Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_0cd0a5f0aae68030ebc1c05223046805_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_0cd0a5f0aae68030ebc1c05223046805_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-19_0cd0a5f0aae68030ebc1c05223046805_elex_mafia.exe
- Size 816KB
- Sample260419-ltdycsfx2j
- SHA256 fd805d879c8d696be1fdd53ebb668372b857af2d56ddda50d5c97895e03cf899
- MD5 0cd0a5f0aae68030ebc1c05223046805
- SHA1 728a871aad1ced1b81e04db8d253d9d082f1ed71
- SHA512 55798ef42ec93b9bcf062f15a8c81c71fc584dde28d259ddb4f8a27a4e890d56d92bd930dd060703c262d630d027c7b3771e85f226e3bb07d7ade650cf2e8e3f
- SSDEEP 12288:+mF/W8Dsy3cV2jvN48XgYemQtrbc8/TO33Z:+m0833U+vN4wgYFzmi33
- TLSH T15505F121B698C032F59311380A2AEB62497A3D614B2769C7BBD0276D6FB13D2CF75307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3936 F81B.tmp 4328 F8F6.tmp 5852 F992.tmp 4316 FA9C.tmp 3752 FB48.tmp 5916 FC03.tmp 5888 FCA0.tmp 3144 FD6B.tmp 3692 FDF7.tmp 5696 FE94.tmp 6076 FF11.tmp 5848 FFFB.tmp 1220 A7.tmp 1676 153.tmp 3408 1FF.tmp 2040 27C.tmp 4508 337.tmp 4940 3E3.tmp 4972 470.tmp 3640 51C.tmp 2600 5C7.tmp 5740 644.tmp 4784 700.tmp 2676 7BB.tmp 4688 848.tmp 8 8F4.tmp 3856 990.tmp 3436 A4C.tmp 3360 B26.tmp 5428 BC3.tmp 888 C6F.tmp 6120 D0B.tmp 4664 DE6.tmp 5780 E43.tmp 2352 EB1.tmp 4804 EFF.tmp 5596 F6C.tmp 1620 FBA.tmp 5224 1008.tmp 5808 1057.tmp 5008 10C4.tmp 5564 1131.tmp 4780 119F.tmp 2864 120C.tmp 5752 1279.tmp 5828 12E7.tmp 1980 1373.tmp 468 13D1.tmp 544 141F.tmp 2716 146D.tmp 208 14DB.tmp 920 1529.tmp 5248 1577.tmp 2108 15F4.tmp 3536 1681.tmp 5316 16CF.tmp 1036 172D.tmp 3988 177B.tmp 2652 17D8.tmp 2012 1827.tmp 3824 1894.tmp 2564 18F2.tmp 3216 196F.tmp 4164 19BD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7318.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 823B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 916D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1822.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2093.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 3936 2428 2026-04-19_0cd0a5f0aae68030ebc1c05223046805_elex_mafia.exe 86 PID 3936 wrote to memory of 4328 3936 F81B.tmp 87 PID 4328 wrote to memory of 5852 4328 F8F6.tmp 88 PID 5852 wrote to memory of 4316 5852 F992.tmp 89 PID 4316 wrote to memory of 3752 4316 FA9C.tmp 90 PID 3752 wrote to memory of 5916 3752 FB48.tmp 91 PID 5916 wrote to memory of 5888 5916 FC03.tmp 92 PID 5888 wrote to memory of 3144 5888 FCA0.tmp 93 PID 3144 wrote to memory of 3692 3144 FD6B.tmp 94 PID 3692 wrote to memory of 5696 3692 FDF7.tmp 95 PID 5696 wrote to memory of 6076 5696 FE94.tmp 96 PID 6076 wrote to memory of 5848 6076 FF11.tmp 97 PID 5848 wrote to memory of 1220 5848 FFFB.tmp 98 PID 1220 wrote to memory of 1676 1220 A7.tmp 99 PID 1676 wrote to memory of 3408 1676 153.tmp 100 PID 3408 wrote to memory of 2040 3408 1FF.tmp 101 PID 2040 wrote to memory of 4508 2040 27C.tmp 102 PID 4508 wrote to memory of 4940 4508 337.tmp 103 PID 4940 wrote to memory of 4972 4940 3E3.tmp 104 PID 4972 wrote to memory of 3640 4972 470.tmp 105 PID 3640 wrote to memory of 2600 3640 51C.tmp 106 PID 2600 wrote to memory of 5740 2600 5C7.tmp 107 PID 5740 wrote to memory of 4784 5740 644.tmp 108 PID 4784 wrote to memory of 2676 4784 700.tmp 109 PID 2676 wrote to memory of 4688 2676 7BB.tmp 110 PID 4688 wrote to memory of 8 4688 848.tmp 111 PID 8 wrote to memory of 3856 8 8F4.tmp 112 PID 3856 wrote to memory of 3436 3856 990.tmp 113 PID 3436 wrote to memory of 3360 3436 A4C.tmp 114 PID 3360 wrote to memory of 5428 3360 B26.tmp 115 PID 5428 wrote to memory of 888 5428 BC3.tmp 116 PID 888 wrote to memory of 6120 888 C6F.tmp 117 PID 6120 wrote to memory of 4664 6120 D0B.tmp 118 PID 4664 wrote to memory of 5780 4664 DE6.tmp 119 PID 5780 wrote to memory of 2352 5780 E43.tmp 120 PID 2352 wrote to memory of 4804 2352 EB1.tmp 121 PID 4804 wrote to memory of 5596 4804 EFF.tmp 122 PID 5596 wrote to memory of 1620 5596 F6C.tmp 123 PID 1620 wrote to memory of 5224 1620 FBA.tmp 124 PID 5224 wrote to memory of 5808 5224 1008.tmp 125 PID 5808 wrote to memory of 5008 5808 1057.tmp 126 PID 5008 wrote to memory of 5564 5008 10C4.tmp 127 PID 5564 wrote to memory of 4780 5564 1131.tmp 128 PID 4780 wrote to memory of 2864 4780 119F.tmp 129 PID 2864 wrote to memory of 5752 2864 120C.tmp 130 PID 5752 wrote to memory of 5828 5752 1279.tmp 131 PID 5828 wrote to memory of 1980 5828 12E7.tmp 132 PID 1980 wrote to memory of 468 1980 1373.tmp 133 PID 468 wrote to memory of 544 468 13D1.tmp 134 PID 544 wrote to memory of 2716 544 141F.tmp 135 PID 2716 wrote to memory of 208 2716 146D.tmp 136 PID 208 wrote to memory of 920 208 14DB.tmp 137 PID 920 wrote to memory of 5248 920 1529.tmp 138 PID 5248 wrote to memory of 2108 5248 1577.tmp 139 PID 2108 wrote to memory of 3536 2108 15F4.tmp 140 PID 3536 wrote to memory of 5316 3536 1681.tmp 141 PID 5316 wrote to memory of 1036 5316 16CF.tmp 142 PID 1036 wrote to memory of 3988 1036 172D.tmp 143 PID 3988 wrote to memory of 2652 3988 177B.tmp 144 PID 2652 wrote to memory of 2012 2652 17D8.tmp 145 PID 2012 wrote to memory of 3824 2012 1827.tmp 146 PID 3824 wrote to memory of 2564 3824 1894.tmp 147 PID 2564 wrote to memory of 3216 2564 18F2.tmp 148 PID 3216 wrote to memory of 4164 3216 196F.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_0cd0a5f0aae68030ebc1c05223046805_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_0cd0a5f0aae68030ebc1c05223046805_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"65⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"66⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"67⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"68⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"69⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"70⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"72⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"73⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"74⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"75⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"76⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"78⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"80⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"81⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"82⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"83⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"85⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"86⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"87⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"88⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"89⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"90⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"91⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"92⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"93⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"94⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"95⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"96⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"97⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"98⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"99⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"100⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"101⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"102⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"103⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"104⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"105⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"106⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"107⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"108⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"109⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"110⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"111⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"112⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"113⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"114⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"115⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"116⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"117⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"118⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"119⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"120⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"121⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"122⤵PID:2444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-