Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/10/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_707c3705c7fc0cd072e7f51b74fc5c39_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-19_707c3705c7fc0cd072e7f51b74fc5c39_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-19_707c3705c7fc0cd072e7f51b74fc5c39_elex_mafia.exe
- Size 524KB
- Sample261020-va3baacd62
- SHA256 612bb78436ba26da4d1ed9294cd20df5ce902bad12683bfc2192de0a4f3da6d3
- MD5 707c3705c7fc0cd072e7f51b74fc5c39
- SHA1 6ae414d7fb50f693065a0fcb06416c27c9574cc9
- SHA512 b50717f73116e21ed111cdca1f254aaf9194b63102893207a0e626dae167548f1067db330c42776fa73d4741efeb5ce10d9cfa75bc5d55b84f07381ab8a0489f
- SSDEEP 12288:TRyZzqyL66TCZ5jR4ghAIV+DLd3WKUjbYv4GANZ:TRyQylT05hOvZkPIAN
- TLSH T1E4B4F1257584C032E59201724A6AEB96593FBD71AB3398C73B84366E2FF13D1D6B430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1532 97F5.tmp 4276 991E.tmp 1264 9A47.tmp 3504 9B31.tmp 5008 9C99.tmp 3904 9D74.tmp 4652 9E6E.tmp 2128 9F48.tmp 4660 A023.tmp 3484 A12D.tmp 4228 A1D9.tmp 1180 A294.tmp 1116 A36F.tmp 3352 A469.tmp 2928 A524.tmp 116 A5C1.tmp 3664 A6BB.tmp 3712 A786.tmp 4396 A880.tmp 4508 A9A9.tmp 384 AA83.tmp 1728 AB7D.tmp 2616 AC1A.tmp 4716 AD33.tmp 3508 ADEE.tmp 4024 AEB9.tmp 4296 AFA4.tmp 4332 B08E.tmp 3516 B198.tmp 4892 B263.tmp 2056 B31E.tmp 2936 B418.tmp 756 B4C4.tmp 4212 B570.tmp 2140 B61C.tmp 3328 B6A9.tmp 4456 B735.tmp 4376 B7B2.tmp 4816 B82F.tmp 3972 B8DB.tmp 3976 B958.tmp 1392 B9D5.tmp 1708 BA81.tmp 1160 BB0E.tmp 1592 BB8B.tmp 3924 BC08.tmp 4956 BC94.tmp 4596 BD21.tmp 2448 BD7F.tmp 2412 BDDC.tmp 3616 BE2B.tmp 2104 BE79.tmp 2560 BEC7.tmp 5028 BF15.tmp 3884 BF63.tmp 1780 BFB1.tmp 4400 BFFF.tmp 1304 C04D.tmp 1804 C09C.tmp 4896 C0EA.tmp 3196 C138.tmp 5004 C186.tmp 4992 C1D4.tmp 4328 C222.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 115B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 308C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E10F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 331C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 1532 2784 2026-10-19_707c3705c7fc0cd072e7f51b74fc5c39_elex_mafia.exe 85 PID 1532 wrote to memory of 4276 1532 97F5.tmp 86 PID 4276 wrote to memory of 1264 4276 991E.tmp 87 PID 1264 wrote to memory of 3504 1264 9A47.tmp 88 PID 3504 wrote to memory of 5008 3504 9B31.tmp 89 PID 5008 wrote to memory of 3904 5008 9C99.tmp 90 PID 3904 wrote to memory of 4652 3904 9D74.tmp 91 PID 4652 wrote to memory of 2128 4652 9E6E.tmp 92 PID 2128 wrote to memory of 4660 2128 9F48.tmp 93 PID 4660 wrote to memory of 3484 4660 A023.tmp 96 PID 3484 wrote to memory of 4228 3484 A12D.tmp 97 PID 4228 wrote to memory of 1180 4228 A1D9.tmp 98 PID 1180 wrote to memory of 1116 1180 A294.tmp 99 PID 1116 wrote to memory of 3352 1116 A36F.tmp 100 PID 3352 wrote to memory of 2928 3352 A469.tmp 102 PID 2928 wrote to memory of 116 2928 A524.tmp 104 PID 116 wrote to memory of 3664 116 A5C1.tmp 105 PID 3664 wrote to memory of 3712 3664 A6BB.tmp 106 PID 3712 wrote to memory of 4396 3712 A786.tmp 108 PID 4396 wrote to memory of 4508 4396 A880.tmp 110 PID 4508 wrote to memory of 384 4508 A9A9.tmp 112 PID 384 wrote to memory of 1728 384 AA83.tmp 113 PID 1728 wrote to memory of 2616 1728 AB7D.tmp 114 PID 2616 wrote to memory of 4716 2616 AC1A.tmp 115 PID 4716 wrote to memory of 3508 4716 AD33.tmp 116 PID 3508 wrote to memory of 4024 3508 ADEE.tmp 117 PID 4024 wrote to memory of 4296 4024 AEB9.tmp 118 PID 4296 wrote to memory of 4332 4296 AFA4.tmp 120 PID 4332 wrote to memory of 3516 4332 B08E.tmp 121 PID 3516 wrote to memory of 4892 3516 B198.tmp 122 PID 4892 wrote to memory of 2056 4892 B263.tmp 123 PID 2056 wrote to memory of 2936 2056 B31E.tmp 124 PID 2936 wrote to memory of 756 2936 B418.tmp 125 PID 756 wrote to memory of 4212 756 B4C4.tmp 126 PID 4212 wrote to memory of 2140 4212 B570.tmp 127 PID 2140 wrote to memory of 3328 2140 B61C.tmp 128 PID 3328 wrote to memory of 4456 3328 B6A9.tmp 129 PID 4456 wrote to memory of 4376 4456 B735.tmp 130 PID 4376 wrote to memory of 4816 4376 B7B2.tmp 131 PID 4816 wrote to memory of 3972 4816 B82F.tmp 132 PID 3972 wrote to memory of 3976 3972 B8DB.tmp 133 PID 3976 wrote to memory of 1392 3976 B958.tmp 134 PID 1392 wrote to memory of 1708 1392 B9D5.tmp 135 PID 1708 wrote to memory of 1160 1708 BA81.tmp 136 PID 1160 wrote to memory of 1592 1160 BB0E.tmp 138 PID 1592 wrote to memory of 3924 1592 BB8B.tmp 139 PID 3924 wrote to memory of 4956 3924 BC08.tmp 141 PID 4956 wrote to memory of 4596 4956 BC94.tmp 143 PID 4596 wrote to memory of 2448 4596 BD21.tmp 144 PID 2448 wrote to memory of 2412 2448 BD7F.tmp 145 PID 2412 wrote to memory of 3616 2412 BDDC.tmp 146 PID 3616 wrote to memory of 2104 3616 BE2B.tmp 148 PID 2104 wrote to memory of 2560 2104 BE79.tmp 149 PID 2560 wrote to memory of 5028 2560 BEC7.tmp 150 PID 5028 wrote to memory of 3884 5028 BF15.tmp 151 PID 3884 wrote to memory of 1780 3884 BF63.tmp 152 PID 1780 wrote to memory of 4400 1780 BFB1.tmp 153 PID 4400 wrote to memory of 1304 4400 BFFF.tmp 154 PID 1304 wrote to memory of 1804 1304 C04D.tmp 155 PID 1804 wrote to memory of 4896 1804 C09C.tmp 156 PID 4896 wrote to memory of 3196 4896 C0EA.tmp 157 PID 3196 wrote to memory of 5004 3196 C138.tmp 158 PID 5004 wrote to memory of 4992 5004 C186.tmp 159 PID 4992 wrote to memory of 4328 4992 C1D4.tmp 160
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_707c3705c7fc0cd072e7f51b74fc5c39_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_707c3705c7fc0cd072e7f51b74fc5c39_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\9A47.tmp"C:\Users\Admin\AppData\Local\Temp\9A47.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9B31.tmp"C:\Users\Admin\AppData\Local\Temp\9B31.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\9C99.tmp"C:\Users\Admin\AppData\Local\Temp\9C99.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A023.tmp"C:\Users\Admin\AppData\Local\Temp\A023.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\A36F.tmp"C:\Users\Admin\AppData\Local\Temp\A36F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\A469.tmp"C:\Users\Admin\AppData\Local\Temp\A469.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\A524.tmp"C:\Users\Admin\AppData\Local\Temp\A524.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\A786.tmp"C:\Users\Admin\AppData\Local\Temp\A786.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\AD33.tmp"C:\Users\Admin\AppData\Local\Temp\AD33.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\B735.tmp"C:\Users\Admin\AppData\Local\Temp\B735.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\B8DB.tmp"C:\Users\Admin\AppData\Local\Temp\B8DB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\B958.tmp"C:\Users\Admin\AppData\Local\Temp\B958.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\BA81.tmp"C:\Users\Admin\AppData\Local\Temp\BA81.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"C:\Users\Admin\AppData\Local\Temp\BDDC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\BF15.tmp"C:\Users\Admin\AppData\Local\Temp\BF15.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\BF63.tmp"C:\Users\Admin\AppData\Local\Temp\BF63.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\C09C.tmp"C:\Users\Admin\AppData\Local\Temp\C09C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\C0EA.tmp"C:\Users\Admin\AppData\Local\Temp\C0EA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\C138.tmp"C:\Users\Admin\AppData\Local\Temp\C138.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\C186.tmp"C:\Users\Admin\AppData\Local\Temp\C186.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C222.tmp"C:\Users\Admin\AppData\Local\Temp\C222.tmp"65⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"66⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"67⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"68⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"69⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"70⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"71⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\C445.tmp"C:\Users\Admin\AppData\Local\Temp\C445.tmp"72⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\C493.tmp"C:\Users\Admin\AppData\Local\Temp\C493.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"74⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"75⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"76⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"77⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"78⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C678.tmp"C:\Users\Admin\AppData\Local\Temp\C678.tmp"79⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"80⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"81⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"82⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"83⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"84⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\C84C.tmp"C:\Users\Admin\AppData\Local\Temp\C84C.tmp"85⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"86⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"87⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"88⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C994.tmp"C:\Users\Admin\AppData\Local\Temp\C994.tmp"89⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"90⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\CA40.tmp"C:\Users\Admin\AppData\Local\Temp\CA40.tmp"91⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"92⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"93⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"94⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"95⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"96⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"97⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"98⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"99⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"100⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"101⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"102⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"104⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"105⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"106⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"107⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\CF80.tmp"C:\Users\Admin\AppData\Local\Temp\CF80.tmp"108⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"109⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"110⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"111⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"112⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"113⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"114⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"115⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"116⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"117⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"118⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"119⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"121⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"122⤵PID:1772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-