Analysis
- max time kernel
131s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_54aa12a2cfd037378da676ab896b108a_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_54aa12a2cfd037378da676ab896b108a_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_54aa12a2cfd037378da676ab896b108a_elex_mafia.exe
- Size 561KB
- Sample260810-2gjwvaar91
- SHA256 5e787ede9c40380e52ec08a762e97b761b756000fc540fd2274ee79348786d0c
- MD5 54aa12a2cfd037378da676ab896b108a
- SHA1 2c5b5ca644e04dec965ee217a1dffee20ea2870a
- SHA512 5603926e5fd79661349ffa8a4b60f49098cb92ee98f9198df7f3f1a428284fb0f839b2d951bc862d2494273254a4f2a4c8e881ab012330374e7b14553be4782e
- SSDEEP 12288:VuelPWET0yhPiKo/kMveznEcUN5JspcrDBfr9DZuL:8eEEvhPivNezEcUNVBZDoL
- TLSH T13CC4DF11B2D8C831F1F31A348AF49BA2097BBD619B75D5CF2B84221D2EB12D1E679713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3888 4613.tmp 2712 469F.tmp 2632 475B.tmp 5392 4807.tmp 5316 48F1.tmp 1412 49FB.tmp 752 4A87.tmp 2884 4B04.tmp 1196 4B81.tmp 5912 4C2D.tmp 4476 4CBA.tmp 1576 4D27.tmp 260 4E40.tmp 5044 4EAE.tmp 4672 4F4A.tmp 912 5006.tmp 4636 50D1.tmp 3592 519C.tmp 1592 5267.tmp 4952 52E4.tmp 4916 5380.tmp 5652 545B.tmp 856 5526.tmp 3380 55F1.tmp 5828 569D.tmp 5740 5749.tmp 5992 5814.tmp 4688 590E.tmp 676 59BA.tmp 4856 5A56.tmp 700 5B41.tmp 4764 5BDD.tmp 2104 5CC7.tmp 1948 5D54.tmp 3916 5DC1.tmp 5208 5E3E.tmp 3252 5E9C.tmp 5252 5F19.tmp 4964 5F96.tmp 1584 6013.tmp 2156 6090.tmp 1872 611D.tmp 2780 61A9.tmp 1764 6226.tmp 4004 62A3.tmp 4384 6320.tmp 1436 67A4.tmp 4612 6831.tmp 4700 68DD.tmp 3008 6979.tmp 2776 69E7.tmp 620 6A64.tmp 3236 6AF0.tmp 5720 6B8C.tmp 2136 6C09.tmp 5408 6CB5.tmp 5876 6D42.tmp 5496 6DBF.tmp 2244 6E5B.tmp 3476 6F07.tmp 4804 6FA3.tmp 5556 7011.tmp 1140 707E.tmp 3280 710B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B504.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 569D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8048.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 586D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E07E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 992F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D92B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 174D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 928D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E26.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 3888 4444 2026-08-10_54aa12a2cfd037378da676ab896b108a_elex_mafia.exe 90 PID 3888 wrote to memory of 2712 3888 4613.tmp 91 PID 2712 wrote to memory of 2632 2712 469F.tmp 92 PID 2632 wrote to memory of 5392 2632 475B.tmp 93 PID 5392 wrote to memory of 5316 5392 4807.tmp 94 PID 5316 wrote to memory of 1412 5316 48F1.tmp 95 PID 1412 wrote to memory of 752 1412 49FB.tmp 96 PID 752 wrote to memory of 2884 752 4A87.tmp 97 PID 2884 wrote to memory of 1196 2884 4B04.tmp 98 PID 1196 wrote to memory of 5912 1196 4B81.tmp 99 PID 5912 wrote to memory of 4476 5912 4C2D.tmp 100 PID 4476 wrote to memory of 1576 4476 4CBA.tmp 101 PID 1576 wrote to memory of 260 1576 4D27.tmp 102 PID 260 wrote to memory of 5044 260 4E40.tmp 103 PID 5044 wrote to memory of 4672 5044 4EAE.tmp 104 PID 4672 wrote to memory of 912 4672 4F4A.tmp 105 PID 912 wrote to memory of 4636 912 5006.tmp 106 PID 4636 wrote to memory of 3592 4636 50D1.tmp 107 PID 3592 wrote to memory of 1592 3592 519C.tmp 108 PID 1592 wrote to memory of 4952 1592 5267.tmp 109 PID 4952 wrote to memory of 4916 4952 52E4.tmp 110 PID 4916 wrote to memory of 5652 4916 5380.tmp 111 PID 5652 wrote to memory of 856 5652 545B.tmp 112 PID 856 wrote to memory of 3380 856 5526.tmp 113 PID 3380 wrote to memory of 5828 3380 55F1.tmp 114 PID 5828 wrote to memory of 5740 5828 569D.tmp 115 PID 5740 wrote to memory of 5992 5740 5749.tmp 116 PID 5992 wrote to memory of 4688 5992 5814.tmp 117 PID 4688 wrote to memory of 676 4688 590E.tmp 118 PID 676 wrote to memory of 4856 676 59BA.tmp 119 PID 4856 wrote to memory of 700 4856 5A56.tmp 120 PID 700 wrote to memory of 4764 700 5B41.tmp 121 PID 4764 wrote to memory of 2104 4764 5BDD.tmp 122 PID 2104 wrote to memory of 1948 2104 5CC7.tmp 123 PID 1948 wrote to memory of 3916 1948 5D54.tmp 124 PID 3916 wrote to memory of 5208 3916 5DC1.tmp 125 PID 5208 wrote to memory of 3252 5208 5E3E.tmp 126 PID 3252 wrote to memory of 5252 3252 5E9C.tmp 127 PID 5252 wrote to memory of 4964 5252 5F19.tmp 128 PID 4964 wrote to memory of 1584 4964 5F96.tmp 129 PID 1584 wrote to memory of 2156 1584 6013.tmp 130 PID 2156 wrote to memory of 1872 2156 6090.tmp 131 PID 1872 wrote to memory of 2780 1872 611D.tmp 132 PID 2780 wrote to memory of 1764 2780 61A9.tmp 133 PID 1764 wrote to memory of 4004 1764 6226.tmp 134 PID 4004 wrote to memory of 4384 4004 62A3.tmp 135 PID 4384 wrote to memory of 1436 4384 6320.tmp 136 PID 1436 wrote to memory of 4612 1436 67A4.tmp 137 PID 4612 wrote to memory of 4700 4612 6831.tmp 138 PID 4700 wrote to memory of 3008 4700 68DD.tmp 139 PID 3008 wrote to memory of 2776 3008 6979.tmp 140 PID 2776 wrote to memory of 620 2776 69E7.tmp 141 PID 620 wrote to memory of 3236 620 6A64.tmp 142 PID 3236 wrote to memory of 5720 3236 6AF0.tmp 143 PID 5720 wrote to memory of 2136 5720 6B8C.tmp 144 PID 2136 wrote to memory of 5408 2136 6C09.tmp 145 PID 5408 wrote to memory of 5876 5408 6CB5.tmp 146 PID 5876 wrote to memory of 5496 5876 6D42.tmp 147 PID 5496 wrote to memory of 2244 5496 6DBF.tmp 148 PID 2244 wrote to memory of 3476 2244 6E5B.tmp 149 PID 3476 wrote to memory of 4804 3476 6F07.tmp 150 PID 4804 wrote to memory of 5556 4804 6FA3.tmp 151 PID 5556 wrote to memory of 1140 5556 7011.tmp 152 PID 1140 wrote to memory of 3280 1140 707E.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_54aa12a2cfd037378da676ab896b108a_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_54aa12a2cfd037378da676ab896b108a_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\469F.tmp"C:\Users\Admin\AppData\Local\Temp\469F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\475B.tmp"C:\Users\Admin\AppData\Local\Temp\475B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4807.tmp"C:\Users\Admin\AppData\Local\Temp\4807.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\48F1.tmp"C:\Users\Admin\AppData\Local\Temp\48F1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4A87.tmp"C:\Users\Admin\AppData\Local\Temp\4A87.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\4CBA.tmp"C:\Users\Admin\AppData\Local\Temp\4CBA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4D27.tmp"C:\Users\Admin\AppData\Local\Temp\4D27.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\4E40.tmp"C:\Users\Admin\AppData\Local\Temp\4E40.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5006.tmp"C:\Users\Admin\AppData\Local\Temp\5006.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\50D1.tmp"C:\Users\Admin\AppData\Local\Temp\50D1.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\519C.tmp"C:\Users\Admin\AppData\Local\Temp\519C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\5267.tmp"C:\Users\Admin\AppData\Local\Temp\5267.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\52E4.tmp"C:\Users\Admin\AppData\Local\Temp\52E4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5380.tmp"C:\Users\Admin\AppData\Local\Temp\5380.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\545B.tmp"C:\Users\Admin\AppData\Local\Temp\545B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\5526.tmp"C:\Users\Admin\AppData\Local\Temp\5526.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\55F1.tmp"C:\Users\Admin\AppData\Local\Temp\55F1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\569D.tmp"C:\Users\Admin\AppData\Local\Temp\569D.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\5749.tmp"C:\Users\Admin\AppData\Local\Temp\5749.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\5814.tmp"C:\Users\Admin\AppData\Local\Temp\5814.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\590E.tmp"C:\Users\Admin\AppData\Local\Temp\590E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\59BA.tmp"C:\Users\Admin\AppData\Local\Temp\59BA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\5A56.tmp"C:\Users\Admin\AppData\Local\Temp\5A56.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5D54.tmp"C:\Users\Admin\AppData\Local\Temp\5D54.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"C:\Users\Admin\AppData\Local\Temp\5DC1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\5F19.tmp"C:\Users\Admin\AppData\Local\Temp\5F19.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\5F96.tmp"C:\Users\Admin\AppData\Local\Temp\5F96.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\6013.tmp"C:\Users\Admin\AppData\Local\Temp\6013.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\6090.tmp"C:\Users\Admin\AppData\Local\Temp\6090.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\61A9.tmp"C:\Users\Admin\AppData\Local\Temp\61A9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6226.tmp"C:\Users\Admin\AppData\Local\Temp\6226.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\62A3.tmp"C:\Users\Admin\AppData\Local\Temp\62A3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\6320.tmp"C:\Users\Admin\AppData\Local\Temp\6320.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\67A4.tmp"C:\Users\Admin\AppData\Local\Temp\67A4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\6831.tmp"C:\Users\Admin\AppData\Local\Temp\6831.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\68DD.tmp"C:\Users\Admin\AppData\Local\Temp\68DD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6979.tmp"C:\Users\Admin\AppData\Local\Temp\6979.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\69E7.tmp"C:\Users\Admin\AppData\Local\Temp\69E7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\6A64.tmp"C:\Users\Admin\AppData\Local\Temp\6A64.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\6B8C.tmp"C:\Users\Admin\AppData\Local\Temp\6B8C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\6C09.tmp"C:\Users\Admin\AppData\Local\Temp\6C09.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\6D42.tmp"C:\Users\Admin\AppData\Local\Temp\6D42.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"C:\Users\Admin\AppData\Local\Temp\6DBF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\6F07.tmp"C:\Users\Admin\AppData\Local\Temp\6F07.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\707E.tmp"C:\Users\Admin\AppData\Local\Temp\707E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"65⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"66⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"67⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"68⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\737C.tmp"C:\Users\Admin\AppData\Local\Temp\737C.tmp"70⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\7408.tmp"C:\Users\Admin\AppData\Local\Temp\7408.tmp"71⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7485.tmp"C:\Users\Admin\AppData\Local\Temp\7485.tmp"72⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"73⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\758F.tmp"C:\Users\Admin\AppData\Local\Temp\758F.tmp"74⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\762B.tmp"C:\Users\Admin\AppData\Local\Temp\762B.tmp"75⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\76A8.tmp"C:\Users\Admin\AppData\Local\Temp\76A8.tmp"76⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\7735.tmp"C:\Users\Admin\AppData\Local\Temp\7735.tmp"77⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\77D1.tmp"C:\Users\Admin\AppData\Local\Temp\77D1.tmp"78⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\783E.tmp"C:\Users\Admin\AppData\Local\Temp\783E.tmp"79⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\78AC.tmp"C:\Users\Admin\AppData\Local\Temp\78AC.tmp"80⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\7929.tmp"C:\Users\Admin\AppData\Local\Temp\7929.tmp"81⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\79A6.tmp"C:\Users\Admin\AppData\Local\Temp\79A6.tmp"82⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\7A42.tmp"C:\Users\Admin\AppData\Local\Temp\7A42.tmp"83⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"84⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"85⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\7C17.tmp"C:\Users\Admin\AppData\Local\Temp\7C17.tmp"86⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7C94.tmp"C:\Users\Admin\AppData\Local\Temp\7C94.tmp"87⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\7D11.tmp"C:\Users\Admin\AppData\Local\Temp\7D11.tmp"88⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\7D8E.tmp"C:\Users\Admin\AppData\Local\Temp\7D8E.tmp"89⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"90⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\7E69.tmp"C:\Users\Admin\AppData\Local\Temp\7E69.tmp"91⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\7EE6.tmp"C:\Users\Admin\AppData\Local\Temp\7EE6.tmp"92⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"93⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"94⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\804D.tmp"C:\Users\Admin\AppData\Local\Temp\804D.tmp"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\80CA.tmp"C:\Users\Admin\AppData\Local\Temp\80CA.tmp"96⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\8147.tmp"C:\Users\Admin\AppData\Local\Temp\8147.tmp"97⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\81D4.tmp"C:\Users\Admin\AppData\Local\Temp\81D4.tmp"98⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\8251.tmp"C:\Users\Admin\AppData\Local\Temp\8251.tmp"99⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\82ED.tmp"C:\Users\Admin\AppData\Local\Temp\82ED.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\835A.tmp"C:\Users\Admin\AppData\Local\Temp\835A.tmp"101⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\83D7.tmp"C:\Users\Admin\AppData\Local\Temp\83D7.tmp"102⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\8445.tmp"C:\Users\Admin\AppData\Local\Temp\8445.tmp"103⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\84E1.tmp"C:\Users\Admin\AppData\Local\Temp\84E1.tmp"104⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\857D.tmp"C:\Users\Admin\AppData\Local\Temp\857D.tmp"105⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\860A.tmp"C:\Users\Admin\AppData\Local\Temp\860A.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\8677.tmp"C:\Users\Admin\AppData\Local\Temp\8677.tmp"107⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"108⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\87B0.tmp"C:\Users\Admin\AppData\Local\Temp\87B0.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\882D.tmp"C:\Users\Admin\AppData\Local\Temp\882D.tmp"110⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\88AA.tmp"C:\Users\Admin\AppData\Local\Temp\88AA.tmp"111⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8927.tmp"C:\Users\Admin\AppData\Local\Temp\8927.tmp"112⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\8994.tmp"C:\Users\Admin\AppData\Local\Temp\8994.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\8A11.tmp"C:\Users\Admin\AppData\Local\Temp\8A11.tmp"114⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"115⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"116⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\8BA7.tmp"C:\Users\Admin\AppData\Local\Temp\8BA7.tmp"117⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\8C34.tmp"C:\Users\Admin\AppData\Local\Temp\8C34.tmp"118⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"119⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"120⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"121⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\8E28.tmp"C:\Users\Admin\AppData\Local\Temp\8E28.tmp"122⤵PID:5396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-