Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 07:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_b0d06108c2e9a9459a8af35a9fa4c922_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_b0d06108c2e9a9459a8af35a9fa4c922_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_b0d06108c2e9a9459a8af35a9fa4c922_elex_mafia.exe
- Size 524KB
- Sample261001-jp3d2sweja
- SHA256 ed20f5fda0f86a3fb9f78ce7e83cfb07b1fdda22cf16aa9a06a54a7d0898e9b0
- MD5 b0d06108c2e9a9459a8af35a9fa4c922
- SHA1 60986a9a94253327ddeffa8d87e9d7e32256e097
- SHA512 863d6b12520e65eadcf47b06927490207ac880cc4a7040d34c989d1a36e4fd46439bfe3287bef364214f7c244289e30a391b565a2c65a3d36f17067e43e8b415
- SSDEEP 12288:TRyZzqyL66TVt3XeRaCyL39xTDVVUlYFSw0dAXNZ:TRyQylT3ZFrVkJkN
- TLSH T183B4E115B984C032F69205318B2ADBA2493B7C769B3799C73BD4366D2EF12D1E2B4317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4400 ED39.tmp 3836 EE62.tmp 3860 EF9B.tmp 1928 F0A4.tmp 3672 F1CD.tmp 1824 F2F6.tmp 4412 F41F.tmp 1964 F548.tmp 3004 F671.tmp 2172 F77A.tmp 3996 F894.tmp 1832 F9BD.tmp 4276 FAD6.tmp 4760 FBFF.tmp 4388 FD08.tmp 3888 FDC4.tmp 3496 FECD.tmp 1764 FFE7.tmp 4660 100.tmp 3284 1CB.tmp 4104 2F4.tmp 3100 3CF.tmp 3196 4D8.tmp 4676 5D2.tmp 3956 68E.tmp 4028 778.tmp 1820 853.tmp 2576 97C.tmp 2140 A85.tmp 2520 B60.tmp 1880 C2B.tmp 828 D25.tmp 4356 DF0.tmp 4776 EAC.tmp 752 F48.tmp 4484 1004.tmp 3048 10CF.tmp 4728 11AA.tmp 3032 1255.tmp 3276 12D2.tmp 3732 136F.tmp 3976 142A.tmp 3148 1524.tmp 2888 15D0.tmp 468 16AB.tmp 5016 1757.tmp 4992 17F3.tmp 3336 1880.tmp 3464 190C.tmp 3948 195A.tmp 4556 19B8.tmp 3140 1A06.tmp 4308 1A54.tmp 1608 1AA2.tmp 3368 1AF1.tmp 1136 1B3F.tmp 1084 1B9C.tmp 1212 1BEB.tmp 3704 1C48.tmp 1636 1CA6.tmp 516 1D23.tmp 452 1D90.tmp 1876 1DDF.tmp 632 1E5C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 931E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 516D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 4400 1284 2026-09-30_b0d06108c2e9a9459a8af35a9fa4c922_elex_mafia.exe 86 PID 4400 wrote to memory of 3836 4400 ED39.tmp 88 PID 3836 wrote to memory of 3860 3836 EE62.tmp 90 PID 3860 wrote to memory of 1928 3860 EF9B.tmp 91 PID 1928 wrote to memory of 3672 1928 F0A4.tmp 93 PID 3672 wrote to memory of 1824 3672 F1CD.tmp 94 PID 1824 wrote to memory of 4412 1824 F2F6.tmp 95 PID 4412 wrote to memory of 1964 4412 F41F.tmp 96 PID 1964 wrote to memory of 3004 1964 F548.tmp 97 PID 3004 wrote to memory of 2172 3004 F671.tmp 98 PID 2172 wrote to memory of 3996 2172 F77A.tmp 99 PID 3996 wrote to memory of 1832 3996 F894.tmp 100 PID 1832 wrote to memory of 4276 1832 F9BD.tmp 101 PID 4276 wrote to memory of 4760 4276 FAD6.tmp 104 PID 4760 wrote to memory of 4388 4760 FBFF.tmp 105 PID 4388 wrote to memory of 3888 4388 FD08.tmp 106 PID 3888 wrote to memory of 3496 3888 FDC4.tmp 107 PID 3496 wrote to memory of 1764 3496 FECD.tmp 108 PID 1764 wrote to memory of 4660 1764 FFE7.tmp 110 PID 4660 wrote to memory of 3284 4660 100.tmp 111 PID 3284 wrote to memory of 4104 3284 1CB.tmp 113 PID 4104 wrote to memory of 3100 4104 2F4.tmp 114 PID 3100 wrote to memory of 3196 3100 3CF.tmp 115 PID 3196 wrote to memory of 4676 3196 4D8.tmp 116 PID 4676 wrote to memory of 3956 4676 5D2.tmp 117 PID 3956 wrote to memory of 4028 3956 68E.tmp 118 PID 4028 wrote to memory of 1820 4028 778.tmp 119 PID 1820 wrote to memory of 2576 1820 853.tmp 120 PID 2576 wrote to memory of 2140 2576 97C.tmp 121 PID 2140 wrote to memory of 2520 2140 A85.tmp 122 PID 2520 wrote to memory of 1880 2520 B60.tmp 123 PID 1880 wrote to memory of 828 1880 C2B.tmp 125 PID 828 wrote to memory of 4356 828 D25.tmp 126 PID 4356 wrote to memory of 4776 4356 DF0.tmp 127 PID 4776 wrote to memory of 752 4776 EAC.tmp 128 PID 752 wrote to memory of 4484 752 F48.tmp 129 PID 4484 wrote to memory of 3048 4484 1004.tmp 130 PID 3048 wrote to memory of 4728 3048 10CF.tmp 131 PID 4728 wrote to memory of 3032 4728 11AA.tmp 132 PID 3032 wrote to memory of 3276 3032 1255.tmp 133 PID 3276 wrote to memory of 3732 3276 12D2.tmp 134 PID 3732 wrote to memory of 3976 3732 136F.tmp 135 PID 3976 wrote to memory of 3148 3976 142A.tmp 136 PID 3148 wrote to memory of 2888 3148 1524.tmp 137 PID 2888 wrote to memory of 468 2888 15D0.tmp 138 PID 468 wrote to memory of 5016 468 16AB.tmp 139 PID 5016 wrote to memory of 4992 5016 1757.tmp 140 PID 4992 wrote to memory of 3336 4992 17F3.tmp 141 PID 3336 wrote to memory of 3464 3336 1880.tmp 143 PID 3464 wrote to memory of 3948 3464 190C.tmp 145 PID 3948 wrote to memory of 4556 3948 195A.tmp 146 PID 4556 wrote to memory of 3140 4556 19B8.tmp 147 PID 3140 wrote to memory of 4308 3140 1A06.tmp 148 PID 4308 wrote to memory of 1608 4308 1A54.tmp 149 PID 1608 wrote to memory of 3368 1608 1AA2.tmp 150 PID 3368 wrote to memory of 1136 3368 1AF1.tmp 151 PID 1136 wrote to memory of 1084 1136 1B3F.tmp 152 PID 1084 wrote to memory of 1212 1084 1B9C.tmp 153 PID 1212 wrote to memory of 3704 1212 1BEB.tmp 154 PID 3704 wrote to memory of 1636 3704 1C48.tmp 155 PID 1636 wrote to memory of 516 1636 1CA6.tmp 156 PID 516 wrote to memory of 452 516 1D23.tmp 157 PID 452 wrote to memory of 1876 452 1D90.tmp 158 PID 1876 wrote to memory of 632 1876 1DDF.tmp 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_b0d06108c2e9a9459a8af35a9fa4c922_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b0d06108c2e9a9459a8af35a9fa4c922_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\ED39.tmp"C:\Users\Admin\AppData\Local\Temp\ED39.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\EE62.tmp"C:\Users\Admin\AppData\Local\Temp\EE62.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\F548.tmp"C:\Users\Admin\AppData\Local\Temp\F548.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\F894.tmp"C:\Users\Admin\AppData\Local\Temp\F894.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"C:\Users\Admin\AppData\Local\Temp\FAD6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\100.tmp"C:\Users\Admin\AppData\Local\Temp\100.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\1CB.tmp"C:\Users\Admin\AppData\Local\Temp\1CB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\2F4.tmp"C:\Users\Admin\AppData\Local\Temp\2F4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\3CF.tmp"C:\Users\Admin\AppData\Local\Temp\3CF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\778.tmp"C:\Users\Admin\AppData\Local\Temp\778.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\97C.tmp"C:\Users\Admin\AppData\Local\Temp\97C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B60.tmp"C:\Users\Admin\AppData\Local\Temp\B60.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\DF0.tmp"C:\Users\Admin\AppData\Local\Temp\DF0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\F48.tmp"C:\Users\Admin\AppData\Local\Temp\F48.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\10CF.tmp"C:\Users\Admin\AppData\Local\Temp\10CF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\12D2.tmp"C:\Users\Admin\AppData\Local\Temp\12D2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\136F.tmp"C:\Users\Admin\AppData\Local\Temp\136F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\142A.tmp"C:\Users\Admin\AppData\Local\Temp\142A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\15D0.tmp"C:\Users\Admin\AppData\Local\Temp\15D0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"65⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"66⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"67⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"68⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"69⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"70⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"71⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\213A.tmp"C:\Users\Admin\AppData\Local\Temp\213A.tmp"73⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\2198.tmp"C:\Users\Admin\AppData\Local\Temp\2198.tmp"74⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"75⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2282.tmp"C:\Users\Admin\AppData\Local\Temp\2282.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\22E0.tmp"C:\Users\Admin\AppData\Local\Temp\22E0.tmp"77⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\232E.tmp"C:\Users\Admin\AppData\Local\Temp\232E.tmp"78⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"79⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"80⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"81⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"82⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"83⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"84⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"85⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"86⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\261C.tmp"C:\Users\Admin\AppData\Local\Temp\261C.tmp"87⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"88⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"91⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\27E1.tmp"C:\Users\Admin\AppData\Local\Temp\27E1.tmp"92⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"94⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"95⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"96⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"97⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"98⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"99⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"100⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"101⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"102⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"103⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"104⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2D50.tmp"C:\Users\Admin\AppData\Local\Temp\2D50.tmp"105⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"106⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"107⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"108⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"C:\Users\Admin\AppData\Local\Temp\2ED6.tmp"109⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2F44.tmp"C:\Users\Admin\AppData\Local\Temp\2F44.tmp"110⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"111⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"112⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\307C.tmp"C:\Users\Admin\AppData\Local\Temp\307C.tmp"113⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\30CA.tmp"C:\Users\Admin\AppData\Local\Temp\30CA.tmp"114⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"115⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"116⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\31F3.tmp"C:\Users\Admin\AppData\Local\Temp\31F3.tmp"117⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3280.tmp"C:\Users\Admin\AppData\Local\Temp\3280.tmp"118⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"119⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"120⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"121⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"122⤵PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-