Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 15:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_46059b7467d3397855a9e829bc9db26b_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_46059b7467d3397855a9e829bc9db26b_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_46059b7467d3397855a9e829bc9db26b_elex_mafia.exe
- Size 520KB
- Sample261002-s3thqsdb96
- SHA256 e11bd18d719f3cb14d4cf9d365c55a052944a2b9bd06b0b196943cb27c1eb168
- MD5 46059b7467d3397855a9e829bc9db26b
- SHA1 14f2ab793cdded7c291eba8b84293091fc7ef124
- SHA512 fa538c7762bdd528f22399a54b3294628cd04e716bf5e685fb14837b96a7c3026719d8b5fea3bd66a4891876341dfadfe982b94b5c9520ee10841122b3d0b596
- SSDEEP 12288:roRXOQjmOyruVmHA4JDyNARjxEqwovB6W1881NZ:rogQ9yKj4JD6ojxEqwoph1dN
- TLSH T16AB4E112B584C032E5D226308B25DFA14A7F7D734B2A92C73B84267D6EF42D1E6B534B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4480 A0B0.tmp 812 A12D.tmp 4576 A1D9.tmp 3840 A265.tmp 3796 A311.tmp 4984 A3BD.tmp 4456 A44A.tmp 4752 A4F5.tmp 5068 A5A1.tmp 1420 A63E.tmp 4584 A6AB.tmp 220 A728.tmp 4212 A7D4.tmp 1312 A89F.tmp 2556 A91C.tmp 1756 A9D7.tmp 4880 AA83.tmp 2420 AB20.tmp 4528 ABBC.tmp 2564 AC68.tmp 4364 ACE5.tmp 880 AD71.tmp 768 ADDF.tmp 3924 AE4C.tmp 1444 AF27.tmp 1792 AFC3.tmp 4500 B06F.tmp 1144 B0FC.tmp 3332 B1C7.tmp 4016 B234.tmp 2528 B2E0.tmp 2580 B34D.tmp 3672 B409.tmp 3328 B457.tmp 4900 B4C4.tmp 692 B532.tmp 4200 B59F.tmp 4492 B5ED.tmp 4124 B64B.tmp 2920 B6B8.tmp 1224 B726.tmp 3772 B793.tmp 4276 B7F1.tmp 1724 B83F.tmp 2336 B88D.tmp 5028 B8DB.tmp 2096 B949.tmp 1060 B997.tmp 1456 B9E5.tmp 2192 BA33.tmp 4732 BA81.tmp 4004 BACF.tmp 944 BB1D.tmp 1624 BB6B.tmp 2456 BBC9.tmp 3520 BC17.tmp 2636 BC65.tmp 4552 BCC3.tmp 1720 BD11.tmp 1016 BD5F.tmp 1032 BDBD.tmp 4428 BE1B.tmp 2736 BE69.tmp 1600 BEC7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 793D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D45D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 577D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 233E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5CB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4480 4812 2026-10-01_46059b7467d3397855a9e829bc9db26b_elex_mafia.exe 86 PID 4480 wrote to memory of 812 4480 A0B0.tmp 88 PID 812 wrote to memory of 4576 812 A12D.tmp 90 PID 4576 wrote to memory of 3840 4576 A1D9.tmp 91 PID 3840 wrote to memory of 3796 3840 A265.tmp 92 PID 3796 wrote to memory of 4984 3796 A311.tmp 94 PID 4984 wrote to memory of 4456 4984 A3BD.tmp 95 PID 4456 wrote to memory of 4752 4456 A44A.tmp 97 PID 4752 wrote to memory of 5068 4752 A4F5.tmp 100 PID 5068 wrote to memory of 1420 5068 A5A1.tmp 101 PID 1420 wrote to memory of 4584 1420 A63E.tmp 102 PID 4584 wrote to memory of 220 4584 A6AB.tmp 103 PID 220 wrote to memory of 4212 220 A728.tmp 104 PID 4212 wrote to memory of 1312 4212 A7D4.tmp 105 PID 1312 wrote to memory of 2556 1312 A89F.tmp 106 PID 2556 wrote to memory of 1756 2556 A91C.tmp 108 PID 1756 wrote to memory of 4880 1756 A9D7.tmp 109 PID 4880 wrote to memory of 2420 4880 AA83.tmp 111 PID 2420 wrote to memory of 4528 2420 AB20.tmp 112 PID 4528 wrote to memory of 2564 4528 ABBC.tmp 113 PID 2564 wrote to memory of 4364 2564 AC68.tmp 114 PID 4364 wrote to memory of 880 4364 ACE5.tmp 115 PID 880 wrote to memory of 768 880 AD71.tmp 116 PID 768 wrote to memory of 3924 768 ADDF.tmp 117 PID 3924 wrote to memory of 1444 3924 AE4C.tmp 118 PID 1444 wrote to memory of 1792 1444 AF27.tmp 119 PID 1792 wrote to memory of 4500 1792 AFC3.tmp 120 PID 4500 wrote to memory of 1144 4500 B06F.tmp 121 PID 1144 wrote to memory of 3332 1144 B0FC.tmp 122 PID 3332 wrote to memory of 4016 3332 B1C7.tmp 123 PID 4016 wrote to memory of 2528 4016 B234.tmp 124 PID 2528 wrote to memory of 2580 2528 B2E0.tmp 125 PID 2580 wrote to memory of 3672 2580 B34D.tmp 126 PID 3672 wrote to memory of 3328 3672 B409.tmp 127 PID 3328 wrote to memory of 4900 3328 B457.tmp 128 PID 4900 wrote to memory of 692 4900 B4C4.tmp 129 PID 692 wrote to memory of 4200 692 B532.tmp 131 PID 4200 wrote to memory of 4492 4200 B59F.tmp 132 PID 4492 wrote to memory of 4124 4492 B5ED.tmp 133 PID 4124 wrote to memory of 2920 4124 B64B.tmp 134 PID 2920 wrote to memory of 1224 2920 B6B8.tmp 135 PID 1224 wrote to memory of 3772 1224 B726.tmp 136 PID 3772 wrote to memory of 4276 3772 B793.tmp 137 PID 4276 wrote to memory of 1724 4276 B7F1.tmp 138 PID 1724 wrote to memory of 2336 1724 B83F.tmp 139 PID 2336 wrote to memory of 5028 2336 B88D.tmp 140 PID 5028 wrote to memory of 2096 5028 B8DB.tmp 141 PID 2096 wrote to memory of 1060 2096 B949.tmp 142 PID 1060 wrote to memory of 1456 1060 B997.tmp 143 PID 1456 wrote to memory of 2192 1456 B9E5.tmp 144 PID 2192 wrote to memory of 4732 2192 BA33.tmp 145 PID 4732 wrote to memory of 4004 4732 BA81.tmp 146 PID 4004 wrote to memory of 944 4004 BACF.tmp 147 PID 944 wrote to memory of 1624 944 BB1D.tmp 148 PID 1624 wrote to memory of 2456 1624 BB6B.tmp 149 PID 2456 wrote to memory of 3520 2456 BBC9.tmp 150 PID 3520 wrote to memory of 2636 3520 BC17.tmp 151 PID 2636 wrote to memory of 4552 2636 BC65.tmp 152 PID 4552 wrote to memory of 1720 4552 BCC3.tmp 153 PID 1720 wrote to memory of 1016 1720 BD11.tmp 154 PID 1016 wrote to memory of 1032 1016 BD5F.tmp 155 PID 1032 wrote to memory of 4428 1032 BDBD.tmp 156 PID 4428 wrote to memory of 2736 4428 BE1B.tmp 157 PID 2736 wrote to memory of 1600 2736 BE69.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_46059b7467d3397855a9e829bc9db26b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_46059b7467d3397855a9e829bc9db26b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\A265.tmp"C:\Users\Admin\AppData\Local\Temp\A265.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\A311.tmp"C:\Users\Admin\AppData\Local\Temp\A311.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A44A.tmp"C:\Users\Admin\AppData\Local\Temp\A44A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\A89F.tmp"C:\Users\Admin\AppData\Local\Temp\A89F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\AB20.tmp"C:\Users\Admin\AppData\Local\Temp\AB20.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\AC68.tmp"C:\Users\Admin\AppData\Local\Temp\AC68.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\AE4C.tmp"C:\Users\Admin\AppData\Local\Temp\AE4C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\AF27.tmp"C:\Users\Admin\AppData\Local\Temp\AF27.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\B06F.tmp"C:\Users\Admin\AppData\Local\Temp\B06F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\B532.tmp"C:\Users\Admin\AppData\Local\Temp\B532.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B64B.tmp"C:\Users\Admin\AppData\Local\Temp\B64B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\B6B8.tmp"C:\Users\Admin\AppData\Local\Temp\B6B8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\B726.tmp"C:\Users\Admin\AppData\Local\Temp\B726.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\B793.tmp"C:\Users\Admin\AppData\Local\Temp\B793.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\B83F.tmp"C:\Users\Admin\AppData\Local\Temp\B83F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\B88D.tmp"C:\Users\Admin\AppData\Local\Temp\B88D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\B8DB.tmp"C:\Users\Admin\AppData\Local\Temp\B8DB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\B949.tmp"C:\Users\Admin\AppData\Local\Temp\B949.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B997.tmp"C:\Users\Admin\AppData\Local\Temp\B997.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"C:\Users\Admin\AppData\Local\Temp\B9E5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\BA33.tmp"C:\Users\Admin\AppData\Local\Temp\BA33.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\BA81.tmp"C:\Users\Admin\AppData\Local\Temp\BA81.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\BACF.tmp"C:\Users\Admin\AppData\Local\Temp\BACF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\BE69.tmp"C:\Users\Admin\AppData\Local\Temp\BE69.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"65⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"66⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"67⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"68⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"69⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"70⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"71⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\C157.tmp"C:\Users\Admin\AppData\Local\Temp\C157.tmp"72⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\C1A5.tmp"C:\Users\Admin\AppData\Local\Temp\C1A5.tmp"73⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C1F3.tmp"C:\Users\Admin\AppData\Local\Temp\C1F3.tmp"74⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\C251.tmp"C:\Users\Admin\AppData\Local\Temp\C251.tmp"75⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\C29F.tmp"C:\Users\Admin\AppData\Local\Temp\C29F.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"77⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"78⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"79⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\C3E7.tmp"C:\Users\Admin\AppData\Local\Temp\C3E7.tmp"80⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C435.tmp"C:\Users\Admin\AppData\Local\Temp\C435.tmp"81⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"82⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"83⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"84⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"85⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"86⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"87⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"88⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\C6F5.tmp"C:\Users\Admin\AppData\Local\Temp\C6F5.tmp"89⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"90⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"C:\Users\Admin\AppData\Local\Temp\C7A0.tmp"91⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"93⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"94⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"95⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"96⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C985.tmp"C:\Users\Admin\AppData\Local\Temp\C985.tmp"97⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"98⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"99⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"100⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"101⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"102⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"103⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"104⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"105⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"106⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"108⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"109⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"110⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"111⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"112⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"113⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"114⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"115⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"116⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\D04B.tmp"C:\Users\Admin\AppData\Local\Temp\D04B.tmp"117⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"118⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"119⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"120⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"121⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"122⤵PID:3200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-