Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe
- Size 524KB
- Sample260730-eeccnasvgt
- SHA256 6a47c3dc7e2067a39029add4448ab2b49a27e18c2ea37851619b942fb50d7b27
- MD5 1f1677ce8c27488621f5f712b5c625f0
- SHA1 638b2e53c857657b169d45ade1273f2e1137a407
- SHA512 19f4ba394279b3c3986359c8b7aec0c768bec2868f02aa3bef35a966a6a4c042936b92eb1ab30037a64272e813ea1baf8ad3a5d4f0c00840aadd76ca5c7487b7
- SSDEEP 12288:TRyZzqyL66T6DL86hpt3k7DI30jnKo/CmCJF4jNZ:TRyQylT65pUI6nKo6TMN
- TLSH T1C9B4F025BA85C032F19205768A26EB62597F7CB55B27A4CB3B95363D2FB03D1E274303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1584 8E70.tmp 3144 8F99.tmp 2424 90A2.tmp 4348 91BC.tmp 1956 92C5.tmp 4864 9390.tmp 328 948A.tmp 820 9546.tmp 4752 969E.tmp 4872 97A7.tmp 1020 9892.tmp 4120 998C.tmp 4060 9A66.tmp 2440 9B51.tmp 4052 9C4B.tmp 1296 9D35.tmp 1344 9E10.tmp 540 9E5E.tmp 1832 9F39.tmp 4328 9FC5.tmp 3356 A023.tmp 4068 A15C.tmp 3880 A1AA.tmp 3812 A246.tmp 4656 A2A4.tmp 3092 A301.tmp 3604 A3BD.tmp 740 A459.tmp 1948 A4C7.tmp 4732 A534.tmp 2004 A592.tmp 3916 A5EF.tmp 4808 A64D.tmp 3704 A6AB.tmp 1080 A738.tmp 1980 A7A5.tmp 2180 A803.tmp 1840 A860.tmp 4700 A8CE.tmp 4916 A91C.tmp 748 A97A.tmp 2716 A9C8.tmp 3268 AA16.tmp 1604 AA64.tmp 904 AAB2.tmp 3996 AB20.tmp 2700 AB7D.tmp 372 ABDB.tmp 3708 AC29.tmp 2272 AC87.tmp 212 ACD5.tmp 1156 AD23.tmp 936 AD71.tmp 3848 ADBF.tmp 2472 AE0E.tmp 3864 AE5C.tmp 3348 AEAA.tmp 4388 AEF8.tmp 4836 AF46.tmp 948 AF94.tmp 1460 AFE2.tmp 724 B030.tmp 924 B07F.tmp 4460 B0CD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 748A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E51B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 527B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA39.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3336 wrote to memory of 1584 3336 2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe 86 PID 1584 wrote to memory of 3144 1584 8E70.tmp 87 PID 3144 wrote to memory of 2424 3144 8F99.tmp 88 PID 2424 wrote to memory of 4348 2424 90A2.tmp 89 PID 4348 wrote to memory of 1956 4348 91BC.tmp 90 PID 1956 wrote to memory of 4864 1956 92C5.tmp 91 PID 4864 wrote to memory of 328 4864 9390.tmp 92 PID 328 wrote to memory of 820 328 948A.tmp 93 PID 820 wrote to memory of 4752 820 9546.tmp 94 PID 4752 wrote to memory of 4872 4752 969E.tmp 95 PID 4872 wrote to memory of 1020 4872 97A7.tmp 96 PID 1020 wrote to memory of 4120 1020 9892.tmp 97 PID 4120 wrote to memory of 4060 4120 998C.tmp 98 PID 4060 wrote to memory of 2440 4060 9A66.tmp 101 PID 2440 wrote to memory of 4052 2440 9B51.tmp 102 PID 4052 wrote to memory of 1296 4052 9C4B.tmp 103 PID 1296 wrote to memory of 1344 1296 9D35.tmp 104 PID 1344 wrote to memory of 540 1344 9E10.tmp 105 PID 540 wrote to memory of 1832 540 9E5E.tmp 107 PID 1832 wrote to memory of 4328 1832 9F39.tmp 108 PID 4328 wrote to memory of 3356 4328 9FC5.tmp 109 PID 3356 wrote to memory of 4068 3356 A023.tmp 111 PID 4068 wrote to memory of 3880 4068 A15C.tmp 112 PID 3880 wrote to memory of 3812 3880 A1AA.tmp 113 PID 3812 wrote to memory of 4656 3812 A246.tmp 114 PID 4656 wrote to memory of 3092 4656 A2A4.tmp 116 PID 3092 wrote to memory of 3604 3092 A301.tmp 117 PID 3604 wrote to memory of 740 3604 A3BD.tmp 120 PID 740 wrote to memory of 1948 740 A459.tmp 122 PID 1948 wrote to memory of 4732 1948 A4C7.tmp 123 PID 4732 wrote to memory of 2004 4732 A534.tmp 124 PID 2004 wrote to memory of 3916 2004 A592.tmp 125 PID 3916 wrote to memory of 4808 3916 A5EF.tmp 126 PID 4808 wrote to memory of 3704 4808 A64D.tmp 127 PID 3704 wrote to memory of 1080 3704 A6AB.tmp 128 PID 1080 wrote to memory of 1980 1080 A738.tmp 129 PID 1980 wrote to memory of 2180 1980 A7A5.tmp 130 PID 2180 wrote to memory of 1840 2180 A803.tmp 131 PID 1840 wrote to memory of 4700 1840 A860.tmp 132 PID 4700 wrote to memory of 4916 4700 A8CE.tmp 133 PID 4916 wrote to memory of 748 4916 A91C.tmp 134 PID 748 wrote to memory of 2716 748 A97A.tmp 135 PID 2716 wrote to memory of 3268 2716 A9C8.tmp 136 PID 3268 wrote to memory of 1604 3268 AA16.tmp 137 PID 1604 wrote to memory of 904 1604 AA64.tmp 138 PID 904 wrote to memory of 3996 904 AAB2.tmp 140 PID 3996 wrote to memory of 2700 3996 AB20.tmp 141 PID 2700 wrote to memory of 372 2700 AB7D.tmp 142 PID 372 wrote to memory of 3708 372 ABDB.tmp 143 PID 3708 wrote to memory of 2272 3708 AC29.tmp 144 PID 2272 wrote to memory of 212 2272 AC87.tmp 145 PID 212 wrote to memory of 1156 212 ACD5.tmp 146 PID 1156 wrote to memory of 936 1156 AD23.tmp 147 PID 936 wrote to memory of 3848 936 AD71.tmp 148 PID 3848 wrote to memory of 2472 3848 ADBF.tmp 149 PID 2472 wrote to memory of 3864 2472 AE0E.tmp 150 PID 3864 wrote to memory of 3348 3864 AE5C.tmp 151 PID 3348 wrote to memory of 4388 3348 AEAA.tmp 152 PID 4388 wrote to memory of 4836 4388 AEF8.tmp 153 PID 4836 wrote to memory of 948 4836 AF46.tmp 154 PID 948 wrote to memory of 1460 948 AF94.tmp 118 PID 1460 wrote to memory of 724 1460 AFE2.tmp 156 PID 724 wrote to memory of 924 724 B030.tmp 157 PID 924 wrote to memory of 4460 924 B07F.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1f1677ce8c27488621f5f712b5c625f0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\8F99.tmp"C:\Users\Admin\AppData\Local\Temp\8F99.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\91BC.tmp"C:\Users\Admin\AppData\Local\Temp\91BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\948A.tmp"C:\Users\Admin\AppData\Local\Temp\948A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\998C.tmp"C:\Users\Admin\AppData\Local\Temp\998C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\9E10.tmp"C:\Users\Admin\AppData\Local\Temp\9E10.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\9F39.tmp"C:\Users\Admin\AppData\Local\Temp\9F39.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\A023.tmp"C:\Users\Admin\AppData\Local\Temp\A023.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\A459.tmp"C:\Users\Admin\AppData\Local\Temp\A459.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\A534.tmp"C:\Users\Admin\AppData\Local\Temp\A534.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\A97A.tmp"C:\Users\Admin\AppData\Local\Temp\A97A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\AA64.tmp"C:\Users\Admin\AppData\Local\Temp\AA64.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\AB20.tmp"C:\Users\Admin\AppData\Local\Temp\AB20.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\ADBF.tmp"C:\Users\Admin\AppData\Local\Temp\ADBF.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\AEF8.tmp"C:\Users\Admin\AppData\Local\Temp\AEF8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\AF46.tmp"C:\Users\Admin\AppData\Local\Temp\AF46.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\AF94.tmp"C:\Users\Admin\AppData\Local\Temp\AF94.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\AFE2.tmp"C:\Users\Admin\AppData\Local\Temp\AFE2.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\B07F.tmp"C:\Users\Admin\AppData\Local\Temp\B07F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"65⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\B11B.tmp"C:\Users\Admin\AppData\Local\Temp\B11B.tmp"66⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\B169.tmp"C:\Users\Admin\AppData\Local\Temp\B169.tmp"67⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"68⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"69⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"70⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"71⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"72⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"73⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"74⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\B4B5.tmp"C:\Users\Admin\AppData\Local\Temp\B4B5.tmp"75⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\B522.tmp"C:\Users\Admin\AppData\Local\Temp\B522.tmp"76⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"77⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"78⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\B64B.tmp"C:\Users\Admin\AppData\Local\Temp\B64B.tmp"79⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"80⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"81⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"82⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"83⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\B800.tmp"C:\Users\Admin\AppData\Local\Temp\B800.tmp"84⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\B85E.tmp"C:\Users\Admin\AppData\Local\Temp\B85E.tmp"85⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"87⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\B987.tmp"C:\Users\Admin\AppData\Local\Temp\B987.tmp"88⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\BA04.tmp"C:\Users\Admin\AppData\Local\Temp\BA04.tmp"89⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\BA62.tmp"C:\Users\Admin\AppData\Local\Temp\BA62.tmp"90⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"91⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"92⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"93⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"94⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"95⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"96⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\BD40.tmp"C:\Users\Admin\AppData\Local\Temp\BD40.tmp"97⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"99⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"100⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"101⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\BF63.tmp"C:\Users\Admin\AppData\Local\Temp\BF63.tmp"102⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"103⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\C02E.tmp"C:\Users\Admin\AppData\Local\Temp\C02E.tmp"104⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\C08C.tmp"C:\Users\Admin\AppData\Local\Temp\C08C.tmp"105⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\C157.tmp"C:\Users\Admin\AppData\Local\Temp\C157.tmp"107⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\C222.tmp"C:\Users\Admin\AppData\Local\Temp\C222.tmp"109⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"110⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"111⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"112⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\C36A.tmp"C:\Users\Admin\AppData\Local\Temp\C36A.tmp"113⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"114⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"115⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:988 -
C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"117⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"118⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"119⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"120⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\C668.tmp"C:\Users\Admin\AppData\Local\Temp\C668.tmp"121⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-