Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 05:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_aa26adf1fefabf4efe3bff95b61e79fc_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_aa26adf1fefabf4efe3bff95b61e79fc_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_aa26adf1fefabf4efe3bff95b61e79fc_elex_mafia.exe
- Size 560KB
- Sample260817-gntdmseq6x
- SHA256 20122af12639a13dbb673f241c7a4b5b5ca0f71df2b4463ca32ad9871cad0197
- MD5 aa26adf1fefabf4efe3bff95b61e79fc
- SHA1 aa4c42156e34331d28fad535817b3d63b8a26aff
- SHA512 2c2a14cba715e2e02fc252bb8aca6b71582ade76abced08bf3eaaf98b7d7d49750f6a146d5ba30e8050ce871693f2f868a87cd31c05f56a4460d794df35894ae
- SSDEEP 6144:wLvdEBzvs0OVAJluXLyQUDmrC8Sn/tJdDdsj9iOvN+ZLWsl0SYTjAt7ndWsH34Zf:MlFXOQUDmrC8SVJdDiN/TSk6nIZxV
- TLSH T187C4F1127580C073E6D202344A66DBA22B3F7C355B2AA4D73794266DAFB93D1DB3434B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2028 A16B.tmp 5012 A236.tmp 2500 A321.tmp 4360 A43A.tmp 1216 A534.tmp 4496 A63E.tmp 5076 A718.tmp 2276 A7F3.tmp 3936 A8DD.tmp 2856 A9B8.tmp 3888 AAA3.tmp 2568 AB8D.tmp 896 AC97.tmp 2040 AD62.tmp 3348 ADFE.tmp 2256 AEB9.tmp 1992 AFB3.tmp 1712 B08E.tmp 2728 B169.tmp 2792 B224.tmp 3028 B30F.tmp 4816 B3EA.tmp 2360 B4C4.tmp 4192 B59F.tmp 2892 B67A.tmp 3040 B745.tmp 4364 B7A3.tmp 3844 B87D.tmp 3316 B8CC.tmp 4884 B91A.tmp 5072 B997.tmp 404 B9E5.tmp 3608 BA62.tmp 2132 BACF.tmp 4180 BB1D.tmp 4280 BB7B.tmp 4248 BBC9.tmp 3884 BC27.tmp 2388 BC85.tmp 1732 BCD3.tmp 3144 BD21.tmp 3096 BD7F.tmp 4720 BDDC.tmp 1988 BE2B.tmp 4768 BE88.tmp 3732 BEE6.tmp 4980 BF34.tmp 4460 BF92.tmp 3456 BFF0.tmp 5084 C03E.tmp 1976 C08C.tmp 2260 C0DA.tmp 3908 C128.tmp 208 C176.tmp 956 C1C4.tmp 3048 C213.tmp 4304 C261.tmp 3108 C2AF.tmp 5036 C2FD.tmp 4164 C34B.tmp 4048 C399.tmp 3744 C3E7.tmp 3832 C435.tmp 3236 C484.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 160A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C34B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C261.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E53B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B80B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 2028 4800 2026-08-17_aa26adf1fefabf4efe3bff95b61e79fc_elex_mafia.exe 85 PID 2028 wrote to memory of 5012 2028 A16B.tmp 86 PID 5012 wrote to memory of 2500 5012 A236.tmp 87 PID 2500 wrote to memory of 4360 2500 A321.tmp 89 PID 4360 wrote to memory of 1216 4360 A43A.tmp 90 PID 1216 wrote to memory of 4496 1216 A534.tmp 91 PID 4496 wrote to memory of 5076 4496 A63E.tmp 93 PID 5076 wrote to memory of 2276 5076 A718.tmp 95 PID 2276 wrote to memory of 3936 2276 A7F3.tmp 96 PID 3936 wrote to memory of 2856 3936 A8DD.tmp 98 PID 2856 wrote to memory of 3888 2856 A9B8.tmp 99 PID 3888 wrote to memory of 2568 3888 AAA3.tmp 100 PID 2568 wrote to memory of 896 2568 AB8D.tmp 101 PID 896 wrote to memory of 2040 896 AC97.tmp 102 PID 2040 wrote to memory of 3348 2040 AD62.tmp 103 PID 3348 wrote to memory of 2256 3348 ADFE.tmp 104 PID 2256 wrote to memory of 1992 2256 AEB9.tmp 105 PID 1992 wrote to memory of 1712 1992 AFB3.tmp 106 PID 1712 wrote to memory of 2728 1712 B08E.tmp 107 PID 2728 wrote to memory of 2792 2728 B169.tmp 108 PID 2792 wrote to memory of 3028 2792 B224.tmp 109 PID 3028 wrote to memory of 4816 3028 B30F.tmp 110 PID 4816 wrote to memory of 2360 4816 B3EA.tmp 111 PID 2360 wrote to memory of 4192 2360 B4C4.tmp 112 PID 4192 wrote to memory of 2892 4192 B59F.tmp 113 PID 2892 wrote to memory of 3040 2892 B67A.tmp 114 PID 3040 wrote to memory of 4364 3040 B745.tmp 115 PID 4364 wrote to memory of 3844 4364 B7A3.tmp 116 PID 3844 wrote to memory of 3316 3844 B87D.tmp 117 PID 3316 wrote to memory of 4884 3316 B8CC.tmp 118 PID 4884 wrote to memory of 5072 4884 B91A.tmp 119 PID 5072 wrote to memory of 404 5072 B997.tmp 120 PID 404 wrote to memory of 3608 404 B9E5.tmp 121 PID 3608 wrote to memory of 2132 3608 BA62.tmp 122 PID 2132 wrote to memory of 4180 2132 BACF.tmp 123 PID 4180 wrote to memory of 4280 4180 BB1D.tmp 124 PID 4280 wrote to memory of 4248 4280 BB7B.tmp 125 PID 4248 wrote to memory of 3884 4248 BBC9.tmp 126 PID 3884 wrote to memory of 2388 3884 BC27.tmp 127 PID 2388 wrote to memory of 1732 2388 BC85.tmp 128 PID 1732 wrote to memory of 3144 1732 BCD3.tmp 129 PID 3144 wrote to memory of 3096 3144 BD21.tmp 130 PID 3096 wrote to memory of 4720 3096 BD7F.tmp 131 PID 4720 wrote to memory of 1988 4720 BDDC.tmp 132 PID 1988 wrote to memory of 4768 1988 BE2B.tmp 133 PID 4768 wrote to memory of 3732 4768 BE88.tmp 134 PID 3732 wrote to memory of 4980 3732 BEE6.tmp 135 PID 4980 wrote to memory of 4460 4980 BF34.tmp 136 PID 4460 wrote to memory of 3456 4460 BF92.tmp 137 PID 3456 wrote to memory of 5084 3456 BFF0.tmp 138 PID 5084 wrote to memory of 1976 5084 C03E.tmp 139 PID 1976 wrote to memory of 2260 1976 C08C.tmp 140 PID 2260 wrote to memory of 3908 2260 C0DA.tmp 141 PID 3908 wrote to memory of 208 3908 C128.tmp 142 PID 208 wrote to memory of 956 208 C176.tmp 143 PID 956 wrote to memory of 3048 956 C1C4.tmp 144 PID 3048 wrote to memory of 4304 3048 C213.tmp 145 PID 4304 wrote to memory of 3108 4304 C261.tmp 146 PID 3108 wrote to memory of 5036 3108 C2AF.tmp 147 PID 5036 wrote to memory of 4164 5036 C2FD.tmp 148 PID 4164 wrote to memory of 4048 4164 C34B.tmp 149 PID 4048 wrote to memory of 3744 4048 C399.tmp 150 PID 3744 wrote to memory of 3832 3744 C3E7.tmp 151 PID 3832 wrote to memory of 3236 3832 C435.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_aa26adf1fefabf4efe3bff95b61e79fc_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_aa26adf1fefabf4efe3bff95b61e79fc_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\A16B.tmp"C:\Users\Admin\AppData\Local\Temp\A16B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\A236.tmp"C:\Users\Admin\AppData\Local\Temp\A236.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A321.tmp"C:\Users\Admin\AppData\Local\Temp\A321.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A534.tmp"C:\Users\Admin\AppData\Local\Temp\A534.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\AC97.tmp"C:\Users\Admin\AppData\Local\Temp\AC97.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B169.tmp"C:\Users\Admin\AppData\Local\Temp\B169.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\B224.tmp"C:\Users\Admin\AppData\Local\Temp\B224.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\B30F.tmp"C:\Users\Admin\AppData\Local\Temp\B30F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\B67A.tmp"C:\Users\Admin\AppData\Local\Temp\B67A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\B87D.tmp"C:\Users\Admin\AppData\Local\Temp\B87D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\B997.tmp"C:\Users\Admin\AppData\Local\Temp\B997.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\BA62.tmp"C:\Users\Admin\AppData\Local\Temp\BA62.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\BACF.tmp"C:\Users\Admin\AppData\Local\Temp\BACF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\BC27.tmp"C:\Users\Admin\AppData\Local\Temp\BC27.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\C03E.tmp"C:\Users\Admin\AppData\Local\Temp\C03E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\C08C.tmp"C:\Users\Admin\AppData\Local\Temp\C08C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\C261.tmp"C:\Users\Admin\AppData\Local\Temp\C261.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\C3E7.tmp"C:\Users\Admin\AppData\Local\Temp\C3E7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\C435.tmp"C:\Users\Admin\AppData\Local\Temp\C435.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"65⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"66⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"67⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"68⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"69⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C60A.tmp"C:\Users\Admin\AppData\Local\Temp\C60A.tmp"70⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\C678.tmp"C:\Users\Admin\AppData\Local\Temp\C678.tmp"71⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"72⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"73⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\C781.tmp"C:\Users\Admin\AppData\Local\Temp\C781.tmp"74⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"75⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"76⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"77⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"78⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"79⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"80⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"81⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"82⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"83⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"84⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"85⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"86⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"87⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"88⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"89⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"90⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"91⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"92⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"93⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"95⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"96⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\CF90.tmp"C:\Users\Admin\AppData\Local\Temp\CF90.tmp"97⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"98⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\D03C.tmp"C:\Users\Admin\AppData\Local\Temp\D03C.tmp"99⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"100⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"101⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"102⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"103⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\D220.tmp"C:\Users\Admin\AppData\Local\Temp\D220.tmp"104⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"105⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"106⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"107⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"108⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\D404.tmp"C:\Users\Admin\AppData\Local\Temp\D404.tmp"109⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"110⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"111⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\D54C.tmp"C:\Users\Admin\AppData\Local\Temp\D54C.tmp"113⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"114⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"115⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"116⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"117⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"118⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"119⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"120⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"121⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\D84A.tmp"C:\Users\Admin\AppData\Local\Temp\D84A.tmp"122⤵PID:1480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-