Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 16:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe
- Size 520KB
- Sample260802-tpaddacm41
- SHA256 a83b7bf2fffbbd6a21275e10a88653db813c722bf7b732866833efb78cb0e6f4
- MD5 f10bfea3d11bd171ef1afb20624c501a
- SHA1 251e50307224b30ab32f5705796de881280a5013
- SHA512 ef664e3cbde75183e82033b4f569d588bd2b46211b0678cb650d97eef8ba7dae35996ebf9c9ee179ee8fa2a314547420c1e3efbfd2c11393cb9ae4744e12ce02
- SSDEEP 12288:gj8fuxR21t5i8fSm624OyywaahswjrV27SqoO0flNZ6:gj8fuK1GYSywapO5qSXNI
- TLSH T18BB4F112B548C033E9E215314B56DBA65BBA7C794B3296C73BC436AC6FB52C1D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3756 2B80.tmp 1552 2C1C.tmp 3308 2CD7.tmp 3296 2DB2.tmp 4332 2E4E.tmp 3984 2EDB.tmp 3844 2F97.tmp 3784 3023.tmp 1232 30BF.tmp 2148 316B.tmp 3528 3217.tmp 2740 32D3.tmp 1112 335F.tmp 2572 33DC.tmp 5020 3498.tmp 4924 3534.tmp 3564 35C1.tmp 5100 366D.tmp 1936 3718.tmp 4872 37C4.tmp 1460 3841.tmp 3324 38ED.tmp 3120 3989.tmp 3628 3A16.tmp 3716 3AC2.tmp 1788 3B6E.tmp 2184 3C1A.tmp 540 3C97.tmp 4600 3D43.tmp 4984 3E0E.tmp 3968 3E7B.tmp 368 3F27.tmp 3856 3FF2.tmp 3584 4040.tmp 3832 408E.tmp 4508 40DC.tmp 2084 412B.tmp 1720 4198.tmp 5092 41F6.tmp 3896 4263.tmp 4928 42C1.tmp 4204 431F.tmp 3000 436D.tmp 2448 43BB.tmp 3732 4409.tmp 3364 4467.tmp 4512 44B5.tmp 2416 4503.tmp 700 4561.tmp 3960 45BE.tmp 3604 461C.tmp 4520 466A.tmp 1904 46B8.tmp 4636 4707.tmp 2420 4755.tmp 2660 47A3.tmp 5024 4801.tmp 3500 486E.tmp 3744 48BC.tmp 1852 4929.tmp 4880 4987.tmp 1364 49D5.tmp 3552 4A81.tmp 2384 4ACF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A515.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 412B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 404B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 425E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4012 wrote to memory of 3756 4012 2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe 84 PID 3756 wrote to memory of 1552 3756 2B80.tmp 85 PID 1552 wrote to memory of 3308 1552 2C1C.tmp 86 PID 3308 wrote to memory of 3296 3308 2CD7.tmp 87 PID 3296 wrote to memory of 4332 3296 2DB2.tmp 88 PID 4332 wrote to memory of 3984 4332 2E4E.tmp 89 PID 3984 wrote to memory of 3844 3984 2EDB.tmp 90 PID 3844 wrote to memory of 3784 3844 2F97.tmp 91 PID 3784 wrote to memory of 1232 3784 3023.tmp 92 PID 1232 wrote to memory of 2148 1232 30BF.tmp 93 PID 2148 wrote to memory of 3528 2148 316B.tmp 94 PID 3528 wrote to memory of 2740 3528 3217.tmp 95 PID 2740 wrote to memory of 1112 2740 32D3.tmp 96 PID 1112 wrote to memory of 2572 1112 335F.tmp 97 PID 2572 wrote to memory of 5020 2572 33DC.tmp 98 PID 5020 wrote to memory of 4924 5020 3498.tmp 99 PID 4924 wrote to memory of 3564 4924 3534.tmp 100 PID 3564 wrote to memory of 5100 3564 35C1.tmp 101 PID 5100 wrote to memory of 1936 5100 366D.tmp 102 PID 1936 wrote to memory of 4872 1936 3718.tmp 103 PID 4872 wrote to memory of 1460 4872 37C4.tmp 104 PID 1460 wrote to memory of 3324 1460 3841.tmp 105 PID 3324 wrote to memory of 3120 3324 38ED.tmp 106 PID 3120 wrote to memory of 3628 3120 3989.tmp 107 PID 3628 wrote to memory of 3716 3628 3A16.tmp 108 PID 3716 wrote to memory of 1788 3716 3AC2.tmp 109 PID 1788 wrote to memory of 2184 1788 3B6E.tmp 110 PID 2184 wrote to memory of 540 2184 3C1A.tmp 112 PID 540 wrote to memory of 4600 540 3C97.tmp 113 PID 4600 wrote to memory of 4984 4600 3D43.tmp 114 PID 4984 wrote to memory of 3968 4984 3E0E.tmp 115 PID 3968 wrote to memory of 368 3968 3E7B.tmp 116 PID 368 wrote to memory of 3856 368 3F27.tmp 117 PID 3856 wrote to memory of 3584 3856 3FF2.tmp 118 PID 3584 wrote to memory of 3832 3584 4040.tmp 119 PID 3832 wrote to memory of 4508 3832 408E.tmp 120 PID 4508 wrote to memory of 2084 4508 40DC.tmp 121 PID 2084 wrote to memory of 1720 2084 412B.tmp 122 PID 1720 wrote to memory of 5092 1720 4198.tmp 123 PID 5092 wrote to memory of 3896 5092 41F6.tmp 124 PID 3896 wrote to memory of 4928 3896 4263.tmp 125 PID 4928 wrote to memory of 4204 4928 42C1.tmp 126 PID 4204 wrote to memory of 3000 4204 431F.tmp 127 PID 3000 wrote to memory of 2448 3000 436D.tmp 128 PID 2448 wrote to memory of 3732 2448 43BB.tmp 129 PID 3732 wrote to memory of 3364 3732 4409.tmp 130 PID 3364 wrote to memory of 4512 3364 4467.tmp 131 PID 4512 wrote to memory of 2416 4512 44B5.tmp 132 PID 2416 wrote to memory of 700 2416 4503.tmp 133 PID 700 wrote to memory of 3960 700 4561.tmp 134 PID 3960 wrote to memory of 3604 3960 45BE.tmp 135 PID 3604 wrote to memory of 4520 3604 461C.tmp 136 PID 4520 wrote to memory of 1904 4520 466A.tmp 137 PID 1904 wrote to memory of 4636 1904 46B8.tmp 138 PID 4636 wrote to memory of 2420 4636 4707.tmp 139 PID 2420 wrote to memory of 2660 2420 4755.tmp 140 PID 2660 wrote to memory of 5024 2660 47A3.tmp 141 PID 5024 wrote to memory of 3500 5024 4801.tmp 142 PID 3500 wrote to memory of 3744 3500 486E.tmp 143 PID 3744 wrote to memory of 1852 3744 48BC.tmp 144 PID 1852 wrote to memory of 4880 1852 4929.tmp 145 PID 4880 wrote to memory of 1364 4880 4987.tmp 146 PID 4180 wrote to memory of 3552 4180 4A23.tmp 148 PID 3552 wrote to memory of 2384 3552 4A81.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"63⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"64⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"67⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"69⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"70⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"71⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"72⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"73⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"74⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"75⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"76⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"77⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"78⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"79⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"80⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"81⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"82⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"83⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"84⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"85⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"86⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"88⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"89⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"90⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"91⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"92⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"93⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"94⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"95⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"96⤵PID:176
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"97⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"98⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"99⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"100⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"101⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"102⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"103⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"104⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"105⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"106⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"108⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"109⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"110⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"111⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"112⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"113⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"114⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"115⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"116⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"117⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"118⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"119⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"120⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"121⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"122⤵PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-