Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-18_1180caa89ddf31ddbf94a6ffb9832c39_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_1180caa89ddf31ddbf94a6ffb9832c39_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-18_1180caa89ddf31ddbf94a6ffb9832c39_elex_mafia.exe
- Size 561KB
- Sample260518-bb1djaew5x
- SHA256 51530c2fc08eecc67a9c45c6822f671b333f0e6cfcf2ec04a3c6e7bd9b191602
- MD5 1180caa89ddf31ddbf94a6ffb9832c39
- SHA1 0874677aa44eb91628e7daf5dae05b5afb3f5bf5
- SHA512 7b23cbf0e6faac40a90bf76923b1d470cfb3aa6d1f2ed68ea444e59fcb20973de5073fe0d178b9ba1016dcabf33fddb739147a060d662ac49985d39505f40a0b
- SSDEEP 12288:VuelPWET0yhnHBYlD6LQ6Z7C+6OtZy9fyopDZuL:8eEEvhHBWuku16O7o3DoL
- TLSH T173C4DF11B6C8C436F1F32A345AF59762497B7D619B31D9CB2B88222E1EF02D1E678713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3152 7A7A.tmp 4184 7AC9.tmp 1728 7B17.tmp 2376 7B84.tmp 1136 7BD2.tmp 2192 7C40.tmp 1072 7C8E.tmp 856 7CEB.tmp 1988 7D49.tmp 3296 7D97.tmp 4956 7DE5.tmp 1932 7E34.tmp 4524 7E82.tmp 2624 7EDF.tmp 380 7F2E.tmp 4652 7F9B.tmp 1788 7FE9.tmp 2152 8037.tmp 1372 8085.tmp 2676 8112.tmp 3760 818F.tmp 3352 81DD.tmp 5064 824A.tmp 4260 8299.tmp 4408 82E7.tmp 3260 8335.tmp 2308 83A2.tmp 4788 83F0.tmp 1028 843E.tmp 2484 848D.tmp 4228 84DB.tmp 4248 8529.tmp 2196 85C5.tmp 3488 8604.tmp 3956 8652.tmp 2400 86A0.tmp 1116 86DE.tmp 1252 871D.tmp 2784 877B.tmp 2288 87C9.tmp 4888 8817.tmp 2500 8865.tmp 3516 88A3.tmp 4224 88F2.tmp 4764 8940.tmp 4668 897E.tmp 4532 89CC.tmp 5096 8A1A.tmp 3772 8A69.tmp 3044 8AB7.tmp 828 8AF5.tmp 1248 8B43.tmp 3544 8B91.tmp 2132 8BE0.tmp 1276 8C2E.tmp 1152 8C7C.tmp 4696 8CCA.tmp 1680 8D18.tmp 1472 8D57.tmp 2056 8D95.tmp 4964 8DE3.tmp 3492 8E31.tmp 2160 8E7F.tmp 1508 8EBE.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F98E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B467.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7064.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 549E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CAD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 3152 3676 2026-05-18_1180caa89ddf31ddbf94a6ffb9832c39_elex_mafia.exe 87 PID 3152 wrote to memory of 4184 3152 7A7A.tmp 89 PID 4184 wrote to memory of 1728 4184 7AC9.tmp 90 PID 1728 wrote to memory of 2376 1728 7B17.tmp 91 PID 2376 wrote to memory of 1136 2376 7B84.tmp 93 PID 1136 wrote to memory of 2192 1136 7BD2.tmp 94 PID 2192 wrote to memory of 1072 2192 7C40.tmp 95 PID 1072 wrote to memory of 856 1072 7C8E.tmp 96 PID 856 wrote to memory of 1988 856 7CEB.tmp 97 PID 1988 wrote to memory of 3296 1988 7D49.tmp 98 PID 3296 wrote to memory of 4956 3296 7D97.tmp 99 PID 4956 wrote to memory of 1932 4956 7DE5.tmp 100 PID 1932 wrote to memory of 4524 1932 7E34.tmp 101 PID 4524 wrote to memory of 2624 4524 7E82.tmp 102 PID 2624 wrote to memory of 380 2624 7EDF.tmp 103 PID 380 wrote to memory of 4652 380 7F2E.tmp 104 PID 4652 wrote to memory of 1788 4652 7F9B.tmp 105 PID 1788 wrote to memory of 2152 1788 7FE9.tmp 106 PID 2152 wrote to memory of 1372 2152 8037.tmp 107 PID 1372 wrote to memory of 2676 1372 8085.tmp 108 PID 2676 wrote to memory of 3760 2676 8112.tmp 109 PID 3760 wrote to memory of 3352 3760 818F.tmp 110 PID 3352 wrote to memory of 5064 3352 81DD.tmp 111 PID 5064 wrote to memory of 4260 5064 824A.tmp 112 PID 4260 wrote to memory of 4408 4260 8299.tmp 113 PID 4408 wrote to memory of 3260 4408 82E7.tmp 114 PID 3260 wrote to memory of 2308 3260 8335.tmp 115 PID 2308 wrote to memory of 4788 2308 83A2.tmp 116 PID 4788 wrote to memory of 1028 4788 83F0.tmp 117 PID 1028 wrote to memory of 2484 1028 843E.tmp 118 PID 2484 wrote to memory of 4228 2484 848D.tmp 119 PID 4228 wrote to memory of 4248 4228 84DB.tmp 120 PID 4248 wrote to memory of 2196 4248 8529.tmp 121 PID 2196 wrote to memory of 3488 2196 85C5.tmp 122 PID 3488 wrote to memory of 3956 3488 8604.tmp 123 PID 3956 wrote to memory of 2400 3956 8652.tmp 124 PID 2400 wrote to memory of 1116 2400 86A0.tmp 125 PID 1116 wrote to memory of 1252 1116 86DE.tmp 126 PID 1252 wrote to memory of 2784 1252 871D.tmp 127 PID 2784 wrote to memory of 2288 2784 877B.tmp 128 PID 2288 wrote to memory of 4888 2288 87C9.tmp 129 PID 4888 wrote to memory of 2500 4888 8817.tmp 130 PID 2500 wrote to memory of 3516 2500 8865.tmp 131 PID 3516 wrote to memory of 4224 3516 88A3.tmp 132 PID 4224 wrote to memory of 4764 4224 88F2.tmp 133 PID 4764 wrote to memory of 4668 4764 8940.tmp 134 PID 4668 wrote to memory of 4532 4668 897E.tmp 135 PID 4532 wrote to memory of 5096 4532 89CC.tmp 136 PID 5096 wrote to memory of 3772 5096 8A1A.tmp 137 PID 3772 wrote to memory of 3044 3772 8A69.tmp 138 PID 3044 wrote to memory of 828 3044 8AB7.tmp 139 PID 828 wrote to memory of 1248 828 8AF5.tmp 140 PID 1248 wrote to memory of 3544 1248 8B43.tmp 141 PID 3544 wrote to memory of 2132 3544 8B91.tmp 142 PID 2132 wrote to memory of 1276 2132 8BE0.tmp 143 PID 1276 wrote to memory of 1152 1276 8C2E.tmp 144 PID 1152 wrote to memory of 4696 1152 8C7C.tmp 145 PID 4696 wrote to memory of 1680 4696 8CCA.tmp 146 PID 1680 wrote to memory of 1472 1680 8D18.tmp 147 PID 1472 wrote to memory of 2056 1472 8D57.tmp 148 PID 2056 wrote to memory of 4964 2056 8D95.tmp 149 PID 4964 wrote to memory of 3492 4964 8DE3.tmp 150 PID 3492 wrote to memory of 2160 3492 8E31.tmp 151 PID 2160 wrote to memory of 1508 2160 8E7F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_1180caa89ddf31ddbf94a6ffb9832c39_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_1180caa89ddf31ddbf94a6ffb9832c39_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\7B17.tmp"C:\Users\Admin\AppData\Local\Temp\7B17.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\7C40.tmp"C:\Users\Admin\AppData\Local\Temp\7C40.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\848D.tmp"C:\Users\Admin\AppData\Local\Temp\848D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\84DB.tmp"C:\Users\Admin\AppData\Local\Temp\84DB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\8529.tmp"C:\Users\Admin\AppData\Local\Temp\8529.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8604.tmp"C:\Users\Admin\AppData\Local\Temp\8604.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8817.tmp"C:\Users\Admin\AppData\Local\Temp\8817.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\897E.tmp"C:\Users\Admin\AppData\Local\Temp\897E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\89CC.tmp"C:\Users\Admin\AppData\Local\Temp\89CC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8A69.tmp"C:\Users\Admin\AppData\Local\Temp\8A69.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\8B91.tmp"C:\Users\Admin\AppData\Local\Temp\8B91.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"65⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"66⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"67⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8F89.tmp"C:\Users\Admin\AppData\Local\Temp\8F89.tmp"68⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"69⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\9025.tmp"C:\Users\Admin\AppData\Local\Temp\9025.tmp"70⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\9073.tmp"C:\Users\Admin\AppData\Local\Temp\9073.tmp"71⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\90C2.tmp"C:\Users\Admin\AppData\Local\Temp\90C2.tmp"72⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"73⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"74⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"75⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\91DB.tmp"C:\Users\Admin\AppData\Local\Temp\91DB.tmp"76⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\9229.tmp"C:\Users\Admin\AppData\Local\Temp\9229.tmp"77⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"78⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"79⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\9313.tmp"C:\Users\Admin\AppData\Local\Temp\9313.tmp"80⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\9361.tmp"C:\Users\Admin\AppData\Local\Temp\9361.tmp"81⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\93B0.tmp"C:\Users\Admin\AppData\Local\Temp\93B0.tmp"82⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"83⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"84⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"85⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"86⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\9507.tmp"C:\Users\Admin\AppData\Local\Temp\9507.tmp"87⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"88⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"89⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\9630.tmp"C:\Users\Admin\AppData\Local\Temp\9630.tmp"90⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\967E.tmp"C:\Users\Admin\AppData\Local\Temp\967E.tmp"91⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\96CC.tmp"C:\Users\Admin\AppData\Local\Temp\96CC.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"93⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"94⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9798.tmp"C:\Users\Admin\AppData\Local\Temp\9798.tmp"95⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\97D6.tmp"C:\Users\Admin\AppData\Local\Temp\97D6.tmp"96⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\9815.tmp"C:\Users\Admin\AppData\Local\Temp\9815.tmp"97⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\9863.tmp"C:\Users\Admin\AppData\Local\Temp\9863.tmp"98⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"99⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\98E0.tmp"C:\Users\Admin\AppData\Local\Temp\98E0.tmp"100⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"101⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\996C.tmp"C:\Users\Admin\AppData\Local\Temp\996C.tmp"102⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\99AB.tmp"C:\Users\Admin\AppData\Local\Temp\99AB.tmp"103⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"104⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"105⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"107⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"108⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"110⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"111⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"112⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"113⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"114⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\9D16.tmp"C:\Users\Admin\AppData\Local\Temp\9D16.tmp"115⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"116⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"117⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"118⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"119⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"120⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\A062.tmp"C:\Users\Admin\AppData\Local\Temp\A062.tmp"121⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:1824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-