Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 21:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_093fbe3ff66a4534adf7ed47e05ad410_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_093fbe3ff66a4534adf7ed47e05ad410_elex_mafia.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-08_093fbe3ff66a4534adf7ed47e05ad410_elex_mafia.exe
- Size 524KB
- Sample260708-zws2ysas21
- SHA256 1fe23483b3d15362ac3bc4f77509368f2ed9459f6a63f22cae7f21d0b6a25249
- MD5 093fbe3ff66a4534adf7ed47e05ad410
- SHA1 9fda9d8349352502f5d2e77efd2ff5d39480f0fa
- SHA512 deaee6b02e7da06f71f61aa3722739ae4732c4db697d788ebcd69886d53a820dfba6f7083e299f8aba2d78feea76a42c295a08f99e6540047937bc11082b9068
- SSDEEP 12288:TRyZzqyL66TPub9mR1XQe7WEBzjrvMrNZ:TRyQylTPub9ne7WEkN
- TLSH T13AB4F116B584C432E58206324B66EB52997A7D75AB27A4CB3B84363D2FF03D0E7B4347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3400 4273.tmp 2132 43AB.tmp 3088 44A5.tmp 1196 4580.tmp 2836 467A.tmp 3644 47B2.tmp 1456 488D.tmp 3256 49A6.tmp 4704 4A91.tmp 2496 4BAA.tmp 2112 4CB4.tmp 1848 4DAE.tmp 3916 4E88.tmp 2292 4F54.tmp 2432 502E.tmp 3352 5128.tmp 4000 5222.tmp 1816 52ED.tmp 5064 53C8.tmp 4020 5520.tmp 996 55FB.tmp 800 5714.tmp 3688 57EF.tmp 4452 58C9.tmp 208 59A4.tmp 4636 5A6F.tmp 4952 5B4A.tmp 1016 5C34.tmp 1120 5D1F.tmp 560 5DDA.tmp 464 5E96.tmp 3276 5FAF.tmp 4896 60A9.tmp 4312 6145.tmp 1832 61D2.tmp 2764 626E.tmp 3160 630A.tmp 1100 6397.tmp 2544 6433.tmp 1728 64A1.tmp 3836 653D.tmp 3340 65CA.tmp 2624 6656.tmp 4920 66E3.tmp 2308 676F.tmp 5080 67DD.tmp 3552 685A.tmp 812 68E6.tmp 4192 6963.tmp 4464 69B2.tmp 1336 6A0F.tmp 3252 6A5D.tmp 1244 6AAC.tmp 4580 6B09.tmp 2100 6B57.tmp 3096 6BA6.tmp 808 6BF4.tmp 1052 6C42.tmp 3960 6C90.tmp 4780 6CDE.tmp 1696 6D2C.tmp 2880 6D7A.tmp 4284 6DC8.tmp 4736 6E36.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 335B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F911.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 791E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 874C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C56E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 624A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 937C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8469.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 3400 1548 2026-07-08_093fbe3ff66a4534adf7ed47e05ad410_elex_mafia.exe 86 PID 3400 wrote to memory of 2132 3400 4273.tmp 87 PID 2132 wrote to memory of 3088 2132 43AB.tmp 88 PID 3088 wrote to memory of 1196 3088 44A5.tmp 89 PID 1196 wrote to memory of 2836 1196 4580.tmp 90 PID 2836 wrote to memory of 3644 2836 467A.tmp 91 PID 3644 wrote to memory of 1456 3644 47B2.tmp 92 PID 1456 wrote to memory of 3256 1456 488D.tmp 93 PID 3256 wrote to memory of 4704 3256 49A6.tmp 94 PID 4704 wrote to memory of 2496 4704 4A91.tmp 95 PID 2496 wrote to memory of 2112 2496 4BAA.tmp 96 PID 2112 wrote to memory of 1848 2112 4CB4.tmp 97 PID 1848 wrote to memory of 3916 1848 4DAE.tmp 98 PID 3916 wrote to memory of 2292 3916 4E88.tmp 99 PID 2292 wrote to memory of 2432 2292 4F54.tmp 100 PID 2432 wrote to memory of 3352 2432 502E.tmp 101 PID 3352 wrote to memory of 4000 3352 5128.tmp 102 PID 4000 wrote to memory of 1816 4000 5222.tmp 103 PID 1816 wrote to memory of 5064 1816 52ED.tmp 104 PID 5064 wrote to memory of 4020 5064 53C8.tmp 105 PID 4020 wrote to memory of 996 4020 5520.tmp 106 PID 996 wrote to memory of 800 996 55FB.tmp 107 PID 800 wrote to memory of 3688 800 5714.tmp 108 PID 3688 wrote to memory of 4452 3688 57EF.tmp 109 PID 4452 wrote to memory of 208 4452 58C9.tmp 110 PID 208 wrote to memory of 4636 208 59A4.tmp 111 PID 4636 wrote to memory of 4952 4636 5A6F.tmp 112 PID 4952 wrote to memory of 1016 4952 5B4A.tmp 113 PID 1016 wrote to memory of 1120 1016 5C34.tmp 114 PID 1120 wrote to memory of 560 1120 5D1F.tmp 115 PID 560 wrote to memory of 464 560 5DDA.tmp 116 PID 464 wrote to memory of 3276 464 5E96.tmp 117 PID 3276 wrote to memory of 4896 3276 5FAF.tmp 118 PID 4896 wrote to memory of 4312 4896 60A9.tmp 119 PID 4312 wrote to memory of 1832 4312 6145.tmp 120 PID 1832 wrote to memory of 2764 1832 61D2.tmp 121 PID 2764 wrote to memory of 3160 2764 626E.tmp 122 PID 3160 wrote to memory of 1100 3160 630A.tmp 123 PID 1100 wrote to memory of 2544 1100 6397.tmp 124 PID 2544 wrote to memory of 1728 2544 6433.tmp 125 PID 1728 wrote to memory of 3836 1728 64A1.tmp 126 PID 3836 wrote to memory of 3340 3836 653D.tmp 127 PID 3340 wrote to memory of 2624 3340 65CA.tmp 128 PID 2624 wrote to memory of 4920 2624 6656.tmp 129 PID 4920 wrote to memory of 2308 4920 66E3.tmp 130 PID 2308 wrote to memory of 5080 2308 676F.tmp 131 PID 5080 wrote to memory of 3552 5080 67DD.tmp 132 PID 3552 wrote to memory of 812 3552 685A.tmp 133 PID 812 wrote to memory of 4192 812 68E6.tmp 134 PID 4192 wrote to memory of 4464 4192 6963.tmp 135 PID 4464 wrote to memory of 1336 4464 69B2.tmp 136 PID 1336 wrote to memory of 3252 1336 6A0F.tmp 138 PID 3252 wrote to memory of 1244 3252 6A5D.tmp 139 PID 1244 wrote to memory of 4580 1244 6AAC.tmp 140 PID 4580 wrote to memory of 2100 4580 6B09.tmp 141 PID 2100 wrote to memory of 3096 2100 6B57.tmp 142 PID 3096 wrote to memory of 808 3096 6BA6.tmp 143 PID 808 wrote to memory of 1052 808 6BF4.tmp 144 PID 1052 wrote to memory of 3960 1052 6C42.tmp 145 PID 3960 wrote to memory of 4780 3960 6C90.tmp 146 PID 4780 wrote to memory of 1696 4780 6CDE.tmp 147 PID 1696 wrote to memory of 2880 1696 6D2C.tmp 148 PID 2880 wrote to memory of 4284 2880 6D7A.tmp 149 PID 4284 wrote to memory of 4736 4284 6DC8.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_093fbe3ff66a4534adf7ed47e05ad410_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_093fbe3ff66a4534adf7ed47e05ad410_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\47B2.tmp"C:\Users\Admin\AppData\Local\Temp\47B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\630A.tmp"C:\Users\Admin\AppData\Local\Temp\630A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"65⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"66⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"67⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"68⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"69⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"70⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"71⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"72⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\70B6.tmp"C:\Users\Admin\AppData\Local\Temp\70B6.tmp"73⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"74⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"75⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"76⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\71FF.tmp"C:\Users\Admin\AppData\Local\Temp\71FF.tmp"77⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"78⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"79⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"80⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"81⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"82⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"83⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"84⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"85⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"86⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"87⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"88⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"89⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"90⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"91⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\76E1.tmp"C:\Users\Admin\AppData\Local\Temp\76E1.tmp"92⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"93⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"94⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"96⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"97⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\78C5.tmp"C:\Users\Admin\AppData\Local\Temp\78C5.tmp"98⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"99⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\7961.tmp"C:\Users\Admin\AppData\Local\Temp\7961.tmp"100⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\79AF.tmp"C:\Users\Admin\AppData\Local\Temp\79AF.tmp"101⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"102⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"103⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"105⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"106⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"107⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"108⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"109⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"110⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"111⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"112⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"113⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"114⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"115⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"116⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"117⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"118⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"119⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"120⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"121⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-