 5348 19DC.tmp 138 PID 5948 wrote to memory of 224 5948 1A2A.tmp 139 PID 224 wrote to memory of 3520 224 1A88.tmp 140 PID 3520 wrote to memory of 5408 3520 1AD6.tmp 141 PID 5408 wrote to memory of 952 5408 1B24.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_8e53c78a7a4943a17cc4851460bb146b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_8e53c78a7a4943a17cc4851460bb146b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"65⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"66⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"67⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"68⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"70⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"71⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"72⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"73⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"74⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"75⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"76⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"77⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"78⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"79⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"80⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"81⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"82⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"83⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"84⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"85⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"86⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"87⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"88⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"89⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"90⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"91⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"92⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"93⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"94⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"95⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"96⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"97⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"98⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"99⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"100⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"102⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"103⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"104⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"105⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"106⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"107⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"108⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"109⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"110⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"111⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"112⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"113⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"114⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"115⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"116⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"117⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"118⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"119⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"120⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"121⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-