Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 23:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_22ca21940289c618f84d2e37239352bd_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_22ca21940289c618f84d2e37239352bd_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_22ca21940289c618f84d2e37239352bd_elex_mafia.exe
- Size 520KB
- Sample260819-27eptabl9y
- SHA256 425664d419bb729e6351b5f179fe25d3a57e48d36afba7bc15f2d831c9b7a24b
- MD5 22ca21940289c618f84d2e37239352bd
- SHA1 7901102e7ec196586144788394388d3a070366c3
- SHA512 a34596d6060e4fb980ee8187d2b1ad4dc1f15afd3ac3efbefbdcf2bb634cbc229d4433f73a5022f3aba90d3c9956036c97355a93e797feca7ab127dd908ab6ae
- SSDEEP 12288:gj8fuxR21t5i8frqhVFgwL0FGJV2RIqW/vNomj7CsdNZ6:gj8fuK1GYOV0cjsIqWXNoCmsdNI
- TLSH T172B4F102798AC032E9E212314B66DB610BBE7D798B26D5C73BC0326D7EB52D1D63470B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4932 A65D.tmp 1492 A6F9.tmp 1464 A7B5.tmp 3988 A8CE.tmp 2484 A96A.tmp 2320 A9E7.tmp 4672 AA74.tmp 1740 AB2F.tmp 1816 ABBC.tmp 1460 AC68.tmp 3304 ACD5.tmp 1216 AD62.tmp 1036 ADCF.tmp 1152 AE5C.tmp 2696 AF17.tmp 2656 AFD3.tmp 4580 B06F.tmp 4920 B0FC.tmp 632 B188.tmp 4976 B205.tmp 4832 B2A1.tmp 2512 B31E.tmp 4412 B3CA.tmp 4076 B447.tmp 1060 B4D4.tmp 3452 B561.tmp 220 B5ED.tmp 4056 B689.tmp 1764 B716.tmp 4476 B7A3.tmp 1268 B83F.tmp 3704 B91A.tmp 2192 B987.tmp 736 BA14.tmp 3832 BA62.tmp 1476 BAB0.tmp 3200 BB1D.tmp 3224 BB8B.tmp 4944 BBD9.tmp 1904 BC27.tmp 5040 BC75.tmp 1180 BCC3.tmp 2504 BD11.tmp 928 BD5F.tmp 996 BDAE.tmp 4120 BDFC.tmp 3400 BE59.tmp 1808 BEA8.tmp 1540 BEF6.tmp 4480 BF44.tmp 4880 BF92.tmp 840 BFE0.tmp 4484 C02E.tmp 2096 C07C.tmp 2568 C0CA.tmp 4808 C119.tmp 4816 C167.tmp 4904 C1B5.tmp 4260 C203.tmp 4564 C251.tmp 2632 C29F.tmp 3888 C30D.tmp 1908 C37A.tmp 2424 C3C8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E15D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 389A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F16B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E21.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 4932 2388 2026-08-19_22ca21940289c618f84d2e37239352bd_elex_mafia.exe 86 PID 4932 wrote to memory of 1492 4932 A65D.tmp 87 PID 1492 wrote to memory of 1464 1492 A6F9.tmp 88 PID 1464 wrote to memory of 3988 1464 A7B5.tmp 89 PID 3988 wrote to memory of 2484 3988 A8CE.tmp 90 PID 2484 wrote to memory of 2320 2484 A96A.tmp 91 PID 2320 wrote to memory of 4672 2320 A9E7.tmp 92 PID 4672 wrote to memory of 1740 4672 AA74.tmp 93 PID 1740 wrote to memory of 1816 1740 AB2F.tmp 94 PID 1816 wrote to memory of 1460 1816 ABBC.tmp 95 PID 1460 wrote to memory of 3304 1460 AC68.tmp 96 PID 3304 wrote to memory of 1216 3304 ACD5.tmp 97 PID 1216 wrote to memory of 1036 1216 AD62.tmp 98 PID 1036 wrote to memory of 1152 1036 ADCF.tmp 99 PID 1152 wrote to memory of 2696 1152 AE5C.tmp 100 PID 2696 wrote to memory of 2656 2696 AF17.tmp 101 PID 2656 wrote to memory of 4580 2656 AFD3.tmp 102 PID 4580 wrote to memory of 4920 4580 B06F.tmp 103 PID 4920 wrote to memory of 632 4920 B0FC.tmp 104 PID 632 wrote to memory of 4976 632 B188.tmp 105 PID 4976 wrote to memory of 4832 4976 B205.tmp 106 PID 4832 wrote to memory of 2512 4832 B2A1.tmp 107 PID 2512 wrote to memory of 4412 2512 B31E.tmp 108 PID 4412 wrote to memory of 4076 4412 B3CA.tmp 109 PID 4076 wrote to memory of 1060 4076 B447.tmp 110 PID 1060 wrote to memory of 3452 1060 B4D4.tmp 111 PID 3452 wrote to memory of 220 3452 B561.tmp 112 PID 220 wrote to memory of 4056 220 B5ED.tmp 113 PID 4056 wrote to memory of 1764 4056 B689.tmp 114 PID 1764 wrote to memory of 4476 1764 B716.tmp 115 PID 4476 wrote to memory of 1268 4476 B7A3.tmp 116 PID 1268 wrote to memory of 3704 1268 B83F.tmp 117 PID 3704 wrote to memory of 2192 3704 B91A.tmp 118 PID 2192 wrote to memory of 736 2192 B987.tmp 119 PID 736 wrote to memory of 3832 736 BA14.tmp 120 PID 3832 wrote to memory of 1476 3832 BA62.tmp 121 PID 1476 wrote to memory of 3200 1476 BAB0.tmp 122 PID 3200 wrote to memory of 3224 3200 BB1D.tmp 123 PID 3224 wrote to memory of 4944 3224 BB8B.tmp 124 PID 4944 wrote to memory of 1904 4944 BBD9.tmp 125 PID 1904 wrote to memory of 5040 1904 BC27.tmp 126 PID 5040 wrote to memory of 1180 5040 BC75.tmp 127 PID 1180 wrote to memory of 2504 1180 BCC3.tmp 128 PID 2504 wrote to memory of 928 2504 BD11.tmp 129 PID 928 wrote to memory of 996 928 BD5F.tmp 130 PID 996 wrote to memory of 4120 996 BDAE.tmp 131 PID 4120 wrote to memory of 3400 4120 BDFC.tmp 132 PID 3400 wrote to memory of 1808 3400 BE59.tmp 133 PID 1808 wrote to memory of 1540 1808 BEA8.tmp 134 PID 1540 wrote to memory of 4480 1540 BEF6.tmp 135 PID 4480 wrote to memory of 4880 4480 BF44.tmp 136 PID 4880 wrote to memory of 840 4880 BF92.tmp 137 PID 840 wrote to memory of 4484 840 BFE0.tmp 138 PID 4484 wrote to memory of 2096 4484 C02E.tmp 139 PID 2096 wrote to memory of 2568 2096 C07C.tmp 140 PID 2568 wrote to memory of 4808 2568 C0CA.tmp 141 PID 4808 wrote to memory of 4816 4808 C119.tmp 142 PID 4816 wrote to memory of 4904 4816 C167.tmp 143 PID 4904 wrote to memory of 4260 4904 C1B5.tmp 144 PID 4260 wrote to memory of 4564 4260 C203.tmp 145 PID 4564 wrote to memory of 2632 4564 C251.tmp 146 PID 2632 wrote to memory of 3888 2632 C29F.tmp 147 PID 3888 wrote to memory of 1908 3888 C30D.tmp 148 PID 1908 wrote to memory of 2424 1908 C37A.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_22ca21940289c618f84d2e37239352bd_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_22ca21940289c618f84d2e37239352bd_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\AC68.tmp"C:\Users\Admin\AppData\Local\Temp\AC68.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\AF17.tmp"C:\Users\Admin\AppData\Local\Temp\AF17.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"C:\Users\Admin\AppData\Local\Temp\AFD3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\B06F.tmp"C:\Users\Admin\AppData\Local\Temp\B06F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\B3CA.tmp"C:\Users\Admin\AppData\Local\Temp\B3CA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\B447.tmp"C:\Users\Admin\AppData\Local\Temp\B447.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B561.tmp"C:\Users\Admin\AppData\Local\Temp\B561.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\B83F.tmp"C:\Users\Admin\AppData\Local\Temp\B83F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\B987.tmp"C:\Users\Admin\AppData\Local\Temp\B987.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\BA14.tmp"C:\Users\Admin\AppData\Local\Temp\BA14.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\BA62.tmp"C:\Users\Admin\AppData\Local\Temp\BA62.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\BC27.tmp"C:\Users\Admin\AppData\Local\Temp\BC27.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\BC75.tmp"C:\Users\Admin\AppData\Local\Temp\BC75.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\BE59.tmp"C:\Users\Admin\AppData\Local\Temp\BE59.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\BEA8.tmp"C:\Users\Admin\AppData\Local\Temp\BEA8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\BF44.tmp"C:\Users\Admin\AppData\Local\Temp\BF44.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\C02E.tmp"C:\Users\Admin\AppData\Local\Temp\C02E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\C07C.tmp"C:\Users\Admin\AppData\Local\Temp\C07C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\C251.tmp"C:\Users\Admin\AppData\Local\Temp\C251.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\C29F.tmp"C:\Users\Admin\AppData\Local\Temp\C29F.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\C37A.tmp"C:\Users\Admin\AppData\Local\Temp\C37A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"65⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"66⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"67⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"68⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"69⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"70⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"71⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"72⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C687.tmp"C:\Users\Admin\AppData\Local\Temp\C687.tmp"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"74⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C733.tmp"C:\Users\Admin\AppData\Local\Temp\C733.tmp"75⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C781.tmp"C:\Users\Admin\AppData\Local\Temp\C781.tmp"76⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"77⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"78⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"79⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"80⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"81⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"82⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"83⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\CA6F.tmp"C:\Users\Admin\AppData\Local\Temp\CA6F.tmp"84⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"85⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"86⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"87⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"88⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"89⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"90⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"91⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"92⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"93⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"94⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"95⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\CED4.tmp"C:\Users\Admin\AppData\Local\Temp\CED4.tmp"96⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"97⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\CF90.tmp"C:\Users\Admin\AppData\Local\Temp\CF90.tmp"98⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"99⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"100⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"101⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"102⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"103⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"104⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"105⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"106⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\D27E.tmp"C:\Users\Admin\AppData\Local\Temp\D27E.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"108⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\D32A.tmp"C:\Users\Admin\AppData\Local\Temp\D32A.tmp"109⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\D378.tmp"C:\Users\Admin\AppData\Local\Temp\D378.tmp"110⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"111⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:724 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"113⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"114⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"115⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"116⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\D656.tmp"C:\Users\Admin\AppData\Local\Temp\D656.tmp"117⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"118⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"119⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\D740.tmp"C:\Users\Admin\AppData\Local\Temp\D740.tmp"120⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\D78F.tmp"C:\Users\Admin\AppData\Local\Temp\D78F.tmp"121⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-