Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_2e5308ad0757ea7063089a053a69ff99_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_2e5308ad0757ea7063089a053a69ff99_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-02_2e5308ad0757ea7063089a053a69ff99_elex_mafia.exe
- Size 561KB
- Sample260802-xvg7yseq6s
- SHA256 f7f2678928f0b4a7ec81b2f7c31ead06ff93134e36f536b41650775f34e64a02
- MD5 2e5308ad0757ea7063089a053a69ff99
- SHA1 2b30189b9e281225c39bc00d95bc3b82e8138432
- SHA512 9688afd244df9bf80d628843b927354930f78a49e535a04008613b5b7bfff4d8958c9f452b2ee5ce2c3bdd6f3e460e1961a4aafc013ca7aa1d28426dfea68aca
- SSDEEP 6144:kPTkurf/m9KOzlMsPhYET0yhlwxr1/Kx2BrqFU1k0FYHeKe/XSu632UPC2x0HYPT:VuelPWET0yhYzrqF4ah0X02CCSkPDZuL
- TLSH T184C4DF11B2D8C432F5F31A344AF49B62093BBC629B75D9CF2784226D5EB12C0EA79713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4736 6BF4.tmp 4220 6CA0.tmp 4176 6D3C.tmp 664 6E26.tmp 1128 6EA3.tmp 4696 6F01.tmp 3028 6F7E.tmp 5072 6FCC.tmp 4164 702A.tmp 4660 7088.tmp 956 70E5.tmp 4492 71A1.tmp 2304 71EF.tmp 4432 727C.tmp 1192 72CA.tmp 2600 7318.tmp 4920 73B4.tmp 3916 7402.tmp 4792 7470.tmp 3948 74BE.tmp 2604 751B.tmp 2480 756A.tmp 3724 75F6.tmp 4588 7644.tmp 4536 76A2.tmp 2888 76F0.tmp 4600 774E.tmp 4884 77AC.tmp 3116 7809.tmp 4880 7867.tmp 4508 78D5.tmp 3456 7932.tmp 3808 7990.tmp 3704 79DE.tmp 4764 7A2C.tmp 2996 7A8A.tmp 896 7AE8.tmp 2896 7B36.tmp 3956 7B84.tmp 1592 7BD2.tmp 5056 7C20.tmp 1984 7C6E.tmp 3392 7CBD.tmp 3032 7D0B.tmp 5096 7D59.tmp 3292 7DA7.tmp 3508 7DF5.tmp 3208 7E43.tmp 2768 7E91.tmp 3016 7F0E.tmp 5068 7FBA.tmp 2256 8018.tmp 1280 8095.tmp 3440 8122.tmp 3792 81BE.tmp 4596 820C.tmp 3364 8279.tmp 396 82F6.tmp 3752 8354.tmp 3820 83A2.tmp 4808 8400.tmp 2268 846D.tmp 1228 84DB.tmp 3536 8567.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2774.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 288D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB43.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 4736 2684 2026-08-02_2e5308ad0757ea7063089a053a69ff99_elex_mafia.exe 88 PID 4736 wrote to memory of 4220 4736 6BF4.tmp 89 PID 4220 wrote to memory of 4176 4220 6CA0.tmp 90 PID 4176 wrote to memory of 664 4176 6D3C.tmp 91 PID 664 wrote to memory of 1128 664 6E26.tmp 92 PID 1128 wrote to memory of 4696 1128 6EA3.tmp 93 PID 4696 wrote to memory of 3028 4696 6F01.tmp 94 PID 3028 wrote to memory of 5072 3028 6F7E.tmp 95 PID 5072 wrote to memory of 4164 5072 6FCC.tmp 96 PID 4164 wrote to memory of 4660 4164 702A.tmp 97 PID 4660 wrote to memory of 956 4660 7088.tmp 98 PID 956 wrote to memory of 4492 956 70E5.tmp 99 PID 4492 wrote to memory of 2304 4492 71A1.tmp 100 PID 2304 wrote to memory of 4432 2304 71EF.tmp 101 PID 4432 wrote to memory of 1192 4432 727C.tmp 102 PID 1192 wrote to memory of 2600 1192 72CA.tmp 103 PID 2600 wrote to memory of 4920 2600 7318.tmp 104 PID 4920 wrote to memory of 3916 4920 73B4.tmp 105 PID 3916 wrote to memory of 4792 3916 7402.tmp 106 PID 4792 wrote to memory of 3948 4792 7470.tmp 107 PID 3948 wrote to memory of 2604 3948 74BE.tmp 108 PID 2604 wrote to memory of 2480 2604 751B.tmp 109 PID 2480 wrote to memory of 3724 2480 756A.tmp 110 PID 3724 wrote to memory of 4588 3724 75F6.tmp 111 PID 4588 wrote to memory of 4536 4588 7644.tmp 112 PID 4536 wrote to memory of 2888 4536 76A2.tmp 113 PID 2888 wrote to memory of 4600 2888 76F0.tmp 114 PID 4600 wrote to memory of 4884 4600 774E.tmp 115 PID 4884 wrote to memory of 3116 4884 77AC.tmp 116 PID 3116 wrote to memory of 4880 3116 7809.tmp 117 PID 4880 wrote to memory of 4508 4880 7867.tmp 118 PID 4508 wrote to memory of 3456 4508 78D5.tmp 119 PID 3456 wrote to memory of 3808 3456 7932.tmp 120 PID 3808 wrote to memory of 3704 3808 7990.tmp 121 PID 3704 wrote to memory of 4764 3704 79DE.tmp 122 PID 4764 wrote to memory of 2996 4764 7A2C.tmp 123 PID 2996 wrote to memory of 896 2996 7A8A.tmp 124 PID 896 wrote to memory of 2896 896 7AE8.tmp 125 PID 2896 wrote to memory of 3956 2896 7B36.tmp 126 PID 3956 wrote to memory of 1592 3956 7B84.tmp 127 PID 1592 wrote to memory of 5056 1592 7BD2.tmp 128 PID 5056 wrote to memory of 1984 5056 7C20.tmp 129 PID 1984 wrote to memory of 3392 1984 7C6E.tmp 130 PID 3392 wrote to memory of 3032 3392 7CBD.tmp 131 PID 3032 wrote to memory of 5096 3032 7D0B.tmp 132 PID 5096 wrote to memory of 3292 5096 7D59.tmp 133 PID 3292 wrote to memory of 3508 3292 7DA7.tmp 134 PID 3508 wrote to memory of 3208 3508 7DF5.tmp 135 PID 3208 wrote to memory of 2768 3208 7E43.tmp 136 PID 2768 wrote to memory of 3016 2768 7E91.tmp 137 PID 3016 wrote to memory of 5068 3016 7F0E.tmp 138 PID 5068 wrote to memory of 2256 5068 7FBA.tmp 139 PID 2256 wrote to memory of 1280 2256 8018.tmp 140 PID 1280 wrote to memory of 3440 1280 8095.tmp 141 PID 3440 wrote to memory of 3792 3440 8122.tmp 142 PID 3792 wrote to memory of 4596 3792 81BE.tmp 143 PID 4596 wrote to memory of 3364 4596 820C.tmp 144 PID 3364 wrote to memory of 396 3364 8279.tmp 145 PID 396 wrote to memory of 3752 396 82F6.tmp 146 PID 3752 wrote to memory of 3820 3752 8354.tmp 147 PID 3820 wrote to memory of 4808 3820 83A2.tmp 148 PID 4808 wrote to memory of 2268 4808 8400.tmp 149 PID 2268 wrote to memory of 1228 2268 846D.tmp 150 PID 1228 wrote to memory of 3536 1228 84DB.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_2e5308ad0757ea7063089a053a69ff99_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2e5308ad0757ea7063089a053a69ff99_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\7318.tmp"C:\Users\Admin\AppData\Local\Temp\7318.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\751B.tmp"C:\Users\Admin\AppData\Local\Temp\751B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\756A.tmp"C:\Users\Admin\AppData\Local\Temp\756A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\7E91.tmp"C:\Users\Admin\AppData\Local\Temp\7E91.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\84DB.tmp"C:\Users\Admin\AppData\Local\Temp\84DB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"65⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"67⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"69⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"70⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"71⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"72⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\8930.tmp"C:\Users\Admin\AppData\Local\Temp\8930.tmp"74⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"75⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"76⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"77⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\8B05.tmp"C:\Users\Admin\AppData\Local\Temp\8B05.tmp"78⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"79⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"81⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"82⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"83⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"84⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"85⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"86⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"87⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"88⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"89⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\9035.tmp"C:\Users\Admin\AppData\Local\Temp\9035.tmp"90⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"91⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"92⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"93⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\91DB.tmp"C:\Users\Admin\AppData\Local\Temp\91DB.tmp"94⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"95⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"96⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\9323.tmp"C:\Users\Admin\AppData\Local\Temp\9323.tmp"97⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"98⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"99⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"100⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"101⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\9517.tmp"C:\Users\Admin\AppData\Local\Temp\9517.tmp"102⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\9575.tmp"C:\Users\Admin\AppData\Local\Temp\9575.tmp"103⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\95D2.tmp"C:\Users\Admin\AppData\Local\Temp\95D2.tmp"104⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\964F.tmp"C:\Users\Admin\AppData\Local\Temp\964F.tmp"105⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"106⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"107⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"108⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"109⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"110⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"112⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\999B.tmp"C:\Users\Admin\AppData\Local\Temp\999B.tmp"113⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\99F9.tmp"C:\Users\Admin\AppData\Local\Temp\99F9.tmp"114⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\9A86.tmp"C:\Users\Admin\AppData\Local\Temp\9A86.tmp"115⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"116⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"117⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"118⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"119⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"120⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9D25.tmp"C:\Users\Admin\AppData\Local\Temp\9D25.tmp"121⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"122⤵PID:4124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-