Analysis
- max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 14:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_422084e764f07f8a5fe6ff5f1f8722de_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_422084e764f07f8a5fe6ff5f1f8722de_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_422084e764f07f8a5fe6ff5f1f8722de_elex_mafia.exe
- Size 561KB
- Sample260803-r6phhstses
- SHA256 8f367a1a10dea0b27486502281e5d29e4d726849c9dc6dc4886ad32c47e3b31e
- MD5 422084e764f07f8a5fe6ff5f1f8722de
- SHA1 9fd5b1d1033ffbeac7ee993063f212c84c3aa6ba
- SHA512 c7c21a704d948111a0d25ea43c917c62d295ea9231a252c7d38e3342188406fec9428befaf07885df2ac227fdc98e1ccde242394ce9d885a7ff92ec7e067655f
- SSDEEP 12288:VuelPWET0yhoo78jd+BTMznQl8DCknWR7ZaI7siDZuL:8eEEvhh8+TqLCyWdAkDoL
- TLSH T182C4DF21B2D4C835F5F31A344AF59762097BBC219B35E9CB2788226E1EB17D1E638713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2840 1F6A.tmp 3404 2054.tmp 2344 2110.tmp 4572 21EB.tmp 2952 22B6.tmp 2636 2352.tmp 1100 244C.tmp 4664 2527.tmp 1680 25E2.tmp 1704 265F.tmp 4684 274A.tmp 4792 2805.tmp 892 28C1.tmp 3716 294D.tmp 468 29F9.tmp 1512 2A86.tmp 1996 2B32.tmp 4908 2BCE.tmp 4280 2C89.tmp 5000 2D26.tmp 416 2DC2.tmp 3596 2E7D.tmp 1716 2F1A.tmp 440 2FD5.tmp 3492 3071.tmp 4984 312D.tmp 1544 31C9.tmp 2968 3256.tmp 4276 3321.tmp 4692 33BD.tmp 3856 343A.tmp 1268 34B7.tmp 4832 3553.tmp 2212 35B1.tmp 3940 35FF.tmp 1044 364D.tmp 4892 369B.tmp 5068 36F9.tmp 2112 3747.tmp 2960 37B5.tmp 4776 3803.tmp 4952 3861.tmp 4592 38AF.tmp 4992 38FD.tmp 3228 394B.tmp 3864 39B8.tmp 1312 3A16.tmp 692 3A83.tmp 4208 3AD2.tmp 2304 3B3F.tmp 2208 3B8D.tmp 1328 3BDB.tmp 1108 3C29.tmp 2260 3C97.tmp 5104 3CE5.tmp 4100 3D52.tmp 2136 3DC0.tmp 4084 3E1D.tmp 1752 3E8B.tmp 4868 3ED9.tmp 4304 3F75.tmp 3776 3FC3.tmp 4844 4031.tmp 2484 407F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4031.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 438C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 679E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 894B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A582.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 2840 4240 2026-08-03_422084e764f07f8a5fe6ff5f1f8722de_elex_mafia.exe 84 PID 2840 wrote to memory of 3404 2840 1F6A.tmp 85 PID 3404 wrote to memory of 2344 3404 2054.tmp 86 PID 2344 wrote to memory of 4572 2344 2110.tmp 87 PID 4572 wrote to memory of 2952 4572 21EB.tmp 88 PID 2952 wrote to memory of 2636 2952 22B6.tmp 89 PID 2636 wrote to memory of 1100 2636 2352.tmp 90 PID 1100 wrote to memory of 4664 1100 244C.tmp 91 PID 4664 wrote to memory of 1680 4664 2527.tmp 92 PID 1680 wrote to memory of 1704 1680 25E2.tmp 93 PID 1704 wrote to memory of 4684 1704 265F.tmp 94 PID 4684 wrote to memory of 4792 4684 274A.tmp 95 PID 4792 wrote to memory of 892 4792 2805.tmp 96 PID 892 wrote to memory of 3716 892 28C1.tmp 97 PID 3716 wrote to memory of 468 3716 294D.tmp 98 PID 468 wrote to memory of 1512 468 29F9.tmp 99 PID 1512 wrote to memory of 1996 1512 2A86.tmp 100 PID 1996 wrote to memory of 4908 1996 2B32.tmp 101 PID 4908 wrote to memory of 4280 4908 2BCE.tmp 102 PID 4280 wrote to memory of 5000 4280 2C89.tmp 103 PID 5000 wrote to memory of 416 5000 2D26.tmp 104 PID 416 wrote to memory of 3596 416 2DC2.tmp 105 PID 3596 wrote to memory of 1716 3596 2E7D.tmp 106 PID 1716 wrote to memory of 440 1716 2F1A.tmp 107 PID 440 wrote to memory of 3492 440 2FD5.tmp 108 PID 3492 wrote to memory of 4984 3492 3071.tmp 109 PID 4984 wrote to memory of 1544 4984 312D.tmp 110 PID 1544 wrote to memory of 2968 1544 31C9.tmp 111 PID 2968 wrote to memory of 4276 2968 3256.tmp 113 PID 4276 wrote to memory of 4692 4276 3321.tmp 114 PID 4692 wrote to memory of 3856 4692 33BD.tmp 115 PID 3856 wrote to memory of 1268 3856 343A.tmp 116 PID 1268 wrote to memory of 4832 1268 34B7.tmp 117 PID 4832 wrote to memory of 2212 4832 3553.tmp 118 PID 2212 wrote to memory of 3940 2212 35B1.tmp 119 PID 3940 wrote to memory of 1044 3940 35FF.tmp 120 PID 1044 wrote to memory of 4892 1044 364D.tmp 121 PID 4892 wrote to memory of 5068 4892 369B.tmp 122 PID 5068 wrote to memory of 2112 5068 36F9.tmp 123 PID 2112 wrote to memory of 2960 2112 3747.tmp 124 PID 2960 wrote to memory of 4776 2960 37B5.tmp 125 PID 4776 wrote to memory of 4952 4776 3803.tmp 126 PID 4952 wrote to memory of 4592 4952 3861.tmp 127 PID 4592 wrote to memory of 4992 4592 38AF.tmp 128 PID 4992 wrote to memory of 3228 4992 38FD.tmp 129 PID 3228 wrote to memory of 3864 3228 394B.tmp 130 PID 3864 wrote to memory of 1312 3864 39B8.tmp 131 PID 1312 wrote to memory of 692 1312 3A16.tmp 132 PID 692 wrote to memory of 4208 692 3A83.tmp 133 PID 4208 wrote to memory of 2304 4208 3AD2.tmp 134 PID 2304 wrote to memory of 2208 2304 3B3F.tmp 135 PID 2208 wrote to memory of 1328 2208 3B8D.tmp 136 PID 1328 wrote to memory of 1108 1328 3BDB.tmp 137 PID 1108 wrote to memory of 2260 1108 3C29.tmp 138 PID 2260 wrote to memory of 5104 2260 3C97.tmp 139 PID 5104 wrote to memory of 4100 5104 3CE5.tmp 140 PID 4100 wrote to memory of 2136 4100 3D52.tmp 141 PID 2136 wrote to memory of 4084 2136 3DC0.tmp 142 PID 4084 wrote to memory of 1752 4084 3E1D.tmp 143 PID 1752 wrote to memory of 4868 1752 3E8B.tmp 144 PID 4320 wrote to memory of 4304 4320 3F27.tmp 146 PID 4304 wrote to memory of 3776 4304 3F75.tmp 147 PID 3776 wrote to memory of 4844 3776 3FC3.tmp 148 PID 4844 wrote to memory of 2484 4844 4031.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_422084e764f07f8a5fe6ff5f1f8722de_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_422084e764f07f8a5fe6ff5f1f8722de_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"61⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"62⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"66⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"67⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"68⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"69⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"70⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"71⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"72⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"73⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"74⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"76⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\4447.tmp"C:\Users\Admin\AppData\Local\Temp\4447.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"78⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"79⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"81⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"82⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"83⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"84⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"85⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"86⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"87⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"88⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"89⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"90⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"91⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"92⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"93⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"94⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"95⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"96⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"97⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"98⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"99⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"100⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"101⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"102⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"104⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"105⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"106⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"107⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"108⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"109⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"111⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"112⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"113⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"114⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"115⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"116⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"117⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"118⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"119⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"120⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"121⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-