Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-14_82e5944ecc58551ec853b4574eac3a58_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_82e5944ecc58551ec853b4574eac3a58_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-14_82e5944ecc58551ec853b4574eac3a58_elex_mafia.exe
- Size 524KB
- Sample261014-wedddsfx7n
- SHA256 136c317958c9c22f7d7886523627f5f3daf3fb396d5956b4059f7452721523e9
- MD5 82e5944ecc58551ec853b4574eac3a58
- SHA1 6c84cddf727a6e319a0e73a993a364cf5a457de6
- SHA512 a7629f853aab1cedb8e71b216d1812c2ab918e428859aa6ecb456760fe9de2c27dcb18c28abaa9758b2563aec3476767707155206906f3c949465fb26df8912a
- SSDEEP 12288:TRyZzqyL66ToKksmIk0i4Ssj/OrwtCMNZ:TRyQylTP+0p/WwpN
- TLSH T119B4F115B544C432F69201754E22EBA6497ABD76AB26A4CB3BC4322E2FF13D1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3912 1860.tmp 900 197A.tmp 3532 1A54.tmp 2792 1B6E.tmp 2212 1C58.tmp 1404 1D13.tmp 2480 1DBF.tmp 2364 1EC9.tmp 2316 1FF2.tmp 4620 20BD.tmp 212 21A7.tmp 1072 2253.tmp 3096 232E.tmp 4372 23E9.tmp 4824 24C4.tmp 3336 259F.tmp 2076 2689.tmp 3364 2735.tmp 4796 27F1.tmp 1420 28AC.tmp 3460 2977.tmp 2200 2A81.tmp 3024 2B9A.tmp 2428 2C75.tmp 2872 2D30.tmp 3180 2E1B.tmp 2268 2EE6.tmp 3300 2FC1.tmp 3352 30AB.tmp 1136 3157.tmp 2696 3241.tmp 1988 332C.tmp 3780 33F7.tmp 4200 3493.tmp 3116 3520.tmp 4640 35AC.tmp 4020 3639.tmp 1180 36C6.tmp 1652 3743.tmp 3264 37CF.tmp 1936 386B.tmp 5048 38E8.tmp 1836 3985.tmp 3544 3A21.tmp 924 3ABD.tmp 4364 3B3A.tmp 2524 3BB7.tmp 3360 3C34.tmp 460 3CA2.tmp 3904 3D0F.tmp 4228 3D5D.tmp 2784 3DAB.tmp 2464 3DF9.tmp 3280 3E47.tmp 1920 3E96.tmp 4764 3EF3.tmp 4924 3F51.tmp 2472 3F9F.tmp 1900 3FED.tmp 2324 403B.tmp 3272 408A.tmp 2740 40E7.tmp 2168 4145.tmp 2848 4193.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 786D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 838E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D78A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4368.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3912 2124 2026-10-14_82e5944ecc58551ec853b4574eac3a58_elex_mafia.exe 86 PID 3912 wrote to memory of 900 3912 1860.tmp 88 PID 900 wrote to memory of 3532 900 197A.tmp 91 PID 3532 wrote to memory of 2792 3532 1A54.tmp 92 PID 2792 wrote to memory of 2212 2792 1B6E.tmp 93 PID 2212 wrote to memory of 1404 2212 1C58.tmp 94 PID 1404 wrote to memory of 2480 1404 1D13.tmp 95 PID 2480 wrote to memory of 2364 2480 1DBF.tmp 96 PID 2364 wrote to memory of 2316 2364 1EC9.tmp 97 PID 2316 wrote to memory of 4620 2316 1FF2.tmp 98 PID 4620 wrote to memory of 212 4620 20BD.tmp 99 PID 212 wrote to memory of 1072 212 21A7.tmp 102 PID 1072 wrote to memory of 3096 1072 2253.tmp 103 PID 3096 wrote to memory of 4372 3096 232E.tmp 104 PID 4372 wrote to memory of 4824 4372 23E9.tmp 105 PID 4824 wrote to memory of 3336 4824 24C4.tmp 106 PID 3336 wrote to memory of 2076 3336 259F.tmp 107 PID 2076 wrote to memory of 3364 2076 2689.tmp 109 PID 3364 wrote to memory of 4796 3364 2735.tmp 111 PID 4796 wrote to memory of 1420 4796 27F1.tmp 112 PID 1420 wrote to memory of 3460 1420 28AC.tmp 113 PID 3460 wrote to memory of 2200 3460 2977.tmp 114 PID 2200 wrote to memory of 3024 2200 2A81.tmp 115 PID 3024 wrote to memory of 2428 3024 2B9A.tmp 116 PID 2428 wrote to memory of 2872 2428 2C75.tmp 117 PID 2872 wrote to memory of 3180 2872 2D30.tmp 118 PID 3180 wrote to memory of 2268 3180 2E1B.tmp 119 PID 2268 wrote to memory of 3300 2268 2EE6.tmp 120 PID 3300 wrote to memory of 3352 3300 2FC1.tmp 121 PID 3352 wrote to memory of 1136 3352 30AB.tmp 122 PID 1136 wrote to memory of 2696 1136 3157.tmp 123 PID 2696 wrote to memory of 1988 2696 3241.tmp 125 PID 1988 wrote to memory of 3780 1988 332C.tmp 126 PID 3780 wrote to memory of 4200 3780 33F7.tmp 127 PID 4200 wrote to memory of 3116 4200 3493.tmp 128 PID 3116 wrote to memory of 4640 3116 3520.tmp 129 PID 4640 wrote to memory of 4020 4640 35AC.tmp 130 PID 4020 wrote to memory of 1180 4020 3639.tmp 131 PID 1180 wrote to memory of 1652 1180 36C6.tmp 132 PID 1652 wrote to memory of 3264 1652 3743.tmp 133 PID 3264 wrote to memory of 1936 3264 37CF.tmp 134 PID 1936 wrote to memory of 5048 1936 386B.tmp 135 PID 5048 wrote to memory of 1836 5048 38E8.tmp 136 PID 1836 wrote to memory of 3544 1836 3985.tmp 137 PID 3544 wrote to memory of 924 3544 3A21.tmp 138 PID 924 wrote to memory of 4364 924 3ABD.tmp 139 PID 4364 wrote to memory of 2524 4364 3B3A.tmp 140 PID 2524 wrote to memory of 3360 2524 3BB7.tmp 141 PID 3360 wrote to memory of 460 3360 3C34.tmp 142 PID 460 wrote to memory of 3904 460 3CA2.tmp 143 PID 3904 wrote to memory of 4228 3904 3D0F.tmp 144 PID 4228 wrote to memory of 2784 4228 3D5D.tmp 145 PID 2784 wrote to memory of 2464 2784 3DAB.tmp 146 PID 2464 wrote to memory of 3280 2464 3DF9.tmp 148 PID 3280 wrote to memory of 1920 3280 3E47.tmp 149 PID 1920 wrote to memory of 4764 1920 3E96.tmp 150 PID 4764 wrote to memory of 4924 4764 3EF3.tmp 151 PID 4924 wrote to memory of 2472 4924 3F51.tmp 152 PID 2472 wrote to memory of 1900 2472 3F9F.tmp 153 PID 1900 wrote to memory of 2324 1900 3FED.tmp 154 PID 2324 wrote to memory of 3272 2324 403B.tmp 155 PID 3272 wrote to memory of 2740 3272 408A.tmp 156 PID 2740 wrote to memory of 2168 2740 40E7.tmp 157 PID 2168 wrote to memory of 2848 2168 4145.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_82e5944ecc58551ec853b4574eac3a58_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_82e5944ecc58551ec853b4574eac3a58_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1C58.tmp"C:\Users\Admin\AppData\Local\Temp\1C58.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\21A7.tmp"C:\Users\Admin\AppData\Local\Temp\21A7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\2253.tmp"C:\Users\Admin\AppData\Local\Temp\2253.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\232E.tmp"C:\Users\Admin\AppData\Local\Temp\232E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\2735.tmp"C:\Users\Admin\AppData\Local\Temp\2735.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\2977.tmp"C:\Users\Admin\AppData\Local\Temp\2977.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\3157.tmp"C:\Users\Admin\AppData\Local\Temp\3157.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\332C.tmp"C:\Users\Admin\AppData\Local\Temp\332C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\33F7.tmp"C:\Users\Admin\AppData\Local\Temp\33F7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\35AC.tmp"C:\Users\Admin\AppData\Local\Temp\35AC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\386B.tmp"C:\Users\Admin\AppData\Local\Temp\386B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\3985.tmp"C:\Users\Admin\AppData\Local\Temp\3985.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3E47.tmp"C:\Users\Admin\AppData\Local\Temp\3E47.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"65⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"66⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"67⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"68⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\42CC.tmp"C:\Users\Admin\AppData\Local\Temp\42CC.tmp"69⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\431A.tmp"C:\Users\Admin\AppData\Local\Temp\431A.tmp"70⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"72⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"73⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\4452.tmp"C:\Users\Admin\AppData\Local\Temp\4452.tmp"74⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"75⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\44EF.tmp"C:\Users\Admin\AppData\Local\Temp\44EF.tmp"76⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"77⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"78⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"80⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"81⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\46E3.tmp"C:\Users\Admin\AppData\Local\Temp\46E3.tmp"82⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"83⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"84⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"85⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\481B.tmp"C:\Users\Admin\AppData\Local\Temp\481B.tmp"86⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"87⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"88⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"89⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"90⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"91⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"92⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"C:\Users\Admin\AppData\Local\Temp\4AAB.tmp"94⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"95⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"96⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"97⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"98⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\4C61.tmp"C:\Users\Admin\AppData\Local\Temp\4C61.tmp"99⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"100⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"101⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"102⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"103⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"104⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"105⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"106⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"107⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"108⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"109⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"110⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"111⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"112⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\50C6.tmp"C:\Users\Admin\AppData\Local\Temp\50C6.tmp"113⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\5114.tmp"C:\Users\Admin\AppData\Local\Temp\5114.tmp"114⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"115⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\51B0.tmp"C:\Users\Admin\AppData\Local\Temp\51B0.tmp"116⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"117⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"118⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"119⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\5346.tmp"C:\Users\Admin\AppData\Local\Temp\5346.tmp"121⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"122⤵PID:880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-