Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe
- Size 520KB
- Sample261002-efhaassemb
- SHA256 766c2ae35d3a6aa5f4591943509dfd65c97c2bb7630d194c358e952d31ebfae2
- MD5 c0d894323d484f00f71f51f9cdbc9962
- SHA1 dcd6ddb5839b7b0e0076e671f5d2657412fa97dc
- SHA512 059eb4c6eb29afec90d105c00a38d41a2589c063553152266db61c25adfcc037ad9ba5ef3da85fe6b751ea835b0cbdacd1116ad77b11183aba7df654d8842283
- SSDEEP 12288:roRXOQjmOy2PG/xwKwzgw2TkO+gjE3p2umRBhUoWNZ:rogQ9yBCJzjtObE3pqR7vWN
- TLSH T1F4B4F1227488C032E69216344B25DFA15B3E7D76576A52C73B843A3D7EB02D2E778387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3488 D9F0.tmp 4744 DA8C.tmp 4892 DB19.tmp 1012 DBC5.tmp 5024 DC71.tmp 4256 DD2C.tmp 4160 DDC8.tmp 2068 DE65.tmp 3476 DF30.tmp 4192 DFAD.tmp 1876 E02A.tmp 1956 E114.tmp 2488 E1A1.tmp 2008 E21E.tmp 2036 E2AA.tmp 888 E356.tmp 744 E3F2.tmp 908 E47F.tmp 4004 E53B.tmp 1240 E5B8.tmp 3984 E663.tmp 3212 E6C1.tmp 3052 E75D.tmp 2700 E7DA.tmp 2796 E867.tmp 4424 E8E4.tmp 1672 E971.tmp 780 EA1D.tmp 3348 EA9A.tmp 804 EB36.tmp 1732 EBB3.tmp 3604 EC20.tmp 2344 ECAD.tmp 4900 ED0B.tmp 1628 ED68.tmp 1036 EDB6.tmp 3688 EE05.tmp 548 EED0.tmp 1880 EF4D.tmp 1556 EFAA.tmp 1696 F008.tmp 968 F076.tmp 3868 F0D3.tmp 3496 F131.tmp 4084 F17F.tmp 4616 F1DD.tmp 3384 F23B.tmp 408 F298.tmp 1084 F2E7.tmp 2316 F335.tmp 4448 F383.tmp 1652 F3E1.tmp 1296 F42F.tmp 2360 F47D.tmp 3000 F4CB.tmp 3352 F529.tmp 4416 F577.tmp 4776 F5C5.tmp 1740 F623.tmp 3800 F671.tmp 1692 F6BF.tmp 3556 F70D.tmp 2340 F77A.tmp 1208 F7C9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 838E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 959F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 3488 3164 2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe 85 PID 3488 wrote to memory of 4744 3488 D9F0.tmp 88 PID 4744 wrote to memory of 4892 4744 DA8C.tmp 90 PID 4892 wrote to memory of 1012 4892 DB19.tmp 91 PID 1012 wrote to memory of 5024 1012 DBC5.tmp 92 PID 5024 wrote to memory of 4256 5024 DC71.tmp 93 PID 4256 wrote to memory of 4160 4256 DD2C.tmp 94 PID 4160 wrote to memory of 2068 4160 DDC8.tmp 95 PID 2068 wrote to memory of 3476 2068 DE65.tmp 96 PID 3476 wrote to memory of 4192 3476 DF30.tmp 97 PID 4192 wrote to memory of 1876 4192 DFAD.tmp 98 PID 1876 wrote to memory of 1956 1876 E02A.tmp 99 PID 1956 wrote to memory of 2488 1956 E114.tmp 100 PID 2488 wrote to memory of 2008 2488 E1A1.tmp 101 PID 2008 wrote to memory of 2036 2008 E21E.tmp 102 PID 2036 wrote to memory of 888 2036 E2AA.tmp 103 PID 888 wrote to memory of 744 888 E356.tmp 104 PID 744 wrote to memory of 908 744 E3F2.tmp 106 PID 908 wrote to memory of 4004 908 E47F.tmp 109 PID 4004 wrote to memory of 1240 4004 E53B.tmp 110 PID 1240 wrote to memory of 3984 1240 E5B8.tmp 111 PID 3984 wrote to memory of 3212 3984 E663.tmp 112 PID 3212 wrote to memory of 3052 3212 E6C1.tmp 113 PID 3052 wrote to memory of 2700 3052 E75D.tmp 114 PID 2700 wrote to memory of 2796 2700 E7DA.tmp 115 PID 2796 wrote to memory of 4424 2796 E867.tmp 116 PID 4424 wrote to memory of 1672 4424 E8E4.tmp 118 PID 1672 wrote to memory of 780 1672 E971.tmp 119 PID 780 wrote to memory of 3348 780 EA1D.tmp 121 PID 3348 wrote to memory of 804 3348 EA9A.tmp 122 PID 804 wrote to memory of 1732 804 EB36.tmp 123 PID 1732 wrote to memory of 3604 1732 EBB3.tmp 124 PID 3604 wrote to memory of 2344 3604 EC20.tmp 125 PID 2344 wrote to memory of 4900 2344 ECAD.tmp 126 PID 4900 wrote to memory of 1628 4900 ED0B.tmp 127 PID 1628 wrote to memory of 1036 1628 ED68.tmp 128 PID 1036 wrote to memory of 3688 1036 EDB6.tmp 129 PID 4144 wrote to memory of 548 4144 EE62.tmp 131 PID 548 wrote to memory of 1880 548 EED0.tmp 132 PID 1880 wrote to memory of 1556 1880 EF4D.tmp 133 PID 1556 wrote to memory of 1696 1556 EFAA.tmp 134 PID 1696 wrote to memory of 968 1696 F008.tmp 135 PID 968 wrote to memory of 3868 968 F076.tmp 136 PID 3868 wrote to memory of 3496 3868 F0D3.tmp 137 PID 3496 wrote to memory of 4084 3496 F131.tmp 138 PID 4084 wrote to memory of 4616 4084 F17F.tmp 139 PID 4616 wrote to memory of 3384 4616 F1DD.tmp 140 PID 3384 wrote to memory of 408 3384 F23B.tmp 141 PID 408 wrote to memory of 1084 408 F298.tmp 142 PID 1084 wrote to memory of 2316 1084 F2E7.tmp 143 PID 2316 wrote to memory of 4448 2316 F335.tmp 144 PID 4448 wrote to memory of 1652 4448 F383.tmp 145 PID 1652 wrote to memory of 1296 1652 F3E1.tmp 146 PID 1296 wrote to memory of 2360 1296 F42F.tmp 147 PID 2360 wrote to memory of 3000 2360 F47D.tmp 148 PID 3000 wrote to memory of 3352 3000 F4CB.tmp 150 PID 3352 wrote to memory of 4416 3352 F529.tmp 151 PID 4416 wrote to memory of 4776 4416 F577.tmp 152 PID 4776 wrote to memory of 1740 4776 F5C5.tmp 153 PID 1740 wrote to memory of 3800 1740 F623.tmp 154 PID 3800 wrote to memory of 1692 3800 F671.tmp 155 PID 1692 wrote to memory of 3556 1692 F6BF.tmp 156 PID 3556 wrote to memory of 2340 3556 F70D.tmp 157 PID 2340 wrote to memory of 1208 2340 F77A.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c0d894323d484f00f71f51f9cdbc9962_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\DE65.tmp"C:\Users\Admin\AppData\Local\Temp\DE65.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\E21E.tmp"C:\Users\Admin\AppData\Local\Temp\E21E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"C:\Users\Admin\AppData\Local\Temp\E3F2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\E867.tmp"C:\Users\Admin\AppData\Local\Temp\E867.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E8E4.tmp"C:\Users\Admin\AppData\Local\Temp\E8E4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\E971.tmp"C:\Users\Admin\AppData\Local\Temp\E971.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\EB36.tmp"C:\Users\Admin\AppData\Local\Temp\EB36.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\EC20.tmp"C:\Users\Admin\AppData\Local\Temp\EC20.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\ED0B.tmp"C:\Users\Admin\AppData\Local\Temp\ED0B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\EE05.tmp"C:\Users\Admin\AppData\Local\Temp\EE05.tmp"38⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\EE62.tmp"C:\Users\Admin\AppData\Local\Temp\EE62.tmp"39⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\EFAA.tmp"C:\Users\Admin\AppData\Local\Temp\EFAA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\F0D3.tmp"C:\Users\Admin\AppData\Local\Temp\F0D3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\F131.tmp"C:\Users\Admin\AppData\Local\Temp\F131.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\F17F.tmp"C:\Users\Admin\AppData\Local\Temp\F17F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\F42F.tmp"C:\Users\Admin\AppData\Local\Temp\F42F.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\F47D.tmp"C:\Users\Admin\AppData\Local\Temp\F47D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\F529.tmp"C:\Users\Admin\AppData\Local\Temp\F529.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\F577.tmp"C:\Users\Admin\AppData\Local\Temp\F577.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\F623.tmp"C:\Users\Admin\AppData\Local\Temp\F623.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F70D.tmp"C:\Users\Admin\AppData\Local\Temp\F70D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"66⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\F817.tmp"C:\Users\Admin\AppData\Local\Temp\F817.tmp"67⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"68⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"69⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\F930.tmp"C:\Users\Admin\AppData\Local\Temp\F930.tmp"70⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\F97E.tmp"C:\Users\Admin\AppData\Local\Temp\F97E.tmp"71⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"72⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\FA2A.tmp"C:\Users\Admin\AppData\Local\Temp\FA2A.tmp"73⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"74⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"75⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"76⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\FB62.tmp"C:\Users\Admin\AppData\Local\Temp\FB62.tmp"77⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"78⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"79⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"80⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\FCCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCCA.tmp"81⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\FD18.tmp"C:\Users\Admin\AppData\Local\Temp\FD18.tmp"82⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"83⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"84⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"85⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\FE60.tmp"C:\Users\Admin\AppData\Local\Temp\FE60.tmp"86⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"87⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"88⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"89⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"90⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\44.tmp"C:\Users\Admin\AppData\Local\Temp\44.tmp"91⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"92⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\100.tmp"C:\Users\Admin\AppData\Local\Temp\100.tmp"93⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"94⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"95⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\1EA.tmp"C:\Users\Admin\AppData\Local\Temp\1EA.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"97⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"98⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"99⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"100⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3A0.tmp"C:\Users\Admin\AppData\Local\Temp\3A0.tmp"101⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\3EE.tmp"C:\Users\Admin\AppData\Local\Temp\3EE.tmp"102⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"103⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"104⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"105⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"106⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"107⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"108⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\611.tmp"C:\Users\Admin\AppData\Local\Temp\611.tmp"109⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"110⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"111⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\6FB.tmp"C:\Users\Admin\AppData\Local\Temp\6FB.tmp"112⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"113⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"114⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"116⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"117⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"118⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"119⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\99B.tmp"C:\Users\Admin\AppData\Local\Temp\99B.tmp"120⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"121⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"122⤵PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-