Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 18:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_38ec3cee09f6dcc0ca4771caf47cb9bf_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_38ec3cee09f6dcc0ca4771caf47cb9bf_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-28_38ec3cee09f6dcc0ca4771caf47cb9bf_elex_mafia.exe
- Size 560KB
- Sample260828-w6ds8sdl21
- SHA256 cec49c5ea58fecfdc4389f810382a66ffdc8a12f61fa4451c9f1d40904b13cb1
- MD5 38ec3cee09f6dcc0ca4771caf47cb9bf
- SHA1 d9ed95cbb784cbeddb3208f23ec41f7313ecfe05
- SHA512 0093e9cbece224656a78d6974d4c13f502a974a708e695213a6c8d9be6da6b0e899b8ca09ffad0104630226e84a7dbb21342d64a62c15ffd3650499fc1f0301b
- SSDEEP 12288:MlFXOQUDmrC8SdabIOBBdbfJ4mrONuxZogpiIZxV:MlUQbC8SdakCBdbvOHgpiIR
- TLSH T1B4C4F1237584C073E6D202304A52DBA12B7B7D31572AA5C73B90366EAFB57C0DA7934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 668 3EBA.tmp 2132 3FB4.tmp 5012 40AE.tmp 3984 41C7.tmp 3840 434D.tmp 4304 4486.tmp 1136 4590.tmp 3860 466A.tmp 5088 4764.tmp 1056 485E.tmp 5068 4968.tmp 4476 4A91.tmp 2916 4B8B.tmp 2428 4C75.tmp 4300 4D60.tmp 3284 4E4A.tmp 4472 4F44.tmp 960 501F.tmp 32 5148.tmp 4104 5213.tmp 4144 530D.tmp 988 53D8.tmp 972 54E1.tmp 3880 55DB.tmp 2524 56C6.tmp 4884 57A1.tmp 1556 587B.tmp 1804 5946.tmp 4612 59F2.tmp 2824 5AFC.tmp 852 5BC7.tmp 4452 5CA2.tmp 3364 5D7D.tmp 2744 5E28.tmp 4548 5EC5.tmp 1224 5F80.tmp 4564 602C.tmp 4776 60D8.tmp 1576 6174.tmp 552 6220.tmp 3340 62BC.tmp 3988 6339.tmp 3704 63B6.tmp 2840 6453.tmp 4908 64DF.tmp 704 655C.tmp 1836 65D9.tmp 3656 6695.tmp 4976 6721.tmp 3960 676F.tmp 876 67BE.tmp 4196 680C.tmp 3808 685A.tmp 3768 68A8.tmp 4824 68F6.tmp 560 6944.tmp 1936 6992.tmp 4980 69E0.tmp 3400 6A2F.tmp 2288 6A8C.tmp 2412 6ADA.tmp 4348 6B38.tmp 4580 6B96.tmp 5056 6BF4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F652.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8529.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 355E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 386B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 779C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EA3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 668 4572 2026-08-28_38ec3cee09f6dcc0ca4771caf47cb9bf_elex_mafia.exe 86 PID 668 wrote to memory of 2132 668 3EBA.tmp 87 PID 2132 wrote to memory of 5012 2132 3FB4.tmp 88 PID 5012 wrote to memory of 3984 5012 40AE.tmp 89 PID 3984 wrote to memory of 3840 3984 41C7.tmp 90 PID 3840 wrote to memory of 4304 3840 434D.tmp 91 PID 4304 wrote to memory of 1136 4304 4486.tmp 92 PID 1136 wrote to memory of 3860 1136 4590.tmp 93 PID 3860 wrote to memory of 5088 3860 466A.tmp 94 PID 5088 wrote to memory of 1056 5088 4764.tmp 95 PID 1056 wrote to memory of 5068 1056 485E.tmp 96 PID 5068 wrote to memory of 4476 5068 4968.tmp 97 PID 4476 wrote to memory of 2916 4476 4A91.tmp 98 PID 2916 wrote to memory of 2428 2916 4B8B.tmp 99 PID 2428 wrote to memory of 4300 2428 4C75.tmp 100 PID 4300 wrote to memory of 3284 4300 4D60.tmp 101 PID 3284 wrote to memory of 4472 3284 4E4A.tmp 102 PID 4472 wrote to memory of 960 4472 4F44.tmp 103 PID 960 wrote to memory of 32 960 501F.tmp 104 PID 32 wrote to memory of 4104 32 5148.tmp 105 PID 4104 wrote to memory of 4144 4104 5213.tmp 106 PID 4144 wrote to memory of 988 4144 530D.tmp 107 PID 988 wrote to memory of 972 988 53D8.tmp 108 PID 972 wrote to memory of 3880 972 54E1.tmp 109 PID 3880 wrote to memory of 2524 3880 55DB.tmp 110 PID 2524 wrote to memory of 4884 2524 56C6.tmp 111 PID 4884 wrote to memory of 1556 4884 57A1.tmp 112 PID 1556 wrote to memory of 1804 1556 587B.tmp 113 PID 1804 wrote to memory of 4612 1804 5946.tmp 114 PID 4612 wrote to memory of 2824 4612 59F2.tmp 115 PID 2824 wrote to memory of 852 2824 5AFC.tmp 116 PID 852 wrote to memory of 4452 852 5BC7.tmp 117 PID 4452 wrote to memory of 3364 4452 5CA2.tmp 118 PID 3364 wrote to memory of 2744 3364 5D7D.tmp 119 PID 2744 wrote to memory of 4548 2744 5E28.tmp 120 PID 4548 wrote to memory of 1224 4548 5EC5.tmp 121 PID 1224 wrote to memory of 4564 1224 5F80.tmp 122 PID 4564 wrote to memory of 4776 4564 602C.tmp 123 PID 4776 wrote to memory of 1576 4776 60D8.tmp 124 PID 1576 wrote to memory of 552 1576 6174.tmp 125 PID 552 wrote to memory of 3340 552 6220.tmp 126 PID 3340 wrote to memory of 3988 3340 62BC.tmp 127 PID 3988 wrote to memory of 3704 3988 6339.tmp 128 PID 3704 wrote to memory of 2840 3704 63B6.tmp 129 PID 2840 wrote to memory of 4908 2840 6453.tmp 130 PID 4908 wrote to memory of 704 4908 64DF.tmp 131 PID 704 wrote to memory of 1836 704 655C.tmp 132 PID 1836 wrote to memory of 3656 1836 65D9.tmp 133 PID 3656 wrote to memory of 4976 3656 6695.tmp 134 PID 4976 wrote to memory of 3960 4976 6721.tmp 136 PID 3960 wrote to memory of 876 3960 676F.tmp 137 PID 876 wrote to memory of 4196 876 67BE.tmp 138 PID 4196 wrote to memory of 3808 4196 680C.tmp 139 PID 3808 wrote to memory of 3768 3808 685A.tmp 140 PID 3768 wrote to memory of 4824 3768 68A8.tmp 141 PID 4824 wrote to memory of 560 4824 68F6.tmp 142 PID 560 wrote to memory of 1936 560 6944.tmp 143 PID 1936 wrote to memory of 4980 1936 6992.tmp 144 PID 4980 wrote to memory of 3400 4980 69E0.tmp 145 PID 3400 wrote to memory of 2288 3400 6A2F.tmp 146 PID 2288 wrote to memory of 2412 2288 6A8C.tmp 147 PID 2412 wrote to memory of 4348 2412 6ADA.tmp 148 PID 4348 wrote to memory of 4580 4348 6B38.tmp 149 PID 4580 wrote to memory of 5056 4580 6B96.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_38ec3cee09f6dcc0ca4771caf47cb9bf_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_38ec3cee09f6dcc0ca4771caf47cb9bf_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\434D.tmp"C:\Users\Admin\AppData\Local\Temp\434D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\62BC.tmp"C:\Users\Admin\AppData\Local\Temp\62BC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6944.tmp"C:\Users\Admin\AppData\Local\Temp\6944.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"65⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"66⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"67⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"68⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"69⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"70⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"71⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"72⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"74⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"75⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"76⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"77⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"78⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"79⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"80⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"81⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"82⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"83⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"84⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"85⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"86⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"88⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"89⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"90⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"91⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"92⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"93⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"94⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"95⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"96⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\7644.tmp"C:\Users\Admin\AppData\Local\Temp\7644.tmp"97⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"98⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\76E1.tmp"C:\Users\Admin\AppData\Local\Temp\76E1.tmp"99⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"100⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\77EA.tmp"C:\Users\Admin\AppData\Local\Temp\77EA.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"103⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"104⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"105⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\7923.tmp"C:\Users\Admin\AppData\Local\Temp\7923.tmp"106⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\7971.tmp"C:\Users\Admin\AppData\Local\Temp\7971.tmp"107⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"108⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\7A0D.tmp"C:\Users\Admin\AppData\Local\Temp\7A0D.tmp"109⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"110⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"111⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"112⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"113⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"114⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\7C11.tmp"C:\Users\Admin\AppData\Local\Temp\7C11.tmp"115⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"116⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"117⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"118⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"119⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"120⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"121⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"122⤵PID:2228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-