Analysis
- max time kernel
136s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_54dca0cb9327b0b341e367c121ba8b54_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_54dca0cb9327b0b341e367c121ba8b54_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_54dca0cb9327b0b341e367c121ba8b54_elex_mafia.exe
- Size 564KB
- Sample260801-dvx4mawhmf
- SHA256 deef48414e220894e2d75142412a7bd124ec5165778dc5d04e4fc78d6c9be417
- MD5 54dca0cb9327b0b341e367c121ba8b54
- SHA1 c0dea756555638135c2353d6509db4e3a2a04c62
- SHA512 eb8d326e8b1f45762351cbee158058c56acc47bf9dcdd31727b52fa0c6348ac8874046faaf5e4b5ad5b763fb99636d7d5f3e745ecdd7f955613b94e779371745
- SSDEEP 12288:Kdhh2PNZW9nCO/mIQRAPLlLfE7W4ymFaeCtRTZulH:KdqPu9CshQRAPBLfE76mIRTglH
- TLSH T184C4F125B284C13AF6C202354A16EBA25A3A7C35973AA5C37B94362D2FF17E1D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4756 85C0.tmp 4708 86BA.tmp 5444 8851.tmp 5044 88BE.tmp 2588 8999.tmp 5712 8A54.tmp 2872 8B00.tmp 4328 8BBC.tmp 1520 8C87.tmp 7068 8D42.tmp 5048 8E0D.tmp 5624 8F17.tmp 2764 8FC3.tmp 3380 90AD.tmp 4812 9169.tmp 1212 9224.tmp 6512 92B1.tmp 5088 935D.tmp 3900 93DA.tmp 4680 9476.tmp 5032 9531.tmp 4952 95CE.tmp 6364 96A8.tmp 5332 9793.tmp 4552 985E.tmp 4648 9929.tmp 4348 99D5.tmp 4684 9ACF.tmp 4184 9B9A.tmp 4652 9C36.tmp 5896 9CE2.tmp 1384 9DCD.tmp 6008 9E88.tmp 4196 9F24.tmp 1992 9FA1.tmp 4828 A03E.tmp 900 A0AB.tmp 5436 A118.tmp 5644 A186.tmp 4776 A212.tmp 5532 A270.tmp 1096 A2ED.tmp 1652 A389.tmp 1452 A3E7.tmp 6600 A474.tmp 412 A4F1.tmp 1220 A57D.tmp 1396 A5FA.tmp 5440 A668.tmp 2060 A6E5.tmp 5964 A762.tmp 4268 A7DF.tmp 2452 A88B.tmp 6352 A917.tmp 5820 A985.tmp 5656 AA02.tmp 3508 AA6F.tmp 2628 AAEC.tmp 2064 AB79.tmp 6520 AC05.tmp 7040 AC82.tmp 1600 AD0F.tmp 3420 AD8C.tmp 5500 AE09.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 509D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E64A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 325C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 572A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B065.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 935D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E07E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C3D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3388 wrote to memory of 4756 3388 2026-08-01_54dca0cb9327b0b341e367c121ba8b54_elex_mafia.exe 90 PID 4756 wrote to memory of 4708 4756 85C0.tmp 91 PID 4708 wrote to memory of 5444 4708 86BA.tmp 92 PID 5444 wrote to memory of 5044 5444 8851.tmp 93 PID 5044 wrote to memory of 2588 5044 88BE.tmp 94 PID 2588 wrote to memory of 5712 2588 8999.tmp 95 PID 5712 wrote to memory of 2872 5712 8A54.tmp 96 PID 2872 wrote to memory of 4328 2872 8B00.tmp 97 PID 4328 wrote to memory of 1520 4328 8BBC.tmp 98 PID 1520 wrote to memory of 7068 1520 8C87.tmp 99 PID 7068 wrote to memory of 5048 7068 8D42.tmp 100 PID 5048 wrote to memory of 5624 5048 8E0D.tmp 101 PID 5624 wrote to memory of 2764 5624 8F17.tmp 102 PID 2764 wrote to memory of 3380 2764 8FC3.tmp 103 PID 3380 wrote to memory of 4812 3380 90AD.tmp 104 PID 4812 wrote to memory of 1212 4812 9169.tmp 105 PID 1212 wrote to memory of 6512 1212 9224.tmp 106 PID 6512 wrote to memory of 5088 6512 92B1.tmp 107 PID 5088 wrote to memory of 3900 5088 935D.tmp 108 PID 3900 wrote to memory of 4680 3900 93DA.tmp 109 PID 4680 wrote to memory of 5032 4680 9476.tmp 110 PID 5032 wrote to memory of 4952 5032 9531.tmp 111 PID 4952 wrote to memory of 6364 4952 95CE.tmp 112 PID 6364 wrote to memory of 5332 6364 96A8.tmp 113 PID 5332 wrote to memory of 4552 5332 9793.tmp 114 PID 4552 wrote to memory of 4648 4552 985E.tmp 115 PID 4648 wrote to memory of 4348 4648 9929.tmp 116 PID 4348 wrote to memory of 4684 4348 99D5.tmp 117 PID 4684 wrote to memory of 4184 4684 9ACF.tmp 118 PID 4184 wrote to memory of 4652 4184 9B9A.tmp 119 PID 4652 wrote to memory of 5896 4652 9C36.tmp 120 PID 5896 wrote to memory of 1384 5896 9CE2.tmp 121 PID 1384 wrote to memory of 6008 1384 9DCD.tmp 122 PID 6008 wrote to memory of 4196 6008 9E88.tmp 123 PID 4196 wrote to memory of 1992 4196 9F24.tmp 124 PID 1992 wrote to memory of 4828 1992 9FA1.tmp 125 PID 4828 wrote to memory of 900 4828 A03E.tmp 126 PID 900 wrote to memory of 5436 900 A0AB.tmp 127 PID 5436 wrote to memory of 5644 5436 A118.tmp 128 PID 5644 wrote to memory of 4776 5644 A186.tmp 129 PID 4776 wrote to memory of 5532 4776 A212.tmp 130 PID 5532 wrote to memory of 1096 5532 A270.tmp 131 PID 1096 wrote to memory of 1652 1096 A2ED.tmp 132 PID 1652 wrote to memory of 1452 1652 A389.tmp 133 PID 1452 wrote to memory of 6600 1452 A3E7.tmp 134 PID 6600 wrote to memory of 412 6600 A474.tmp 135 PID 412 wrote to memory of 1220 412 A4F1.tmp 136 PID 1220 wrote to memory of 1396 1220 A57D.tmp 137 PID 1396 wrote to memory of 5440 1396 A5FA.tmp 138 PID 5440 wrote to memory of 2060 5440 A668.tmp 139 PID 2060 wrote to memory of 5964 2060 A6E5.tmp 140 PID 5964 wrote to memory of 4268 5964 A762.tmp 141 PID 4268 wrote to memory of 2452 4268 A7DF.tmp 142 PID 2452 wrote to memory of 6352 2452 A88B.tmp 143 PID 6352 wrote to memory of 5820 6352 A917.tmp 144 PID 5820 wrote to memory of 5656 5820 A985.tmp 145 PID 5656 wrote to memory of 3508 5656 AA02.tmp 146 PID 3508 wrote to memory of 2628 3508 AA6F.tmp 147 PID 2628 wrote to memory of 2064 2628 AAEC.tmp 148 PID 2064 wrote to memory of 6520 2064 AB79.tmp 149 PID 6520 wrote to memory of 7040 6520 AC05.tmp 150 PID 7040 wrote to memory of 1600 7040 AC82.tmp 151 PID 1600 wrote to memory of 3420 1600 AD0F.tmp 152 PID 3420 wrote to memory of 5500 3420 AD8C.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_54dca0cb9327b0b341e367c121ba8b54_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_54dca0cb9327b0b341e367c121ba8b54_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\88BE.tmp"C:\Users\Admin\AppData\Local\Temp\88BE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7068 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\8F17.tmp"C:\Users\Admin\AppData\Local\Temp\8F17.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\90AD.tmp"C:\Users\Admin\AppData\Local\Temp\90AD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6512 -
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\9476.tmp"C:\Users\Admin\AppData\Local\Temp\9476.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6364 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\985E.tmp"C:\Users\Admin\AppData\Local\Temp\985E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\99D5.tmp"C:\Users\Admin\AppData\Local\Temp\99D5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\A212.tmp"C:\Users\Admin\AppData\Local\Temp\A212.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\A270.tmp"C:\Users\Admin\AppData\Local\Temp\A270.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"C:\Users\Admin\AppData\Local\Temp\A2ED.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\A389.tmp"C:\Users\Admin\AppData\Local\Temp\A389.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6600 -
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"C:\Users\Admin\AppData\Local\Temp\A7DF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\A917.tmp"C:\Users\Admin\AppData\Local\Temp\A917.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6352 -
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\AA02.tmp"C:\Users\Admin\AppData\Local\Temp\AA02.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\AB79.tmp"C:\Users\Admin\AppData\Local\Temp\AB79.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7040 -
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\AE09.tmp"C:\Users\Admin\AppData\Local\Temp\AE09.tmp"65⤵
- Executes dropped EXE
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\AE95.tmp"C:\Users\Admin\AppData\Local\Temp\AE95.tmp"66⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"67⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"68⤵PID:6660
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"69⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"70⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"71⤵PID:6932
-
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"72⤵PID:6348
-
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"73⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"74⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"75⤵PID:7108
-
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"76⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"77⤵PID:6844
-
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"78⤵PID:6904
-
C:\Users\Admin\AppData\Local\Temp\B54C.tmp"C:\Users\Admin\AppData\Local\Temp\B54C.tmp"79⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"80⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"81⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"82⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B76F.tmp"C:\Users\Admin\AppData\Local\Temp\B76F.tmp"83⤵PID:7036
-
C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"C:\Users\Admin\AppData\Local\Temp\B7CD.tmp"84⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"85⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"86⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"87⤵PID:6340
-
C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"C:\Users\Admin\AppData\Local\Temp\B9A2.tmp"88⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"89⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\BABB.tmp"C:\Users\Admin\AppData\Local\Temp\BABB.tmp"90⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\BB28.tmp"C:\Users\Admin\AppData\Local\Temp\BB28.tmp"91⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"C:\Users\Admin\AppData\Local\Temp\BBA5.tmp"92⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"94⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"95⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"96⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BE16.tmp"C:\Users\Admin\AppData\Local\Temp\BE16.tmp"97⤵PID:6632
-
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"98⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"99⤵PID:6672
-
C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"C:\Users\Admin\AppData\Local\Temp\BFAC.tmp"100⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"102⤵PID:6236
-
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"103⤵PID:6380
-
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"104⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"105⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\C29A.tmp"C:\Users\Admin\AppData\Local\Temp\C29A.tmp"106⤵PID:7052
-
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"107⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"108⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C431.tmp"C:\Users\Admin\AppData\Local\Temp\C431.tmp"109⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"110⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\C51B.tmp"C:\Users\Admin\AppData\Local\Temp\C51B.tmp"111⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"112⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\C644.tmp"C:\Users\Admin\AppData\Local\Temp\C644.tmp"113⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"114⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\C74E.tmp"C:\Users\Admin\AppData\Local\Temp\C74E.tmp"115⤵PID:6736
-
C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"C:\Users\Admin\AppData\Local\Temp\C7BB.tmp"116⤵PID:6480
-
C:\Users\Admin\AppData\Local\Temp\C838.tmp"C:\Users\Admin\AppData\Local\Temp\C838.tmp"117⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"118⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"119⤵PID:6392
-
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"120⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"121⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"122⤵PID:6912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-