Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 19:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_1c67e333f9b0fcd9b337a2fdd8a5d8b3_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_1c67e333f9b0fcd9b337a2fdd8a5d8b3_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-31_1c67e333f9b0fcd9b337a2fdd8a5d8b3_elex_mafia.exe
- Size 560KB
- Sample260731-xrt3caer2w
- SHA256 cf937c6b31f829eb36beefc2c76f7920cc2f961be32123776c4eecec45816c65
- MD5 1c67e333f9b0fcd9b337a2fdd8a5d8b3
- SHA1 69dee2a7461f53346531a9f3b29866a601de6172
- SHA512 7d87fcd06adb45c9a5768bdcb5fa642be27864b1892c31b5f779b23f3c00cbcae13620d863ed9a18a1e2855f557c00b18460e01fa2a704bf3a8089eec93c0c15
- SSDEEP 6144:HDPzZ/HsLAsNjGShB/ySLa6FVM/n2Li0LtkXxJDqwPuOJovc7+QelK7OUdT7bisi:vQZzqSLa6Faj0LoxNPuYGxSO0TTNZu
- TLSH T101C4F125B284C132EDD202355B12DFA2593A7D318B2AA4C73BE4626F6FB52D1D379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 776 F5D.tmp 4712 1008.tmp 4276 1095.tmp 4820 1141.tmp 3952 120C.tmp 2436 12C8.tmp 4100 1345.tmp 3512 1410.tmp 4224 14DB.tmp 4876 1596.tmp 640 1623.tmp 3908 16DE.tmp 4040 177B.tmp 3976 1817.tmp 4080 18C3.tmp 5032 197E.tmp 2668 1A3A.tmp 1784 1AF5.tmp 2508 1BA1.tmp 3272 1C0F.tmp 2940 1C8C.tmp 844 1D09.tmp 64 1DC4.tmp 2252 1E80.tmp 2784 1EFD.tmp 4220 1FA8.tmp 3708 2016.tmp 1452 2083.tmp 904 211F.tmp 544 21BC.tmp 4304 2277.tmp 2500 22E5.tmp 224 2371.tmp 3120 23CF.tmp 2664 241D.tmp 4996 246B.tmp 4596 24B9.tmp 3212 2507.tmp 1744 2565.tmp 3892 25B3.tmp 928 2611.tmp 1424 265F.tmp 1628 26AD.tmp 4976 270B.tmp 404 2759.tmp 1644 27B7.tmp 364 2805.tmp 2016 2853.tmp 2068 28A1.tmp 2204 28EF.tmp 4120 293E.tmp 1160 299B.tmp 1276 29E9.tmp 3784 2A57.tmp 3180 2AB5.tmp 792 2B03.tmp 4980 2B60.tmp 3604 2BAF.tmp 3884 2C0C.tmp 1080 2C5A.tmp 4812 2CC8.tmp 1244 2D26.tmp 1184 2D74.tmp 3716 2DC2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1321.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 390C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 405B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 727C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3544.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 586C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 623F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 678F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC17.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 776 2520 2026-07-31_1c67e333f9b0fcd9b337a2fdd8a5d8b3_elex_mafia.exe 85 PID 776 wrote to memory of 4712 776 F5D.tmp 86 PID 4712 wrote to memory of 4276 4712 1008.tmp 87 PID 4276 wrote to memory of 4820 4276 1095.tmp 88 PID 4820 wrote to memory of 3952 4820 1141.tmp 89 PID 3952 wrote to memory of 2436 3952 120C.tmp 90 PID 2436 wrote to memory of 4100 2436 12C8.tmp 91 PID 4100 wrote to memory of 3512 4100 1345.tmp 92 PID 3512 wrote to memory of 4224 3512 1410.tmp 93 PID 4224 wrote to memory of 4876 4224 14DB.tmp 94 PID 4876 wrote to memory of 640 4876 1596.tmp 95 PID 640 wrote to memory of 3908 640 1623.tmp 96 PID 3908 wrote to memory of 4040 3908 16DE.tmp 97 PID 4040 wrote to memory of 3976 4040 177B.tmp 98 PID 3976 wrote to memory of 4080 3976 1817.tmp 99 PID 4080 wrote to memory of 5032 4080 18C3.tmp 100 PID 5032 wrote to memory of 2668 5032 197E.tmp 101 PID 2668 wrote to memory of 1784 2668 1A3A.tmp 102 PID 1784 wrote to memory of 2508 1784 1AF5.tmp 103 PID 2508 wrote to memory of 3272 2508 1BA1.tmp 104 PID 3272 wrote to memory of 2940 3272 1C0F.tmp 105 PID 2940 wrote to memory of 844 2940 1C8C.tmp 106 PID 844 wrote to memory of 64 844 1D09.tmp 107 PID 64 wrote to memory of 2252 64 1DC4.tmp 108 PID 2252 wrote to memory of 2784 2252 1E80.tmp 109 PID 2784 wrote to memory of 4220 2784 1EFD.tmp 110 PID 4220 wrote to memory of 3708 4220 1FA8.tmp 111 PID 3708 wrote to memory of 1452 3708 2016.tmp 112 PID 1452 wrote to memory of 904 1452 2083.tmp 113 PID 904 wrote to memory of 544 904 211F.tmp 114 PID 544 wrote to memory of 4304 544 21BC.tmp 115 PID 4304 wrote to memory of 2500 4304 2277.tmp 116 PID 2500 wrote to memory of 224 2500 22E5.tmp 117 PID 224 wrote to memory of 3120 224 2371.tmp 118 PID 3120 wrote to memory of 2664 3120 23CF.tmp 119 PID 2664 wrote to memory of 4996 2664 241D.tmp 120 PID 4996 wrote to memory of 4596 4996 246B.tmp 121 PID 4596 wrote to memory of 3212 4596 24B9.tmp 122 PID 3212 wrote to memory of 1744 3212 2507.tmp 123 PID 1744 wrote to memory of 3892 1744 2565.tmp 124 PID 3892 wrote to memory of 928 3892 25B3.tmp 125 PID 928 wrote to memory of 1424 928 2611.tmp 126 PID 1424 wrote to memory of 1628 1424 265F.tmp 127 PID 1628 wrote to memory of 4976 1628 26AD.tmp 128 PID 4976 wrote to memory of 404 4976 270B.tmp 129 PID 404 wrote to memory of 1644 404 2759.tmp 130 PID 1644 wrote to memory of 364 1644 27B7.tmp 131 PID 364 wrote to memory of 2016 364 2805.tmp 132 PID 2016 wrote to memory of 2068 2016 2853.tmp 133 PID 2068 wrote to memory of 2204 2068 28A1.tmp 134 PID 2204 wrote to memory of 4120 2204 28EF.tmp 135 PID 4120 wrote to memory of 1160 4120 293E.tmp 136 PID 1160 wrote to memory of 1276 1160 299B.tmp 137 PID 1276 wrote to memory of 3784 1276 29E9.tmp 138 PID 3784 wrote to memory of 3180 3784 2A57.tmp 139 PID 3180 wrote to memory of 792 3180 2AB5.tmp 140 PID 792 wrote to memory of 4980 792 2B03.tmp 141 PID 4980 wrote to memory of 3604 4980 2B60.tmp 142 PID 3604 wrote to memory of 3884 3604 2BAF.tmp 143 PID 3884 wrote to memory of 1080 3884 2C0C.tmp 144 PID 1080 wrote to memory of 4812 1080 2C5A.tmp 145 PID 4812 wrote to memory of 1244 4812 2CC8.tmp 146 PID 1244 wrote to memory of 1184 1244 2D26.tmp 147 PID 1184 wrote to memory of 3716 1184 2D74.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_1c67e333f9b0fcd9b337a2fdd8a5d8b3_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_1c67e333f9b0fcd9b337a2fdd8a5d8b3_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"66⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"68⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"69⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"70⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"71⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"72⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"73⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"74⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"75⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"76⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\31D9.tmp"C:\Users\Admin\AppData\Local\Temp\31D9.tmp"77⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"78⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"79⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"80⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"81⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"82⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"83⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"84⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"85⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"87⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"88⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"89⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"90⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\36DA.tmp"C:\Users\Admin\AppData\Local\Temp\36DA.tmp"91⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"92⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"93⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"94⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"95⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"96⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"97⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"99⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"100⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"101⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"102⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:220 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"104⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"105⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"106⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"107⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"108⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"109⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"110⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"111⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"112⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"113⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"114⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"115⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"116⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"117⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"118⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"119⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"120⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"121⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"122⤵PID:4036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-