Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 18:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe
- Size 524KB
- Sample260802-xfsedazbpc
- SHA256 d2e26c07e3b3cc1ac2f14e8131d82b723f8aba3792c91ec6e72186e7e6aae2e7
- MD5 459b382b0fc28976e35be90696072d8c
- SHA1 b2d533665dd30dab3092391a2529460c636cdd73
- SHA512 d81f0fdddbfe46a9c51703d34b7a0058ca68db6385b6914be2bcc883b9926fdfdbda81bf57f0b330063511fc77cc0537327a28deba2a379019b12de15988806e
- SSDEEP 12288:TRyZzqyL66T9u7V2Krj7grdqOI/e0Mikko+TNZ:TRyQylT0AkjMpMfMaJN
- TLSH T126B4F1257589C032E28215725E65EBA2193B7D759B27A4CB3BD43A7E2FB12D0D2B4303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 932 484F.tmp 4684 4997.tmp 2848 4AC0.tmp 464 4BD9.tmp 728 4CA4.tmp 3492 4DFC.tmp 884 4F15.tmp 1944 503E.tmp 1704 5128.tmp 4388 5203.tmp 2700 530D.tmp 2164 5455.tmp 3884 5530.tmp 2356 5639.tmp 2292 5781.tmp 2056 583D.tmp 3108 5937.tmp 1828 5A60.tmp 4336 5B5A.tmp 4636 5C73.tmp 624 5D8C.tmp 3732 5E57.tmp 2408 5F71.tmp 316 607A.tmp 1304 61B3.tmp 4360 629D.tmp 4716 63F5.tmp 1980 64EF.tmp 4608 65CA.tmp 3364 66D3.tmp 1556 67BE.tmp 4760 68C7.tmp 4504 69B2.tmp 1844 6A3E.tmp 3128 6B19.tmp 5064 6BD4.tmp 4180 6C80.tmp 640 6D0D.tmp 1676 6DA9.tmp 3396 6E84.tmp 4516 6F30.tmp 1100 6FDC.tmp 1400 7097.tmp 4308 7143.tmp 3156 71EF.tmp 3260 726C.tmp 2172 72E9.tmp 1504 73A4.tmp 4988 7412.tmp 4212 7470.tmp 4440 74BE.tmp 2436 750C.tmp 5008 7579.tmp 3552 75D7.tmp 5040 7635.tmp 4992 7692.tmp 3220 76F0.tmp 4176 775E.tmp 3196 77BB.tmp 1492 7809.tmp 1816 7858.tmp 208 78B5.tmp 5048 7913.tmp 3356 7990.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3320 wrote to memory of 932 3320 2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe 84 PID 932 wrote to memory of 4684 932 484F.tmp 85 PID 4684 wrote to memory of 2848 4684 4997.tmp 86 PID 2848 wrote to memory of 464 2848 4AC0.tmp 87 PID 464 wrote to memory of 728 464 4BD9.tmp 88 PID 728 wrote to memory of 3492 728 4CA4.tmp 89 PID 3492 wrote to memory of 884 3492 4DFC.tmp 90 PID 884 wrote to memory of 1944 884 4F15.tmp 91 PID 1944 wrote to memory of 1704 1944 503E.tmp 92 PID 1704 wrote to memory of 4388 1704 5128.tmp 93 PID 4388 wrote to memory of 2700 4388 5203.tmp 94 PID 2700 wrote to memory of 2164 2700 530D.tmp 95 PID 2164 wrote to memory of 3884 2164 5455.tmp 96 PID 3884 wrote to memory of 2356 3884 5530.tmp 97 PID 2356 wrote to memory of 2292 2356 5639.tmp 98 PID 2292 wrote to memory of 2056 2292 5781.tmp 99 PID 2056 wrote to memory of 3108 2056 583D.tmp 100 PID 3108 wrote to memory of 1828 3108 5937.tmp 101 PID 1828 wrote to memory of 4336 1828 5A60.tmp 102 PID 4336 wrote to memory of 4636 4336 5B5A.tmp 103 PID 4636 wrote to memory of 624 4636 5C73.tmp 104 PID 624 wrote to memory of 3732 624 5D8C.tmp 105 PID 3732 wrote to memory of 2408 3732 5E57.tmp 106 PID 2408 wrote to memory of 316 2408 5F71.tmp 107 PID 316 wrote to memory of 1304 316 607A.tmp 108 PID 1304 wrote to memory of 4360 1304 61B3.tmp 109 PID 4360 wrote to memory of 4716 4360 629D.tmp 110 PID 4716 wrote to memory of 1980 4716 63F5.tmp 111 PID 1980 wrote to memory of 4608 1980 64EF.tmp 112 PID 4608 wrote to memory of 3364 4608 65CA.tmp 113 PID 3364 wrote to memory of 1556 3364 66D3.tmp 114 PID 1556 wrote to memory of 4760 1556 67BE.tmp 115 PID 4760 wrote to memory of 4504 4760 68C7.tmp 117 PID 4504 wrote to memory of 1844 4504 69B2.tmp 118 PID 1844 wrote to memory of 3128 1844 6A3E.tmp 120 PID 3128 wrote to memory of 5064 3128 6B19.tmp 122 PID 5064 wrote to memory of 4180 5064 6BD4.tmp 124 PID 4180 wrote to memory of 640 4180 6C80.tmp 125 PID 640 wrote to memory of 1676 640 6D0D.tmp 126 PID 1676 wrote to memory of 3396 1676 6DA9.tmp 127 PID 3396 wrote to memory of 4516 3396 6E84.tmp 129 PID 4516 wrote to memory of 1100 4516 6F30.tmp 130 PID 1100 wrote to memory of 1400 1100 6FDC.tmp 131 PID 1400 wrote to memory of 4308 1400 7097.tmp 132 PID 4308 wrote to memory of 3156 4308 7143.tmp 133 PID 3156 wrote to memory of 3260 3156 71EF.tmp 134 PID 3260 wrote to memory of 2172 3260 726C.tmp 135 PID 2172 wrote to memory of 1504 2172 72E9.tmp 136 PID 1504 wrote to memory of 4988 1504 73A4.tmp 137 PID 4988 wrote to memory of 4212 4988 7412.tmp 138 PID 4212 wrote to memory of 4440 4212 7470.tmp 139 PID 4440 wrote to memory of 2436 4440 74BE.tmp 140 PID 2436 wrote to memory of 5008 2436 750C.tmp 141 PID 5008 wrote to memory of 3552 5008 7579.tmp 142 PID 3552 wrote to memory of 5040 3552 75D7.tmp 143 PID 5040 wrote to memory of 4992 5040 7635.tmp 144 PID 4992 wrote to memory of 3220 4992 7692.tmp 145 PID 3220 wrote to memory of 4176 3220 76F0.tmp 146 PID 4176 wrote to memory of 3196 4176 775E.tmp 147 PID 3196 wrote to memory of 1492 3196 77BB.tmp 148 PID 1492 wrote to memory of 1816 1492 7809.tmp 149 PID 1816 wrote to memory of 208 1816 7858.tmp 150 PID 208 wrote to memory of 5048 208 78B5.tmp 151 PID 5048 wrote to memory of 3356 5048 7913.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_459b382b0fc28976e35be90696072d8c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\63F5.tmp"C:\Users\Admin\AppData\Local\Temp\63F5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\6C80.tmp"C:\Users\Admin\AppData\Local\Temp\6C80.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\7143.tmp"C:\Users\Admin\AppData\Local\Temp\7143.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\750C.tmp"C:\Users\Admin\AppData\Local\Temp\750C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\75D7.tmp"C:\Users\Admin\AppData\Local\Temp\75D7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"65⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"66⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"67⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"68⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7B26.tmp"C:\Users\Admin\AppData\Local\Temp\7B26.tmp"69⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"70⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"71⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7C40.tmp"C:\Users\Admin\AppData\Local\Temp\7C40.tmp"72⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"73⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"74⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7D68.tmp"C:\Users\Admin\AppData\Local\Temp\7D68.tmp"75⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"76⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\7E14.tmp"C:\Users\Admin\AppData\Local\Temp\7E14.tmp"77⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"C:\Users\Admin\AppData\Local\Temp\7EB1.tmp"79⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"80⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"81⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"82⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"83⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"84⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"85⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"86⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"87⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"88⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"89⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"90⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"91⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\8383.tmp"C:\Users\Admin\AppData\Local\Temp\8383.tmp"92⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\83D1.tmp"C:\Users\Admin\AppData\Local\Temp\83D1.tmp"93⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\841F.tmp"C:\Users\Admin\AppData\Local\Temp\841F.tmp"94⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\847D.tmp"C:\Users\Admin\AppData\Local\Temp\847D.tmp"95⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"96⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"97⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\8587.tmp"C:\Users\Admin\AppData\Local\Temp\8587.tmp"98⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\85D5.tmp"C:\Users\Admin\AppData\Local\Temp\85D5.tmp"99⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"100⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"101⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"102⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:216 -
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"104⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"105⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"106⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"108⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\8920.tmp"C:\Users\Admin\AppData\Local\Temp\8920.tmp"109⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\897E.tmp"C:\Users\Admin\AppData\Local\Temp\897E.tmp"110⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\89DC.tmp"C:\Users\Admin\AppData\Local\Temp\89DC.tmp"111⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"112⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"114⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\8B34.tmp"C:\Users\Admin\AppData\Local\Temp\8B34.tmp"115⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"116⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"117⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"118⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"119⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"120⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\8D28.tmp"C:\Users\Admin\AppData\Local\Temp\8D28.tmp"121⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"122⤵PID:3824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-