Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_abf1b6d5cd3b9217ee308837aeeec556_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_abf1b6d5cd3b9217ee308837aeeec556_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-24_abf1b6d5cd3b9217ee308837aeeec556_elex_mafia.exe
- Size 520KB
- Sample260825-e75vnssxht
- SHA256 1bb489bdd3c7fe69e356d564a6964952bc5a69fb52a97d882d4184918f1c1b43
- MD5 abf1b6d5cd3b9217ee308837aeeec556
- SHA1 b071fd226f6b770f3cfa758d90ae1415ed90f770
- SHA512 eec50351ff6be9e85a6978f1e7470cb6a13b2018d3b539a1f569d9c2f1946100ffb78f5aa552408c437f34cdfa774c2b765a5dbcadd893d830c55170bfe0d733
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL8wCofZotxjaQe0PQ9Kuqv0RLY8Hf7aFyqjfvP:roRXOQjmOysWGjs/qQU8z7iiNZE
- TLSH T1A8B4F022B188C036E4E215344B66DFA20B3E7D775B6A92C73B84266D6FB42C1E774347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3352 5B5A.tmp 3748 5C06.tmp 1036 5CB1.tmp 5072 5D6D.tmp 2312 5E09.tmp 5100 5EB5.tmp 4788 5F51.tmp 1976 5FBF.tmp 1776 604B.tmp 4756 60F7.tmp 3004 6184.tmp 2460 6210.tmp 3656 629D.tmp 2512 62FB.tmp 4148 6359.tmp 4472 63D6.tmp 4188 6462.tmp 2716 64D0.tmp 2272 656C.tmp 3600 65E9.tmp 2028 6695.tmp 2444 6721.tmp 4344 67BE.tmp 4504 683B.tmp 4128 68C7.tmp 1920 6963.tmp 216 6A0F.tmp 3532 6AAC.tmp 4820 6B29.tmp 3052 6BA6.tmp 4396 6C51.tmp 3628 6CAF.tmp 3828 6D2C.tmp 4908 6D8A.tmp 3092 6DF7.tmp 1740 6E65.tmp 4892 6ED2.tmp 4448 6F20.tmp 4468 6F7E.tmp 568 6FDC.tmp 3340 7039.tmp 4600 7088.tmp 2260 70D6.tmp 1724 7133.tmp 1080 7191.tmp 2504 71EF.tmp 4784 724D.tmp 4896 729B.tmp 2052 72F9.tmp 4300 7347.tmp 3336 7395.tmp 2216 73E3.tmp 1684 7431.tmp 4316 747F.tmp 1940 74CD.tmp 2268 751B.tmp 4180 756A.tmp 2164 75C7.tmp 4252 7615.tmp 2616 7664.tmp 1228 76B2.tmp 3540 7700.tmp 4740 774E.tmp 5036 779C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5589.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 839D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3352 4540 2026-08-24_abf1b6d5cd3b9217ee308837aeeec556_elex_mafia.exe 86 PID 3352 wrote to memory of 3748 3352 5B5A.tmp 87 PID 3748 wrote to memory of 1036 3748 5C06.tmp 88 PID 1036 wrote to memory of 5072 1036 5CB1.tmp 89 PID 5072 wrote to memory of 2312 5072 5D6D.tmp 90 PID 2312 wrote to memory of 5100 2312 5E09.tmp 91 PID 5100 wrote to memory of 4788 5100 5EB5.tmp 92 PID 4788 wrote to memory of 1976 4788 5F51.tmp 93 PID 1976 wrote to memory of 1776 1976 5FBF.tmp 94 PID 1776 wrote to memory of 4756 1776 604B.tmp 95 PID 4756 wrote to memory of 3004 4756 60F7.tmp 96 PID 3004 wrote to memory of 2460 3004 6184.tmp 97 PID 2460 wrote to memory of 3656 2460 6210.tmp 98 PID 3656 wrote to memory of 2512 3656 629D.tmp 99 PID 2512 wrote to memory of 4148 2512 62FB.tmp 100 PID 4148 wrote to memory of 4472 4148 6359.tmp 101 PID 4472 wrote to memory of 4188 4472 63D6.tmp 102 PID 4188 wrote to memory of 2716 4188 6462.tmp 103 PID 2716 wrote to memory of 2272 2716 64D0.tmp 104 PID 2272 wrote to memory of 3600 2272 656C.tmp 105 PID 3600 wrote to memory of 2028 3600 65E9.tmp 106 PID 2028 wrote to memory of 2444 2028 6695.tmp 109 PID 2444 wrote to memory of 4344 2444 6721.tmp 110 PID 4344 wrote to memory of 4504 4344 67BE.tmp 111 PID 4504 wrote to memory of 4128 4504 683B.tmp 112 PID 4128 wrote to memory of 1920 4128 68C7.tmp 113 PID 1920 wrote to memory of 216 1920 6963.tmp 114 PID 216 wrote to memory of 3532 216 6A0F.tmp 115 PID 3532 wrote to memory of 4820 3532 6AAC.tmp 116 PID 4820 wrote to memory of 3052 4820 6B29.tmp 118 PID 3052 wrote to memory of 4396 3052 6BA6.tmp 119 PID 4396 wrote to memory of 3628 4396 6C51.tmp 121 PID 3628 wrote to memory of 3828 3628 6CAF.tmp 122 PID 3828 wrote to memory of 4908 3828 6D2C.tmp 123 PID 4908 wrote to memory of 3092 4908 6D8A.tmp 124 PID 3092 wrote to memory of 1740 3092 6DF7.tmp 125 PID 1740 wrote to memory of 4892 1740 6E65.tmp 126 PID 4892 wrote to memory of 4448 4892 6ED2.tmp 127 PID 4448 wrote to memory of 4468 4448 6F20.tmp 128 PID 4468 wrote to memory of 568 4468 6F7E.tmp 129 PID 568 wrote to memory of 3340 568 6FDC.tmp 130 PID 3340 wrote to memory of 4600 3340 7039.tmp 131 PID 4600 wrote to memory of 2260 4600 7088.tmp 132 PID 2260 wrote to memory of 1724 2260 70D6.tmp 133 PID 1724 wrote to memory of 1080 1724 7133.tmp 134 PID 1080 wrote to memory of 2504 1080 7191.tmp 135 PID 2504 wrote to memory of 4784 2504 71EF.tmp 136 PID 4784 wrote to memory of 4896 4784 724D.tmp 137 PID 4896 wrote to memory of 2052 4896 729B.tmp 138 PID 2052 wrote to memory of 4300 2052 72F9.tmp 139 PID 4300 wrote to memory of 3336 4300 7347.tmp 140 PID 3336 wrote to memory of 2216 3336 7395.tmp 141 PID 2216 wrote to memory of 1684 2216 73E3.tmp 142 PID 1684 wrote to memory of 4316 1684 7431.tmp 143 PID 4316 wrote to memory of 1940 4316 747F.tmp 144 PID 1940 wrote to memory of 2268 1940 74CD.tmp 145 PID 2268 wrote to memory of 4180 2268 751B.tmp 146 PID 4180 wrote to memory of 2164 4180 756A.tmp 147 PID 2164 wrote to memory of 4252 2164 75C7.tmp 148 PID 4252 wrote to memory of 2616 4252 7615.tmp 149 PID 2616 wrote to memory of 1228 2616 7664.tmp 150 PID 1228 wrote to memory of 3540 1228 76B2.tmp 151 PID 3540 wrote to memory of 4740 3540 7700.tmp 152 PID 4740 wrote to memory of 5036 4740 774E.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_abf1b6d5cd3b9217ee308837aeeec556_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_abf1b6d5cd3b9217ee308837aeeec556_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5F51.tmp"C:\Users\Admin\AppData\Local\Temp\5F51.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\6210.tmp"C:\Users\Admin\AppData\Local\Temp\6210.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\70D6.tmp"C:\Users\Admin\AppData\Local\Temp\70D6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\74CD.tmp"C:\Users\Admin\AppData\Local\Temp\74CD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\751B.tmp"C:\Users\Admin\AppData\Local\Temp\751B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\756A.tmp"C:\Users\Admin\AppData\Local\Temp\756A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"65⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\77EA.tmp"C:\Users\Admin\AppData\Local\Temp\77EA.tmp"66⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"67⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"69⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"70⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"71⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"72⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"73⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7AB9.tmp"C:\Users\Admin\AppData\Local\Temp\7AB9.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"75⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"76⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"77⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"78⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"80⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"81⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"82⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\7D88.tmp"C:\Users\Admin\AppData\Local\Temp\7D88.tmp"83⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"84⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"85⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"86⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"87⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"88⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"89⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"90⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"91⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"92⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"93⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"94⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"96⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"97⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\82B8.tmp"C:\Users\Admin\AppData\Local\Temp\82B8.tmp"98⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"99⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"100⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"101⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"102⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"103⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"104⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\850A.tmp"C:\Users\Admin\AppData\Local\Temp\850A.tmp"105⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"106⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"107⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\8604.tmp"C:\Users\Admin\AppData\Local\Temp\8604.tmp"108⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"109⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"110⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"111⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"112⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"113⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"114⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"115⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"116⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"117⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"118⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"119⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"120⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"121⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"122⤵PID:4996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-