Analysis
- max time kernel
135s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 17:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_f0d55781186f652620cd851ecee96c07_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_f0d55781186f652620cd851ecee96c07_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_f0d55781186f652620cd851ecee96c07_elex_mafia.exe
- Size 561KB
- Sample260817-v7v88seq7y
- SHA256 104b84f1c0359abff50bd87e102156e43d52eede1fa496031a42eb3e1f9eab69
- MD5 f0d55781186f652620cd851ecee96c07
- SHA1 ef6bebd55e36607ad68ff5bdc5cc8ffa1dad5bd8
- SHA512 36e2aa81b49f1dce1f2c31cf184e1adea8409ae9e9a2cb6fe78fd5051baaf2651cc832eb05ab5f990aa50d7a64d82e84ea64fc907e0d6945c2b6ae9ca9ee7bcb
- SSDEEP 12288:VuelPWET0yhxUJKSdp1NghsZLSZ1KJL3U+DZuL:8eEEvhxUt6EJL3U+DoL
- TLSH T118C4DF11B2D88435F1F31A344AF497A1097B7D619B35E9CF2B88226D2EB13C1E639727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4488 3A5F.tmp 3884 3B3A.tmp 1508 3BF6.tmp 4296 3CD0.tmp 3824 3D7C.tmp 4144 3E28.tmp 1040 3ED4.tmp 3752 3FAF.tmp 4236 406A.tmp 4948 4155.tmp 5720 425E.tmp 4264 4329.tmp 5108 43F5.tmp 5364 44B0.tmp 3016 452D.tmp 5972 45BA.tmp 1948 4675.tmp 3120 4721.tmp 2860 47DD.tmp 2712 485A.tmp 1260 4905.tmp 2604 49E0.tmp 2488 4A5D.tmp 4412 4AEA.tmp 2096 4BD4.tmp 2764 4C90.tmp 5360 4D99.tmp 3692 4E16.tmp 1108 4ED2.tmp 5348 4F7E.tmp 4800 500A.tmp 856 50A7.tmp 2672 5162.tmp 4692 51DF.tmp 1308 526C.tmp 3240 52E9.tmp 2276 5366.tmp 1788 53F2.tmp 1832 547F.tmp 4364 550C.tmp 5548 5598.tmp 5948 5625.tmp 2368 56A2.tmp 4704 572E.tmp 5052 57AB.tmp 3932 5857.tmp 3520 5903.tmp 3656 5980.tmp 5168 59FD.tmp 3444 5A7A.tmp 1732 5AF7.tmp 2152 5B84.tmp 1548 5C20.tmp 5900 5CBC.tmp 5456 5D2A.tmp 5676 5DA7.tmp 1172 5E24.tmp 3472 5EB0.tmp 2484 5F3D.tmp 2936 5FAA.tmp 5740 6047.tmp 5656 60E3.tmp 1840 6150.tmp 4932 61CD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 717D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 240F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B859.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 785E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 644E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D92B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A56E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 452D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F27F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 328B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4488 4648 2026-08-17_f0d55781186f652620cd851ecee96c07_elex_mafia.exe 89 PID 4488 wrote to memory of 3884 4488 3A5F.tmp 90 PID 3884 wrote to memory of 1508 3884 3B3A.tmp 91 PID 1508 wrote to memory of 4296 1508 3BF6.tmp 92 PID 4296 wrote to memory of 3824 4296 3CD0.tmp 93 PID 3824 wrote to memory of 4144 3824 3D7C.tmp 94 PID 4144 wrote to memory of 1040 4144 3E28.tmp 95 PID 1040 wrote to memory of 3752 1040 3ED4.tmp 96 PID 3752 wrote to memory of 4236 3752 3FAF.tmp 97 PID 4236 wrote to memory of 4948 4236 406A.tmp 98 PID 4948 wrote to memory of 5720 4948 4155.tmp 99 PID 5720 wrote to memory of 4264 5720 425E.tmp 100 PID 4264 wrote to memory of 5108 4264 4329.tmp 101 PID 5108 wrote to memory of 5364 5108 43F5.tmp 102 PID 5364 wrote to memory of 3016 5364 44B0.tmp 103 PID 3016 wrote to memory of 5972 3016 452D.tmp 104 PID 5972 wrote to memory of 1948 5972 45BA.tmp 105 PID 1948 wrote to memory of 3120 1948 4675.tmp 106 PID 3120 wrote to memory of 2860 3120 4721.tmp 107 PID 2860 wrote to memory of 2712 2860 47DD.tmp 108 PID 2712 wrote to memory of 1260 2712 485A.tmp 109 PID 1260 wrote to memory of 2604 1260 4905.tmp 110 PID 2604 wrote to memory of 2488 2604 49E0.tmp 111 PID 2488 wrote to memory of 4412 2488 4A5D.tmp 112 PID 4412 wrote to memory of 2096 4412 4AEA.tmp 113 PID 2096 wrote to memory of 2764 2096 4BD4.tmp 114 PID 2764 wrote to memory of 5360 2764 4C90.tmp 115 PID 5360 wrote to memory of 3692 5360 4D99.tmp 116 PID 3692 wrote to memory of 1108 3692 4E16.tmp 117 PID 1108 wrote to memory of 5348 1108 4ED2.tmp 118 PID 5348 wrote to memory of 4800 5348 4F7E.tmp 119 PID 4800 wrote to memory of 856 4800 500A.tmp 120 PID 856 wrote to memory of 2672 856 50A7.tmp 121 PID 2672 wrote to memory of 4692 2672 5162.tmp 122 PID 4692 wrote to memory of 1308 4692 51DF.tmp 123 PID 1308 wrote to memory of 3240 1308 526C.tmp 124 PID 3240 wrote to memory of 2276 3240 52E9.tmp 125 PID 2276 wrote to memory of 1788 2276 5366.tmp 126 PID 1788 wrote to memory of 1832 1788 53F2.tmp 127 PID 1832 wrote to memory of 4364 1832 547F.tmp 128 PID 4364 wrote to memory of 5548 4364 550C.tmp 129 PID 5548 wrote to memory of 5948 5548 5598.tmp 130 PID 5948 wrote to memory of 2368 5948 5625.tmp 131 PID 2368 wrote to memory of 4704 2368 56A2.tmp 132 PID 4704 wrote to memory of 5052 4704 572E.tmp 133 PID 5052 wrote to memory of 3932 5052 57AB.tmp 134 PID 3932 wrote to memory of 3520 3932 5857.tmp 135 PID 3520 wrote to memory of 3656 3520 5903.tmp 136 PID 3656 wrote to memory of 5168 3656 5980.tmp 137 PID 5168 wrote to memory of 3444 5168 59FD.tmp 138 PID 3444 wrote to memory of 1732 3444 5A7A.tmp 139 PID 1732 wrote to memory of 2152 1732 5AF7.tmp 140 PID 2152 wrote to memory of 1548 2152 5B84.tmp 141 PID 1548 wrote to memory of 5900 1548 5C20.tmp 142 PID 5900 wrote to memory of 5456 5900 5CBC.tmp 143 PID 5456 wrote to memory of 5676 5456 5D2A.tmp 144 PID 5676 wrote to memory of 1172 5676 5DA7.tmp 145 PID 1172 wrote to memory of 3472 1172 5E24.tmp 146 PID 3472 wrote to memory of 2484 3472 5EB0.tmp 147 PID 2484 wrote to memory of 2936 2484 5F3D.tmp 148 PID 2936 wrote to memory of 5740 2936 5FAA.tmp 149 PID 5740 wrote to memory of 5656 5740 6047.tmp 150 PID 5656 wrote to memory of 1840 5656 60E3.tmp 151 PID 1840 wrote to memory of 4932 1840 6150.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_f0d55781186f652620cd851ecee96c07_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_f0d55781186f652620cd851ecee96c07_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\3E28.tmp"C:\Users\Admin\AppData\Local\Temp\3E28.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4155.tmp"C:\Users\Admin\AppData\Local\Temp\4155.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\43F5.tmp"C:\Users\Admin\AppData\Local\Temp\43F5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\485A.tmp"C:\Users\Admin\AppData\Local\Temp\485A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\49E0.tmp"C:\Users\Admin\AppData\Local\Temp\49E0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\4E16.tmp"C:\Users\Admin\AppData\Local\Temp\4E16.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\5625.tmp"C:\Users\Admin\AppData\Local\Temp\5625.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\56A2.tmp"C:\Users\Admin\AppData\Local\Temp\56A2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\57AB.tmp"C:\Users\Admin\AppData\Local\Temp\57AB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5903.tmp"C:\Users\Admin\AppData\Local\Temp\5903.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5C20.tmp"C:\Users\Admin\AppData\Local\Temp\5C20.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\61CD.tmp"C:\Users\Admin\AppData\Local\Temp\61CD.tmp"65⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\624A.tmp"C:\Users\Admin\AppData\Local\Temp\624A.tmp"66⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\62C7.tmp"C:\Users\Admin\AppData\Local\Temp\62C7.tmp"67⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\6354.tmp"C:\Users\Admin\AppData\Local\Temp\6354.tmp"68⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\63D1.tmp"C:\Users\Admin\AppData\Local\Temp\63D1.tmp"69⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"71⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"72⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"73⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"74⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"75⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\678A.tmp"C:\Users\Admin\AppData\Local\Temp\678A.tmp"76⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\6817.tmp"C:\Users\Admin\AppData\Local\Temp\6817.tmp"77⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"78⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"79⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"80⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"81⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"82⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"83⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"84⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"85⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"86⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\6D08.tmp"C:\Users\Admin\AppData\Local\Temp\6D08.tmp"87⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"88⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"89⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\6E50.tmp"C:\Users\Admin\AppData\Local\Temp\6E50.tmp"90⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"91⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\6F89.tmp"C:\Users\Admin\AppData\Local\Temp\6F89.tmp"92⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"93⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"94⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"95⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\71EA.tmp"C:\Users\Admin\AppData\Local\Temp\71EA.tmp"97⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"98⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"99⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\7361.tmp"C:\Users\Admin\AppData\Local\Temp\7361.tmp"100⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"101⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\745B.tmp"C:\Users\Admin\AppData\Local\Temp\745B.tmp"102⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\74E8.tmp"C:\Users\Admin\AppData\Local\Temp\74E8.tmp"103⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"104⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\75E2.tmp"C:\Users\Admin\AppData\Local\Temp\75E2.tmp"105⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\766E.tmp"C:\Users\Admin\AppData\Local\Temp\766E.tmp"106⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\76EB.tmp"C:\Users\Admin\AppData\Local\Temp\76EB.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"108⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"109⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\7862.tmp"C:\Users\Admin\AppData\Local\Temp\7862.tmp"110⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\78D0.tmp"C:\Users\Admin\AppData\Local\Temp\78D0.tmp"111⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\795C.tmp"C:\Users\Admin\AppData\Local\Temp\795C.tmp"112⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\79E9.tmp"C:\Users\Admin\AppData\Local\Temp\79E9.tmp"113⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"114⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"115⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\7B41.tmp"C:\Users\Admin\AppData\Local\Temp\7B41.tmp"116⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"117⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"118⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"119⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"120⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\7E00.tmp"C:\Users\Admin\AppData\Local\Temp\7E00.tmp"121⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"122⤵PID:5368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-