Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe
- Size 520KB
- Sample261017-1dbkmady2s
- SHA256 7525c890a52570cace7e2be4d812b48c4cbdb4597d0c659db170b50f738e5fce
- MD5 265b8ddb5ee945f3311d5875a0f2e05b
- SHA1 9ed5d31ca41f38796d84e7e2cd6c9fbcd6a19376
- SHA512 d690aa2af2a3f2e5a34ddd92e585c13f4c61ab5f3d45c0319c61616e6d579f858da49328062d9329bb6568d707fe65c114dcf78f606372e23fe7b8ed285e4dc3
- SSDEEP 12288:gj8fuxR21t5i8fFhYAhaEqqjRrRJoE4xuIu3pNZ6:gj8fuK1GYFhYAhjjh2E5NI
- TLSH T11EB4F1027994C036E8D615310B56DBA21B7EBD399B3695C737C536AE6FB02C1E63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4468 EC4F.tmp 2712 ED2A.tmp 2136 EE43.tmp 5052 EEDF.tmp 4564 EF7C.tmp 820 EFE9.tmp 2380 F076.tmp 4604 F112.tmp 1360 F19E.tmp 3580 F24A.tmp 3416 F2C7.tmp 3360 F354.tmp 260 F3E1.tmp 1248 F48C.tmp 3960 F538.tmp 1120 F5A6.tmp 2668 F690.tmp 1112 F72C.tmp 3456 F7C9.tmp 3304 F826.tmp 3084 F8B3.tmp 4688 F930.tmp 1748 F9CC.tmp 3972 FA68.tmp 3980 FAF5.tmp 3468 FB62.tmp 2004 FBFF.tmp 980 FC9B.tmp 4484 FD28.tmp 1868 FDE3.tmp 2644 FE7F.tmp 3228 FF1C.tmp 3148 FF89.tmp 552 FFD7.tmp 5016 25.tmp 3920 73.tmp 612 E1.tmp 532 13E.tmp 1288 17D.tmp 4788 1DB.tmp 3540 229.tmp 1908 277.tmp 4248 2E4.tmp 4872 332.tmp 3792 390.tmp 2276 3EE.tmp 4452 44C.tmp 2344 49A.tmp 4052 4E8.tmp 3720 526.tmp 4212 575.tmp 4380 5C3.tmp 1116 611.tmp 3136 65F.tmp 4848 6AD.tmp 2140 70B.tmp 2824 759.tmp 4224 7B7.tmp 4048 805.tmp 1752 863.tmp 3488 8B1.tmp 2372 8FF.tmp 3796 95D.tmp 2356 9AB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F11D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 984E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 133B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 333B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 378C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A01E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 4468 4164 2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe 85 PID 4468 wrote to memory of 2712 4468 EC4F.tmp 87 PID 2712 wrote to memory of 2136 2712 ED2A.tmp 88 PID 2136 wrote to memory of 5052 2136 EE43.tmp 90 PID 5052 wrote to memory of 4564 5052 EEDF.tmp 91 PID 4564 wrote to memory of 820 4564 EF7C.tmp 92 PID 820 wrote to memory of 2380 820 EFE9.tmp 94 PID 2380 wrote to memory of 4604 2380 F076.tmp 95 PID 4604 wrote to memory of 1360 4604 F112.tmp 96 PID 1360 wrote to memory of 3580 1360 F19E.tmp 97 PID 3580 wrote to memory of 3416 3580 F24A.tmp 98 PID 3416 wrote to memory of 3360 3416 F2C7.tmp 99 PID 3360 wrote to memory of 260 3360 F354.tmp 100 PID 260 wrote to memory of 1248 260 F3E1.tmp 101 PID 1248 wrote to memory of 3960 1248 F48C.tmp 102 PID 3960 wrote to memory of 1120 3960 F538.tmp 103 PID 1120 wrote to memory of 2668 1120 F5A6.tmp 104 PID 2668 wrote to memory of 1112 2668 F690.tmp 105 PID 1112 wrote to memory of 3456 1112 F72C.tmp 106 PID 3456 wrote to memory of 3304 3456 F7C9.tmp 107 PID 3304 wrote to memory of 3084 3304 F826.tmp 108 PID 3084 wrote to memory of 4688 3084 F8B3.tmp 111 PID 4688 wrote to memory of 1748 4688 F930.tmp 112 PID 1748 wrote to memory of 3972 1748 F9CC.tmp 113 PID 3972 wrote to memory of 3980 3972 FA68.tmp 114 PID 3980 wrote to memory of 3468 3980 FAF5.tmp 115 PID 3468 wrote to memory of 2004 3468 FB62.tmp 116 PID 2004 wrote to memory of 980 2004 FBFF.tmp 117 PID 980 wrote to memory of 4484 980 FC9B.tmp 118 PID 4484 wrote to memory of 1868 4484 FD28.tmp 120 PID 1868 wrote to memory of 2644 1868 FDE3.tmp 122 PID 2644 wrote to memory of 3228 2644 FE7F.tmp 123 PID 3228 wrote to memory of 3148 3228 FF1C.tmp 124 PID 3148 wrote to memory of 552 3148 FF89.tmp 125 PID 552 wrote to memory of 5016 552 FFD7.tmp 126 PID 5016 wrote to memory of 3920 5016 25.tmp 127 PID 3920 wrote to memory of 612 3920 73.tmp 128 PID 612 wrote to memory of 532 612 E1.tmp 129 PID 532 wrote to memory of 1288 532 13E.tmp 130 PID 1288 wrote to memory of 4788 1288 17D.tmp 131 PID 4788 wrote to memory of 3540 4788 1DB.tmp 132 PID 3540 wrote to memory of 1908 3540 229.tmp 133 PID 1908 wrote to memory of 4248 1908 277.tmp 134 PID 4248 wrote to memory of 4872 4248 2E4.tmp 135 PID 4872 wrote to memory of 3792 4872 332.tmp 136 PID 3792 wrote to memory of 2276 3792 390.tmp 137 PID 2276 wrote to memory of 4452 2276 3EE.tmp 138 PID 4452 wrote to memory of 2344 4452 44C.tmp 139 PID 2344 wrote to memory of 4052 2344 49A.tmp 140 PID 4052 wrote to memory of 3720 4052 4E8.tmp 141 PID 3720 wrote to memory of 4212 3720 526.tmp 142 PID 4212 wrote to memory of 4380 4212 575.tmp 143 PID 4380 wrote to memory of 1116 4380 5C3.tmp 144 PID 1116 wrote to memory of 3136 1116 611.tmp 145 PID 3136 wrote to memory of 4848 3136 65F.tmp 146 PID 4848 wrote to memory of 2140 4848 6AD.tmp 147 PID 2140 wrote to memory of 2824 2140 70B.tmp 148 PID 2824 wrote to memory of 4224 2824 759.tmp 149 PID 4224 wrote to memory of 4048 4224 7B7.tmp 150 PID 4048 wrote to memory of 1752 4048 805.tmp 151 PID 1752 wrote to memory of 3488 1752 863.tmp 152 PID 3488 wrote to memory of 2372 3488 8B1.tmp 153 PID 2372 wrote to memory of 3796 2372 8FF.tmp 154 PID 3796 wrote to memory of 2356 3796 95D.tmp 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_265b8ddb5ee945f3311d5875a0f2e05b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\EEDF.tmp"C:\Users\Admin\AppData\Local\Temp\EEDF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\F19E.tmp"C:\Users\Admin\AppData\Local\Temp\F19E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\F690.tmp"C:\Users\Admin\AppData\Local\Temp\F690.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F72C.tmp"C:\Users\Admin\AppData\Local\Temp\F72C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\F826.tmp"C:\Users\Admin\AppData\Local\Temp\F826.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\F930.tmp"C:\Users\Admin\AppData\Local\Temp\F930.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\FA68.tmp"C:\Users\Admin\AppData\Local\Temp\FA68.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\FB62.tmp"C:\Users\Admin\AppData\Local\Temp\FB62.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\FF89.tmp"C:\Users\Admin\AppData\Local\Temp\FF89.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\73.tmp"C:\Users\Admin\AppData\Local\Temp\73.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\E1.tmp"C:\Users\Admin\AppData\Local\Temp\E1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\13E.tmp"C:\Users\Admin\AppData\Local\Temp\13E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\17D.tmp"C:\Users\Admin\AppData\Local\Temp\17D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\277.tmp"C:\Users\Admin\AppData\Local\Temp\277.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2E4.tmp"C:\Users\Admin\AppData\Local\Temp\2E4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\332.tmp"C:\Users\Admin\AppData\Local\Temp\332.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\390.tmp"C:\Users\Admin\AppData\Local\Temp\390.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3EE.tmp"C:\Users\Admin\AppData\Local\Temp\3EE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\44C.tmp"C:\Users\Admin\AppData\Local\Temp\44C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\49A.tmp"C:\Users\Admin\AppData\Local\Temp\49A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4E8.tmp"C:\Users\Admin\AppData\Local\Temp\4E8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\611.tmp"C:\Users\Admin\AppData\Local\Temp\611.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\70B.tmp"C:\Users\Admin\AppData\Local\Temp\70B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\805.tmp"C:\Users\Admin\AppData\Local\Temp\805.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"65⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\A08.tmp"C:\Users\Admin\AppData\Local\Temp\A08.tmp"66⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"67⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\AB4.tmp"C:\Users\Admin\AppData\Local\Temp\AB4.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:220 -
C:\Users\Admin\AppData\Local\Temp\B12.tmp"C:\Users\Admin\AppData\Local\Temp\B12.tmp"69⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\B70.tmp"C:\Users\Admin\AppData\Local\Temp\B70.tmp"70⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\BBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBE.tmp"71⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"72⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\C79.tmp"C:\Users\Admin\AppData\Local\Temp\C79.tmp"73⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\CB8.tmp"C:\Users\Admin\AppData\Local\Temp\CB8.tmp"74⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"75⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"76⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\DB2.tmp"C:\Users\Admin\AppData\Local\Temp\DB2.tmp"77⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"78⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"79⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"80⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"81⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\F67.tmp"C:\Users\Admin\AppData\Local\Temp\F67.tmp"82⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\FB6.tmp"C:\Users\Admin\AppData\Local\Temp\FB6.tmp"83⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"84⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"85⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\10A0.tmp"C:\Users\Admin\AppData\Local\Temp\10A0.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"87⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\113C.tmp"C:\Users\Admin\AppData\Local\Temp\113C.tmp"88⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\119A.tmp"C:\Users\Admin\AppData\Local\Temp\119A.tmp"89⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"90⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"91⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"92⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"93⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"94⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\13AD.tmp"C:\Users\Admin\AppData\Local\Temp\13AD.tmp"95⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"96⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\1469.tmp"C:\Users\Admin\AppData\Local\Temp\1469.tmp"97⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\14B7.tmp"C:\Users\Admin\AppData\Local\Temp\14B7.tmp"98⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\1505.tmp"C:\Users\Admin\AppData\Local\Temp\1505.tmp"99⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\1553.tmp"C:\Users\Admin\AppData\Local\Temp\1553.tmp"100⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"101⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"102⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"103⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\168C.tmp"C:\Users\Admin\AppData\Local\Temp\168C.tmp"104⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"105⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\1728.tmp"C:\Users\Admin\AppData\Local\Temp\1728.tmp"106⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"107⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"108⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1812.tmp"C:\Users\Admin\AppData\Local\Temp\1812.tmp"109⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"110⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"111⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"112⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"113⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"116⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"117⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"118⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"119⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"120⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"121⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\1C29.tmp"C:\Users\Admin\AppData\Local\Temp\1C29.tmp"122⤵PID:3656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-