Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 04:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_18ad8752917e46a523a9c41f101a6c07_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_18ad8752917e46a523a9c41f101a6c07_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_18ad8752917e46a523a9c41f101a6c07_elex_mafia.exe
- Size 520KB
- Sample260808-emgmcazdnb
- SHA256 954430c3e3dea30d525e739f6d6342074e3ef9bd06661ad1420dd7be8090cb8d
- MD5 18ad8752917e46a523a9c41f101a6c07
- SHA1 47760bfb38e5d11644d9f5b0f602b52f7148f694
- SHA512 31aa5846c9672dc6d2500520b9cbf3d4f252e2830308079ec50903fb3a67ac460c1f2ad58b8fa85210358fe3ad9d055e79ce1f36d4bc785f695d90ac84ae7e5a
- SSDEEP 12288:gj8fuxR21t5i8fyvnsNSMY/IrwpFopNZ6:gj8fuK1GYyvqSJ/IrWopNI
- TLSH T151B4F112B945C033E9E215304A66DB610BBE7D749B3695C73B8036AE6EB53C2D77830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2772 172.tmp 2580 1FF.tmp 3036 27C.tmp 832 356.tmp 2780 3D3.tmp 3712 450.tmp 4748 52B.tmp 1892 5C7.tmp 3824 664.tmp 332 710.tmp 4508 7AC.tmp 2492 829.tmp 1996 8C5.tmp 2392 932.tmp 5084 9CF.tmp 3328 A2C.tmp 700 AA9.tmp 3488 B17.tmp 2484 BA3.tmp 1576 C11.tmp 1728 C8E.tmp 3980 D0B.tmp 628 DD6.tmp 3776 E63.tmp 3972 EE0.tmp 5072 F6C.tmp 2336 1008.tmp 1724 1057.tmp 1620 1112.tmp 4364 11BE.tmp 4300 124B.tmp 2572 12F6.tmp 116 1393.tmp 3544 1400.tmp 3968 144E.tmp 4244 149C.tmp 1680 14EA.tmp 920 1548.tmp 1152 1596.tmp 1364 15E4.tmp 3676 1633.tmp 548 1681.tmp 4052 16EE.tmp 900 173C.tmp 1828 178A.tmp 3868 17D8.tmp 3792 1836.tmp 3672 1884.tmp 4292 18D2.tmp 4384 1921.tmp 896 196F.tmp 4248 19BD.tmp 3800 1A0B.tmp 2328 1A59.tmp 4216 1AA7.tmp 4480 1B05.tmp 2620 1B53.tmp 1400 1BA1.tmp 1088 1BEF.tmp 852 1C3D.tmp 3196 1C9B.tmp 4588 1CE9.tmp 2168 1D37.tmp 3408 1DA5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B561.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 678A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EED0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 680C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 2772 4412 2026-08-08_18ad8752917e46a523a9c41f101a6c07_elex_mafia.exe 84 PID 2772 wrote to memory of 2580 2772 172.tmp 85 PID 2580 wrote to memory of 3036 2580 1FF.tmp 86 PID 3036 wrote to memory of 832 3036 27C.tmp 87 PID 832 wrote to memory of 2780 832 356.tmp 88 PID 2780 wrote to memory of 3712 2780 3D3.tmp 89 PID 3712 wrote to memory of 4748 3712 450.tmp 90 PID 4748 wrote to memory of 1892 4748 52B.tmp 91 PID 1892 wrote to memory of 3824 1892 5C7.tmp 92 PID 3824 wrote to memory of 332 3824 664.tmp 93 PID 332 wrote to memory of 4508 332 710.tmp 94 PID 4508 wrote to memory of 2492 4508 7AC.tmp 95 PID 2492 wrote to memory of 1996 2492 829.tmp 96 PID 1996 wrote to memory of 2392 1996 8C5.tmp 97 PID 2392 wrote to memory of 5084 2392 932.tmp 98 PID 5084 wrote to memory of 3328 5084 9CF.tmp 99 PID 3328 wrote to memory of 700 3328 A2C.tmp 100 PID 700 wrote to memory of 3488 700 AA9.tmp 101 PID 3488 wrote to memory of 2484 3488 B17.tmp 102 PID 2484 wrote to memory of 1576 2484 BA3.tmp 103 PID 1576 wrote to memory of 1728 1576 C11.tmp 104 PID 1728 wrote to memory of 3980 1728 C8E.tmp 105 PID 3980 wrote to memory of 628 3980 D0B.tmp 106 PID 628 wrote to memory of 3776 628 DD6.tmp 107 PID 3776 wrote to memory of 3972 3776 E63.tmp 108 PID 3972 wrote to memory of 5072 3972 EE0.tmp 109 PID 5072 wrote to memory of 2336 5072 F6C.tmp 110 PID 2336 wrote to memory of 1724 2336 1008.tmp 111 PID 1724 wrote to memory of 1620 1724 1057.tmp 112 PID 1620 wrote to memory of 4364 1620 1112.tmp 113 PID 4364 wrote to memory of 4300 4364 11BE.tmp 114 PID 4300 wrote to memory of 2572 4300 124B.tmp 115 PID 2572 wrote to memory of 116 2572 12F6.tmp 116 PID 116 wrote to memory of 3544 116 1393.tmp 117 PID 3544 wrote to memory of 3968 3544 1400.tmp 118 PID 3968 wrote to memory of 4244 3968 144E.tmp 119 PID 4244 wrote to memory of 1680 4244 149C.tmp 120 PID 1680 wrote to memory of 920 1680 14EA.tmp 121 PID 920 wrote to memory of 1152 920 1548.tmp 122 PID 1152 wrote to memory of 1364 1152 1596.tmp 123 PID 1364 wrote to memory of 3676 1364 15E4.tmp 124 PID 3676 wrote to memory of 548 3676 1633.tmp 125 PID 548 wrote to memory of 4052 548 1681.tmp 126 PID 4052 wrote to memory of 900 4052 16EE.tmp 127 PID 900 wrote to memory of 1828 900 173C.tmp 128 PID 1828 wrote to memory of 3868 1828 178A.tmp 129 PID 3868 wrote to memory of 3792 3868 17D8.tmp 130 PID 3792 wrote to memory of 3672 3792 1836.tmp 131 PID 3672 wrote to memory of 4292 3672 1884.tmp 132 PID 4292 wrote to memory of 4384 4292 18D2.tmp 133 PID 4384 wrote to memory of 896 4384 1921.tmp 134 PID 896 wrote to memory of 4248 896 196F.tmp 135 PID 4248 wrote to memory of 3800 4248 19BD.tmp 136 PID 3800 wrote to memory of 2328 3800 1A0B.tmp 137 PID 2328 wrote to memory of 4216 2328 1A59.tmp 138 PID 4216 wrote to memory of 4480 4216 1AA7.tmp 139 PID 4480 wrote to memory of 2620 4480 1B05.tmp 140 PID 2620 wrote to memory of 1400 2620 1B53.tmp 141 PID 1400 wrote to memory of 1088 1400 1BA1.tmp 142 PID 1088 wrote to memory of 852 1088 1BEF.tmp 143 PID 852 wrote to memory of 3196 852 1C3D.tmp 144 PID 3196 wrote to memory of 4588 3196 1C9B.tmp 145 PID 4588 wrote to memory of 2168 4588 1CE9.tmp 146 PID 2168 wrote to memory of 3408 2168 1D37.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_18ad8752917e46a523a9c41f101a6c07_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_18ad8752917e46a523a9c41f101a6c07_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"65⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"66⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"67⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"68⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"70⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"71⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"72⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"73⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"74⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"75⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"76⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"77⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"78⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"79⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"80⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"81⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"82⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"83⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"84⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"85⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"86⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"87⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"88⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"89⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"90⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"91⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"92⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"93⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"94⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"95⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"96⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"98⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"99⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"100⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"101⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"102⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"103⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"104⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"105⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\2B41.tmp"C:\Users\Admin\AppData\Local\Temp\2B41.tmp"106⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"107⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"108⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"109⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"110⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"111⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"112⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"113⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"114⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"116⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"117⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"118⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"119⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"120⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"121⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"122⤵PID:3560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-