Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 19:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_988f80d69c8edec3320d645d3f46a87d_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_988f80d69c8edec3320d645d3f46a87d_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_988f80d69c8edec3320d645d3f46a87d_elex_mafia.exe
- Size 560KB
- Sample260804-xtz2dacn2x
- SHA256 a303aecca256bedd441c10ea7d059ac8341a88e139adcc780aa6250a5acb1e1e
- MD5 988f80d69c8edec3320d645d3f46a87d
- SHA1 38a059b048bc0e401da800e49dd1852bb7dda355
- SHA512 454fd8545054090ab2a239b4b686edd4febff08c5c83c22ca590cbf0d636fa8d18f967d828ace4ec14b4c4e3d5cff793993bece12b94608b29a979f6c75df924
- SSDEEP 12288:MlFXOQUDmrC8SbUfvUzaX5+njRGoLHIZxV:MlUQbC8SavUz2EjRhLHIR
- TLSH T1C6C4F0123688C073E68201314A45CBA25B3F7C75572A64DB3BD0366EAFB47D1DA7A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2540 5C92.tmp 4012 5DCB.tmp 4372 5EA5.tmp 5044 5FFD.tmp 1028 60D8.tmp 1012 61B3.tmp 1372 62AD.tmp 4772 6378.tmp 4672 6491.tmp 2992 655C.tmp 4224 6685.tmp 4940 67BE.tmp 4632 68A8.tmp 4572 69A2.tmp 2972 6A8C.tmp 2212 6BA6.tmp 204 6CBF.tmp 3684 6D6B.tmp 2648 6E55.tmp 4404 6F20.tmp 788 700B.tmp 4140 70F5.tmp 4180 71EF.tmp 5068 72D9.tmp 2272 7402.tmp 1732 74DD.tmp 5056 75C7.tmp 5000 76C1.tmp 2084 779C.tmp 2556 7896.tmp 1840 7952.tmp 2636 7A2C.tmp 3744 7B26.tmp 2376 7BD2.tmp 2916 7C6E.tmp 2708 7D1A.tmp 3208 7DB7.tmp 3636 7E43.tmp 4496 7EC0.tmp 4564 7F3D.tmp 3740 7FE9.tmp 2244 8095.tmp 3164 8141.tmp 4276 81FC.tmp 5004 82A8.tmp 1264 8335.tmp 4852 83B2.tmp 4780 845E.tmp 832 84AC.tmp 4320 8519.tmp 1236 8577.tmp 4980 85C5.tmp 4476 8613.tmp 1916 8671.tmp 4472 86DE.tmp 5104 875B.tmp 3160 87A9.tmp 1128 8807.tmp 3588 8855.tmp 1472 88B3.tmp 4148 8901.tmp 1112 895F.tmp 464 89AD.tmp 2816 8A0B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9621.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 164D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D963.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2540 1500 2026-08-04_988f80d69c8edec3320d645d3f46a87d_elex_mafia.exe 85 PID 2540 wrote to memory of 4012 2540 5C92.tmp 86 PID 4012 wrote to memory of 4372 4012 5DCB.tmp 87 PID 4372 wrote to memory of 5044 4372 5EA5.tmp 88 PID 5044 wrote to memory of 1028 5044 5FFD.tmp 89 PID 1028 wrote to memory of 1012 1028 60D8.tmp 90 PID 1012 wrote to memory of 1372 1012 61B3.tmp 91 PID 1372 wrote to memory of 4772 1372 62AD.tmp 92 PID 4772 wrote to memory of 4672 4772 6378.tmp 93 PID 4672 wrote to memory of 2992 4672 6491.tmp 94 PID 2992 wrote to memory of 4224 2992 655C.tmp 95 PID 4224 wrote to memory of 4940 4224 6685.tmp 96 PID 4940 wrote to memory of 4632 4940 67BE.tmp 97 PID 4632 wrote to memory of 4572 4632 68A8.tmp 99 PID 4572 wrote to memory of 2972 4572 69A2.tmp 101 PID 2972 wrote to memory of 2212 2972 6A8C.tmp 103 PID 2212 wrote to memory of 204 2212 6BA6.tmp 104 PID 204 wrote to memory of 3684 204 6CBF.tmp 105 PID 3684 wrote to memory of 2648 3684 6D6B.tmp 106 PID 2648 wrote to memory of 4404 2648 6E55.tmp 107 PID 4404 wrote to memory of 788 4404 6F20.tmp 108 PID 788 wrote to memory of 4140 788 700B.tmp 109 PID 4140 wrote to memory of 4180 4140 70F5.tmp 110 PID 4180 wrote to memory of 5068 4180 71EF.tmp 111 PID 5068 wrote to memory of 2272 5068 72D9.tmp 112 PID 2272 wrote to memory of 1732 2272 7402.tmp 113 PID 1732 wrote to memory of 5056 1732 74DD.tmp 114 PID 5056 wrote to memory of 5000 5056 75C7.tmp 115 PID 5000 wrote to memory of 2084 5000 76C1.tmp 116 PID 2084 wrote to memory of 2556 2084 779C.tmp 117 PID 2556 wrote to memory of 1840 2556 7896.tmp 118 PID 1840 wrote to memory of 2636 1840 7952.tmp 119 PID 2636 wrote to memory of 3744 2636 7A2C.tmp 120 PID 3744 wrote to memory of 2376 3744 7B26.tmp 121 PID 2376 wrote to memory of 2916 2376 7BD2.tmp 122 PID 2916 wrote to memory of 2708 2916 7C6E.tmp 123 PID 2708 wrote to memory of 3208 2708 7D1A.tmp 124 PID 3208 wrote to memory of 3636 3208 7DB7.tmp 125 PID 3636 wrote to memory of 4496 3636 7E43.tmp 126 PID 4496 wrote to memory of 4564 4496 7EC0.tmp 127 PID 4564 wrote to memory of 3740 4564 7F3D.tmp 128 PID 3740 wrote to memory of 2244 3740 7FE9.tmp 129 PID 2244 wrote to memory of 3164 2244 8095.tmp 130 PID 3164 wrote to memory of 4276 3164 8141.tmp 131 PID 4276 wrote to memory of 5004 4276 81FC.tmp 132 PID 5004 wrote to memory of 1264 5004 82A8.tmp 133 PID 1264 wrote to memory of 4852 1264 8335.tmp 134 PID 4852 wrote to memory of 4780 4852 83B2.tmp 135 PID 4780 wrote to memory of 832 4780 845E.tmp 136 PID 832 wrote to memory of 4320 832 84AC.tmp 137 PID 4320 wrote to memory of 1236 4320 8519.tmp 138 PID 1236 wrote to memory of 4980 1236 8577.tmp 139 PID 4980 wrote to memory of 4476 4980 85C5.tmp 140 PID 4476 wrote to memory of 1916 4476 8613.tmp 141 PID 1916 wrote to memory of 4472 1916 8671.tmp 142 PID 4472 wrote to memory of 5104 4472 86DE.tmp 143 PID 5104 wrote to memory of 3160 5104 875B.tmp 144 PID 3160 wrote to memory of 1128 3160 87A9.tmp 145 PID 1128 wrote to memory of 3588 1128 8807.tmp 146 PID 3588 wrote to memory of 1472 3588 8855.tmp 147 PID 1472 wrote to memory of 4148 1472 88B3.tmp 148 PID 4148 wrote to memory of 1112 4148 8901.tmp 149 PID 1112 wrote to memory of 464 1112 895F.tmp 150 PID 464 wrote to memory of 2816 464 89AD.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_988f80d69c8edec3320d645d3f46a87d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_988f80d69c8edec3320d645d3f46a87d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6378.tmp"C:\Users\Admin\AppData\Local\Temp\6378.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\76C1.tmp"C:\Users\Admin\AppData\Local\Temp\76C1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7B26.tmp"C:\Users\Admin\AppData\Local\Temp\7B26.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\83B2.tmp"C:\Users\Admin\AppData\Local\Temp\83B2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8577.tmp"C:\Users\Admin\AppData\Local\Temp\8577.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8671.tmp"C:\Users\Admin\AppData\Local\Temp\8671.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\875B.tmp"C:\Users\Admin\AppData\Local\Temp\875B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\87A9.tmp"C:\Users\Admin\AppData\Local\Temp\87A9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"65⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\8A69.tmp"C:\Users\Admin\AppData\Local\Temp\8A69.tmp"66⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"67⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"68⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\8B72.tmp"C:\Users\Admin\AppData\Local\Temp\8B72.tmp"69⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"70⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"71⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"72⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"73⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"74⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"75⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"76⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"77⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"78⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"79⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"80⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"81⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"82⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\9016.tmp"C:\Users\Admin\AppData\Local\Temp\9016.tmp"83⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"84⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\90B2.tmp"C:\Users\Admin\AppData\Local\Temp\90B2.tmp"85⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\9110.tmp"C:\Users\Admin\AppData\Local\Temp\9110.tmp"86⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"87⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"88⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"89⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\9287.tmp"C:\Users\Admin\AppData\Local\Temp\9287.tmp"90⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\92D5.tmp"C:\Users\Admin\AppData\Local\Temp\92D5.tmp"91⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\9323.tmp"C:\Users\Admin\AppData\Local\Temp\9323.tmp"92⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9371.tmp"C:\Users\Admin\AppData\Local\Temp\9371.tmp"93⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\93BF.tmp"C:\Users\Admin\AppData\Local\Temp\93BF.tmp"94⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\941D.tmp"C:\Users\Admin\AppData\Local\Temp\941D.tmp"95⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\946B.tmp"C:\Users\Admin\AppData\Local\Temp\946B.tmp"96⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"97⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\9517.tmp"C:\Users\Admin\AppData\Local\Temp\9517.tmp"98⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\9565.tmp"C:\Users\Admin\AppData\Local\Temp\9565.tmp"99⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"100⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:212 -
C:\Users\Admin\AppData\Local\Temp\966F.tmp"C:\Users\Admin\AppData\Local\Temp\966F.tmp"102⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\96BD.tmp"C:\Users\Admin\AppData\Local\Temp\96BD.tmp"103⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"104⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\9769.tmp"C:\Users\Admin\AppData\Local\Temp\9769.tmp"105⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"106⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9805.tmp"C:\Users\Admin\AppData\Local\Temp\9805.tmp"107⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"108⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"110⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\994D.tmp"C:\Users\Admin\AppData\Local\Temp\994D.tmp"111⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\999B.tmp"C:\Users\Admin\AppData\Local\Temp\999B.tmp"112⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"113⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9A47.tmp"C:\Users\Admin\AppData\Local\Temp\9A47.tmp"114⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"115⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"116⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"117⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"118⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"119⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"120⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"121⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\9D25.tmp"C:\Users\Admin\AppData\Local\Temp\9D25.tmp"122⤵PID:3356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-