Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_63d5e461a95182c9669536fb12b935c5_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_63d5e461a95182c9669536fb12b935c5_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_63d5e461a95182c9669536fb12b935c5_elex_mafia.exe
- Size 561KB
- Sample260804-yp2vvayeqc
- SHA256 50ef68c43b4e57bcdceb036380213144282bdd6ebb953360fedf9f6391cc7e5b
- MD5 63d5e461a95182c9669536fb12b935c5
- SHA1 eb0b0f8ac7b6fe86c9750ef3fa87f31cc82822fc
- SHA512 b1ed5db24545dc8396764d6c5003fdecfaefb0d9ef96306e011011586599c3280ace26221a481c627f2fb2a3201e48ce5c132bcff4e87f5f6010f0f78e79b374
- SSDEEP 12288:VuelPWET0yhjkXcj9hpZzbv1l6l1OdJmZDZuL:8eEEvhwsnrzbH6vOdJmZDoL
- TLSH T1DBC4DF11B2D4C436F1F31A344AF1DB62497BBC619B75E9CB2788122E1EB02D1EA39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4548 B1B7.tmp 3864 B2A1.tmp 2948 B32E.tmp 3292 B418.tmp 1084 B4A5.tmp 988 B541.tmp 1180 B5DE.tmp 2464 B65B.tmp 3228 B745.tmp 4596 B7E1.tmp 3748 B87D.tmp 4732 B949.tmp 4932 BA14.tmp 4764 BB0E.tmp 3000 BBE8.tmp 960 BC94.tmp 1216 BD31.tmp 1536 BDAE.tmp 5068 BE79.tmp 1616 BF44.tmp 4188 BFC1.tmp 3808 C05D.tmp 1252 C0DA.tmp 216 C167.tmp 4000 C213.tmp 3776 C290.tmp 2552 C30D.tmp 3840 C38A.tmp 3500 C455.tmp 3344 C510.tmp 888 C61A.tmp 3180 C6A6.tmp 3628 C723.tmp 4768 C781.tmp 2280 C7EF.tmp 1248 C85C.tmp 2508 C8AA.tmp 3140 C908.tmp 3800 C975.tmp 2456 C9C3.tmp 3832 CA11.tmp 432 CA60.tmp 1212 CAAE.tmp 536 CAFC.tmp 2068 CB4A.tmp 1752 CBA8.tmp 1232 CBF6.tmp 4860 CC54.tmp 2548 CCA2.tmp 4916 CD0F.tmp 1388 CD6D.tmp 4480 CDBB.tmp 740 CE19.tmp 2436 CE67.tmp 4256 CEC5.tmp 4300 CF22.tmp 2740 CF70.tmp 5000 CFBF.tmp 1204 D00D.tmp 1080 D05B.tmp 3168 D0A9.tmp 4452 D116.tmp 2636 D174.tmp 2560 D1C2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 717D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E68E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E606.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 866C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 4548 2624 2026-08-04_63d5e461a95182c9669536fb12b935c5_elex_mafia.exe 85 PID 4548 wrote to memory of 3864 4548 B1B7.tmp 86 PID 3864 wrote to memory of 2948 3864 B2A1.tmp 87 PID 2948 wrote to memory of 3292 2948 B32E.tmp 88 PID 3292 wrote to memory of 1084 3292 B418.tmp 89 PID 1084 wrote to memory of 988 1084 B4A5.tmp 90 PID 988 wrote to memory of 1180 988 B541.tmp 91 PID 1180 wrote to memory of 2464 1180 B5DE.tmp 92 PID 2464 wrote to memory of 3228 2464 B65B.tmp 93 PID 3228 wrote to memory of 4596 3228 B745.tmp 94 PID 4596 wrote to memory of 3748 4596 B7E1.tmp 95 PID 3748 wrote to memory of 4732 3748 B87D.tmp 96 PID 4732 wrote to memory of 4932 4732 B949.tmp 97 PID 4932 wrote to memory of 4764 4932 BA14.tmp 98 PID 4764 wrote to memory of 3000 4764 BB0E.tmp 101 PID 3000 wrote to memory of 960 3000 BBE8.tmp 102 PID 960 wrote to memory of 1216 960 BC94.tmp 103 PID 1216 wrote to memory of 1536 1216 BD31.tmp 104 PID 1536 wrote to memory of 5068 1536 BDAE.tmp 105 PID 5068 wrote to memory of 1616 5068 BE79.tmp 106 PID 1616 wrote to memory of 4188 1616 BF44.tmp 107 PID 4188 wrote to memory of 3808 4188 BFC1.tmp 109 PID 3808 wrote to memory of 1252 3808 C05D.tmp 110 PID 1252 wrote to memory of 216 1252 C0DA.tmp 111 PID 216 wrote to memory of 4000 216 C167.tmp 112 PID 4000 wrote to memory of 3776 4000 C213.tmp 114 PID 3776 wrote to memory of 2552 3776 C290.tmp 115 PID 2552 wrote to memory of 3840 2552 C30D.tmp 116 PID 3840 wrote to memory of 3500 3840 C38A.tmp 117 PID 3500 wrote to memory of 3344 3500 C455.tmp 118 PID 3344 wrote to memory of 888 3344 C510.tmp 119 PID 888 wrote to memory of 3180 888 C61A.tmp 120 PID 3180 wrote to memory of 3628 3180 C6A6.tmp 121 PID 3628 wrote to memory of 4768 3628 C723.tmp 122 PID 4768 wrote to memory of 2280 4768 C781.tmp 123 PID 2280 wrote to memory of 1248 2280 C7EF.tmp 124 PID 1248 wrote to memory of 2508 1248 C85C.tmp 125 PID 2508 wrote to memory of 3140 2508 C8AA.tmp 126 PID 3140 wrote to memory of 3800 3140 C908.tmp 127 PID 3800 wrote to memory of 2456 3800 C975.tmp 128 PID 2456 wrote to memory of 3832 2456 C9C3.tmp 129 PID 3832 wrote to memory of 432 3832 CA11.tmp 130 PID 432 wrote to memory of 1212 432 CA60.tmp 131 PID 1212 wrote to memory of 536 1212 CAAE.tmp 132 PID 536 wrote to memory of 2068 536 CAFC.tmp 133 PID 2068 wrote to memory of 1752 2068 CB4A.tmp 134 PID 1752 wrote to memory of 1232 1752 CBA8.tmp 135 PID 1232 wrote to memory of 4860 1232 CBF6.tmp 137 PID 4860 wrote to memory of 2548 4860 CC54.tmp 138 PID 2548 wrote to memory of 4916 2548 CCA2.tmp 139 PID 4916 wrote to memory of 1388 4916 CD0F.tmp 140 PID 1388 wrote to memory of 4480 1388 CD6D.tmp 141 PID 4480 wrote to memory of 740 4480 CDBB.tmp 142 PID 740 wrote to memory of 2436 740 CE19.tmp 143 PID 2436 wrote to memory of 4256 2436 CE67.tmp 144 PID 4256 wrote to memory of 4300 4256 CEC5.tmp 145 PID 4300 wrote to memory of 2740 4300 CF22.tmp 146 PID 2740 wrote to memory of 5000 2740 CF70.tmp 147 PID 5000 wrote to memory of 1204 5000 CFBF.tmp 148 PID 1204 wrote to memory of 1080 1204 D00D.tmp 149 PID 1080 wrote to memory of 3168 1080 D05B.tmp 150 PID 3168 wrote to memory of 4452 3168 D0A9.tmp 151 PID 4452 wrote to memory of 2636 4452 D116.tmp 152 PID 2636 wrote to memory of 2560 2636 D174.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_63d5e461a95182c9669536fb12b935c5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_63d5e461a95182c9669536fb12b935c5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\B541.tmp"C:\Users\Admin\AppData\Local\Temp\B541.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\B87D.tmp"C:\Users\Admin\AppData\Local\Temp\B87D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\B949.tmp"C:\Users\Admin\AppData\Local\Temp\B949.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\BA14.tmp"C:\Users\Admin\AppData\Local\Temp\BA14.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\BD31.tmp"C:\Users\Admin\AppData\Local\Temp\BD31.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BF44.tmp"C:\Users\Admin\AppData\Local\Temp\BF44.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\C455.tmp"C:\Users\Admin\AppData\Local\Temp\C455.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\C510.tmp"C:\Users\Admin\AppData\Local\Temp\C510.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\C61A.tmp"C:\Users\Admin\AppData\Local\Temp\C61A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\C781.tmp"C:\Users\Admin\AppData\Local\Temp\C781.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\C85C.tmp"C:\Users\Admin\AppData\Local\Temp\C85C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\CE67.tmp"C:\Users\Admin\AppData\Local\Temp\CE67.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\D174.tmp"C:\Users\Admin\AppData\Local\Temp\D174.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"65⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\D210.tmp"C:\Users\Admin\AppData\Local\Temp\D210.tmp"66⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"67⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"68⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"69⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"70⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"71⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"72⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"73⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"74⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\D56C.tmp"C:\Users\Admin\AppData\Local\Temp\D56C.tmp"75⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"76⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"77⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"78⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"79⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\D78F.tmp"C:\Users\Admin\AppData\Local\Temp\D78F.tmp"80⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"81⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"82⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"83⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D906.tmp"C:\Users\Admin\AppData\Local\Temp\D906.tmp"84⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"85⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"86⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"87⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"88⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"89⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\DB57.tmp"C:\Users\Admin\AppData\Local\Temp\DB57.tmp"90⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"91⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"92⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"93⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"94⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"97⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\DE65.tmp"C:\Users\Admin\AppData\Local\Temp\DE65.tmp"98⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\DEE2.tmp"C:\Users\Admin\AppData\Local\Temp\DEE2.tmp"99⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"101⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"102⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\E049.tmp"C:\Users\Admin\AppData\Local\Temp\E049.tmp"103⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"104⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\E143.tmp"C:\Users\Admin\AppData\Local\Temp\E143.tmp"105⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"106⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"107⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"108⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\E308.tmp"C:\Users\Admin\AppData\Local\Temp\E308.tmp"109⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"110⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\E421.tmp"C:\Users\Admin\AppData\Local\Temp\E421.tmp"112⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"113⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"114⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\E54A.tmp"C:\Users\Admin\AppData\Local\Temp\E54A.tmp"115⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"116⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\E606.tmp"C:\Users\Admin\AppData\Local\Temp\E606.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"118⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"119⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\E71F.tmp"C:\Users\Admin\AppData\Local\Temp\E71F.tmp"120⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\E77D.tmp"C:\Users\Admin\AppData\Local\Temp\E77D.tmp"121⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"122⤵PID:3520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-