Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe
- Size 524KB
- Sample260712-vffdpsfx5s
- SHA256 43eadd2088da49a9b3aabaa15ec24c50349dacd6ca867d1143cf7699ecb866fe
- MD5 6c909161e72641e2d03b70fa1c9153fb
- SHA1 0db2ce3503fbd37928397f7bf91f9b201f746316
- SHA512 ea42f14eee14882884d1a38d2aa73e07f80b353969ee95a95532d4091078f694dead477e59bd03e18bbf347f1a28f70f616fdd058bfca01bb64ec0f0aaf78984
- SSDEEP 12288:TRyZzqyL66TizNMNHLArCxhA1d/swTHykOvMqNZ:TRyQylTiBQHUrCxKTSkdqN
- TLSH T1B0B4F126B184C032F69200718B16EBA2593ABD759727A4CB7BD52A7D2FF03D1E274307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2308 7CBD.tmp 2272 7DE5.tmp 4468 7EC0.tmp 312 7F9B.tmp 4004 8076.tmp 4720 819F.tmp 2792 8289.tmp 2356 83A2.tmp 3328 848D.tmp 3456 8558.tmp 4884 8652.tmp 3232 875B.tmp 4816 8817.tmp 3884 88F2.tmp 4684 89BD.tmp 3248 8AB7.tmp 4264 8B63.tmp 2120 8C7C.tmp 4464 8D47.tmp 3392 8E22.tmp 3944 8F0C.tmp 4240 9006.tmp 2504 90F0.tmp 1500 920A.tmp 4484 92C5.tmp 4876 93CF.tmp 2784 94AA.tmp 3840 95B3.tmp 1888 968E.tmp 1824 9749.tmp 4228 9843.tmp 1992 990F.tmp 4668 9A09.tmp 1580 9AB4.tmp 4676 9B41.tmp 4788 9BED.tmp 3564 9C6A.tmp 4284 9D06.tmp 4848 9D93.tmp 2264 9E00.tmp 4140 9E7D.tmp 1860 9EFA.tmp 3516 9F87.tmp 1480 A013.tmp 4156 A0B0.tmp 2500 A12D.tmp 1808 A1E8.tmp 4620 A256.tmp 4304 A2B3.tmp 2176 A311.tmp 4940 A35F.tmp 3588 A3CD.tmp 3508 A42A.tmp 3792 A478.tmp 4268 A4C7.tmp 2344 A515.tmp 3864 A563.tmp 2312 A5B1.tmp 4336 A5FF.tmp 2760 A64D.tmp 4540 A69B.tmp 1624 A6F9.tmp 1956 A757.tmp 3264 A7A5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 817B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 748A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 875B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E41D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 560 wrote to memory of 2308 560 2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe 87 PID 2308 wrote to memory of 2272 2308 7CBD.tmp 88 PID 2272 wrote to memory of 4468 2272 7DE5.tmp 89 PID 4468 wrote to memory of 312 4468 7EC0.tmp 90 PID 312 wrote to memory of 4004 312 7F9B.tmp 91 PID 4004 wrote to memory of 4720 4004 8076.tmp 92 PID 4720 wrote to memory of 2792 4720 819F.tmp 93 PID 2792 wrote to memory of 2356 2792 8289.tmp 94 PID 2356 wrote to memory of 3328 2356 83A2.tmp 95 PID 3328 wrote to memory of 3456 3328 848D.tmp 96 PID 3456 wrote to memory of 4884 3456 8558.tmp 97 PID 4884 wrote to memory of 3232 4884 8652.tmp 98 PID 3232 wrote to memory of 4816 3232 875B.tmp 99 PID 4816 wrote to memory of 3884 4816 8817.tmp 100 PID 3884 wrote to memory of 4684 3884 88F2.tmp 101 PID 4684 wrote to memory of 3248 4684 89BD.tmp 102 PID 3248 wrote to memory of 4264 3248 8AB7.tmp 103 PID 4264 wrote to memory of 2120 4264 8B63.tmp 104 PID 2120 wrote to memory of 4464 2120 8C7C.tmp 105 PID 4464 wrote to memory of 3392 4464 8D47.tmp 106 PID 3392 wrote to memory of 3944 3392 8E22.tmp 107 PID 3944 wrote to memory of 4240 3944 8F0C.tmp 108 PID 4240 wrote to memory of 2504 4240 9006.tmp 109 PID 2504 wrote to memory of 1500 2504 90F0.tmp 110 PID 1500 wrote to memory of 4484 1500 920A.tmp 111 PID 4484 wrote to memory of 4876 4484 92C5.tmp 112 PID 4876 wrote to memory of 2784 4876 93CF.tmp 113 PID 2784 wrote to memory of 3840 2784 94AA.tmp 115 PID 3840 wrote to memory of 1888 3840 95B3.tmp 116 PID 1888 wrote to memory of 1824 1888 968E.tmp 117 PID 1824 wrote to memory of 4228 1824 9749.tmp 118 PID 4228 wrote to memory of 1992 4228 9843.tmp 119 PID 1992 wrote to memory of 4668 1992 990F.tmp 120 PID 4668 wrote to memory of 1580 4668 9A09.tmp 121 PID 1580 wrote to memory of 4676 1580 9AB4.tmp 122 PID 4676 wrote to memory of 4788 4676 9B41.tmp 123 PID 4788 wrote to memory of 3564 4788 9BED.tmp 124 PID 3564 wrote to memory of 4284 3564 9C6A.tmp 125 PID 4284 wrote to memory of 4848 4284 9D06.tmp 126 PID 4848 wrote to memory of 2264 4848 9D93.tmp 127 PID 2264 wrote to memory of 4140 2264 9E00.tmp 128 PID 4140 wrote to memory of 1860 4140 9E7D.tmp 129 PID 1860 wrote to memory of 3516 1860 9EFA.tmp 130 PID 3516 wrote to memory of 1480 3516 9F87.tmp 131 PID 1480 wrote to memory of 4156 1480 A013.tmp 132 PID 4156 wrote to memory of 2500 4156 A0B0.tmp 133 PID 2500 wrote to memory of 1808 2500 A12D.tmp 134 PID 1808 wrote to memory of 4620 1808 A1E8.tmp 135 PID 4620 wrote to memory of 4304 4620 A256.tmp 136 PID 4304 wrote to memory of 2176 4304 A2B3.tmp 137 PID 2176 wrote to memory of 4940 2176 A311.tmp 138 PID 4940 wrote to memory of 3588 4940 A35F.tmp 139 PID 3588 wrote to memory of 3508 3588 A3CD.tmp 140 PID 3508 wrote to memory of 3792 3508 A42A.tmp 142 PID 3792 wrote to memory of 4268 3792 A478.tmp 143 PID 4268 wrote to memory of 2344 4268 A4C7.tmp 145 PID 2344 wrote to memory of 3864 2344 A515.tmp 146 PID 3864 wrote to memory of 2312 3864 A563.tmp 147 PID 2312 wrote to memory of 4336 2312 A5B1.tmp 148 PID 4336 wrote to memory of 2760 4336 A5FF.tmp 149 PID 2760 wrote to memory of 4540 2760 A64D.tmp 150 PID 4540 wrote to memory of 1624 4540 A69B.tmp 151 PID 1624 wrote to memory of 1956 1624 A6F9.tmp 152 PID 1956 wrote to memory of 3264 1956 A757.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_6c909161e72641e2d03b70fa1c9153fb_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\848D.tmp"C:\Users\Admin\AppData\Local\Temp\848D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\875B.tmp"C:\Users\Admin\AppData\Local\Temp\875B.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\8817.tmp"C:\Users\Admin\AppData\Local\Temp\8817.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\8D47.tmp"C:\Users\Admin\AppData\Local\Temp\8D47.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8E22.tmp"C:\Users\Admin\AppData\Local\Temp\8E22.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\94AA.tmp"C:\Users\Admin\AppData\Local\Temp\94AA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\95B3.tmp"C:\Users\Admin\AppData\Local\Temp\95B3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\968E.tmp"C:\Users\Admin\AppData\Local\Temp\968E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\9843.tmp"C:\Users\Admin\AppData\Local\Temp\9843.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\9A09.tmp"C:\Users\Admin\AppData\Local\Temp\9A09.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\9F87.tmp"C:\Users\Admin\AppData\Local\Temp\9F87.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A013.tmp"C:\Users\Admin\AppData\Local\Temp\A013.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\A311.tmp"C:\Users\Admin\AppData\Local\Temp\A311.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A35F.tmp"C:\Users\Admin\AppData\Local\Temp\A35F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"C:\Users\Admin\AppData\Local\Temp\A3CD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\A42A.tmp"C:\Users\Admin\AppData\Local\Temp\A42A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\A478.tmp"C:\Users\Admin\AppData\Local\Temp\A478.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"65⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"66⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\A851.tmp"C:\Users\Admin\AppData\Local\Temp\A851.tmp"67⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\A89F.tmp"C:\Users\Admin\AppData\Local\Temp\A89F.tmp"68⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\A8ED.tmp"C:\Users\Admin\AppData\Local\Temp\A8ED.tmp"69⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"70⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A989.tmp"C:\Users\Admin\AppData\Local\Temp\A989.tmp"71⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\AA26.tmp"C:\Users\Admin\AppData\Local\Temp\AA26.tmp"73⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"74⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"75⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\AB10.tmp"C:\Users\Admin\AppData\Local\Temp\AB10.tmp"76⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"77⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"78⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"79⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"80⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"82⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\AD42.tmp"C:\Users\Admin\AppData\Local\Temp\AD42.tmp"83⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"84⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"85⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"86⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"87⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\AED9.tmp"C:\Users\Admin\AppData\Local\Temp\AED9.tmp"88⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\AF27.tmp"C:\Users\Admin\AppData\Local\Temp\AF27.tmp"89⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\AF85.tmp"C:\Users\Admin\AppData\Local\Temp\AF85.tmp"90⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"91⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B021.tmp"C:\Users\Admin\AppData\Local\Temp\B021.tmp"92⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B07F.tmp"C:\Users\Admin\AppData\Local\Temp\B07F.tmp"93⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"94⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"95⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"96⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"97⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"98⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\B282.tmp"C:\Users\Admin\AppData\Local\Temp\B282.tmp"99⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"100⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"102⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\B3CA.tmp"C:\Users\Admin\AppData\Local\Temp\B3CA.tmp"103⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"104⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\B467.tmp"C:\Users\Admin\AppData\Local\Temp\B467.tmp"105⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\B4B5.tmp"C:\Users\Admin\AppData\Local\Temp\B4B5.tmp"106⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B503.tmp"C:\Users\Admin\AppData\Local\Temp\B503.tmp"107⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\B551.tmp"C:\Users\Admin\AppData\Local\Temp\B551.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"109⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"110⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\B63B.tmp"C:\Users\Admin\AppData\Local\Temp\B63B.tmp"111⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"112⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"113⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B726.tmp"C:\Users\Admin\AppData\Local\Temp\B726.tmp"114⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B774.tmp"C:\Users\Admin\AppData\Local\Temp\B774.tmp"115⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"116⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\B810.tmp"C:\Users\Admin\AppData\Local\Temp\B810.tmp"117⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"118⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"119⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"120⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-