Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/10/2026, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_f265b0db4013f7e71c570db417683ec7_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_f265b0db4013f7e71c570db417683ec7_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_f265b0db4013f7e71c570db417683ec7_elex_mafia.exe
- Size 520KB
- Sample261023-c8aptacb45
- SHA256 a0ae0efb05aa5441db53ba410ef9e80b920e896cbfbe565d263931d24ed82ee2
- MD5 f265b0db4013f7e71c570db417683ec7
- SHA1 9f547be9fd04a73bc3e0c1ac1fa198c51a62d9a2
- SHA512 7a61c84287e542b3d42171a8ed73bd059a1c98e7bab2e070f2c9b3bb83a50af3f7f896ab6b475f962096a7b44afa20a8d0dc6443c9b392a0e9d8087aff44ccdf
- SSDEEP 12288:roRXOQjmOytNf3BfzL2k7RDh+qjsCtVgGtwiNZE:rogQ9y3pfP2k1YqjjAGaiN6
- TLSH T1F0B4F122B589C032E5C251318B2ADFA11B3A7D764B3A92C73B94366D6FB42D0E375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4312 E8D4.tmp 2100 E990.tmp 4392 EA4B.tmp 4180 EB07.tmp 4100 EB94.tmp 4760 EC20.tmp 4336 EC8E.tmp 1984 ED2A.tmp 4844 EDA7.tmp 4680 EE43.tmp 3616 EEC0.tmp 1836 EF3D.tmp 4948 EFCA.tmp 4396 F037.tmp 1728 F0D3.tmp 2184 F141.tmp 3748 F1FC.tmp 2812 F289.tmp 4284 F306.tmp 2544 F383.tmp 1400 F41F.tmp 816 F4AC.tmp 2156 F529.tmp 2076 F5B5.tmp 3364 F642.tmp 624 F6EE.tmp 5092 F77A.tmp 564 F807.tmp 4024 F894.tmp 1048 F911.tmp 2136 F99D.tmp 4756 FA1A.tmp 4580 FA88.tmp 1784 FAE5.tmp 1456 FB34.tmp 4076 FB91.tmp 4044 FBFF.tmp 4700 FC5C.tmp 4108 FCBA.tmp 2484 FD18.tmp 4084 FD66.tmp 1444 FDB4.tmp 5072 FE02.tmp 2660 FE50.tmp 3332 FE9F.tmp 2008 FEED.tmp 1272 FF3B.tmp 3216 FF99.tmp 3904 FFE7.tmp 4420 35.tmp 828 83.tmp 2708 D1.tmp 3660 11F.tmp 4464 16D.tmp 3036 1BB.tmp 392 20A.tmp 4228 258.tmp 3960 2B5.tmp 1472 304.tmp 2656 352.tmp 2380 3A0.tmp 4860 3EE.tmp 3572 43C.tmp 924 48A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A53F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7006.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D095.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1220 wrote to memory of 4312 1220 2026-10-22_f265b0db4013f7e71c570db417683ec7_elex_mafia.exe 85 PID 4312 wrote to memory of 2100 4312 E8D4.tmp 86 PID 2100 wrote to memory of 4392 2100 E990.tmp 87 PID 4392 wrote to memory of 4180 4392 EA4B.tmp 88 PID 4180 wrote to memory of 4100 4180 EB07.tmp 89 PID 4100 wrote to memory of 4760 4100 EB94.tmp 90 PID 4760 wrote to memory of 4336 4760 EC20.tmp 91 PID 4336 wrote to memory of 1984 4336 EC8E.tmp 92 PID 1984 wrote to memory of 4844 1984 ED2A.tmp 93 PID 4844 wrote to memory of 4680 4844 EDA7.tmp 94 PID 4680 wrote to memory of 3616 4680 EE43.tmp 95 PID 3616 wrote to memory of 1836 3616 EEC0.tmp 96 PID 1836 wrote to memory of 4948 1836 EF3D.tmp 97 PID 4948 wrote to memory of 4396 4948 EFCA.tmp 98 PID 4396 wrote to memory of 1728 4396 F037.tmp 99 PID 1728 wrote to memory of 2184 1728 F0D3.tmp 100 PID 2184 wrote to memory of 3748 2184 F141.tmp 101 PID 3748 wrote to memory of 2812 3748 F1FC.tmp 102 PID 2812 wrote to memory of 4284 2812 F289.tmp 103 PID 4284 wrote to memory of 2544 4284 F306.tmp 104 PID 2544 wrote to memory of 1400 2544 F383.tmp 107 PID 1400 wrote to memory of 816 1400 F41F.tmp 108 PID 816 wrote to memory of 2156 816 F4AC.tmp 109 PID 2156 wrote to memory of 2076 2156 F529.tmp 110 PID 2076 wrote to memory of 3364 2076 F5B5.tmp 111 PID 3364 wrote to memory of 624 3364 F642.tmp 112 PID 624 wrote to memory of 5092 624 F6EE.tmp 113 PID 5092 wrote to memory of 564 5092 F77A.tmp 115 PID 564 wrote to memory of 4024 564 F807.tmp 116 PID 4024 wrote to memory of 1048 4024 F894.tmp 118 PID 1048 wrote to memory of 2136 1048 F911.tmp 119 PID 2136 wrote to memory of 4756 2136 F99D.tmp 120 PID 4756 wrote to memory of 4580 4756 FA1A.tmp 121 PID 4580 wrote to memory of 1784 4580 FA88.tmp 122 PID 1784 wrote to memory of 1456 1784 FAE5.tmp 123 PID 1456 wrote to memory of 4076 1456 FB34.tmp 124 PID 4076 wrote to memory of 4044 4076 FB91.tmp 125 PID 4044 wrote to memory of 4700 4044 FBFF.tmp 126 PID 4700 wrote to memory of 4108 4700 FC5C.tmp 127 PID 4108 wrote to memory of 2484 4108 FCBA.tmp 128 PID 2484 wrote to memory of 4084 2484 FD18.tmp 129 PID 4084 wrote to memory of 1444 4084 FD66.tmp 130 PID 1444 wrote to memory of 5072 1444 FDB4.tmp 131 PID 5072 wrote to memory of 2660 5072 FE02.tmp 132 PID 2660 wrote to memory of 3332 2660 FE50.tmp 133 PID 3332 wrote to memory of 2008 3332 FE9F.tmp 134 PID 2008 wrote to memory of 1272 2008 FEED.tmp 135 PID 1272 wrote to memory of 3216 1272 FF3B.tmp 136 PID 3216 wrote to memory of 3904 3216 FF99.tmp 137 PID 3904 wrote to memory of 4420 3904 FFE7.tmp 138 PID 4420 wrote to memory of 828 4420 35.tmp 139 PID 828 wrote to memory of 2708 828 83.tmp 140 PID 2708 wrote to memory of 3660 2708 D1.tmp 141 PID 3660 wrote to memory of 4464 3660 11F.tmp 142 PID 4464 wrote to memory of 3036 4464 16D.tmp 143 PID 3036 wrote to memory of 392 3036 1BB.tmp 144 PID 392 wrote to memory of 4228 392 20A.tmp 145 PID 4228 wrote to memory of 3960 4228 258.tmp 146 PID 3960 wrote to memory of 1472 3960 2B5.tmp 147 PID 1472 wrote to memory of 2656 1472 304.tmp 148 PID 2656 wrote to memory of 2380 2656 352.tmp 149 PID 2380 wrote to memory of 4860 2380 3A0.tmp 151 PID 4860 wrote to memory of 3572 4860 3EE.tmp 152 PID 3572 wrote to memory of 924 3572 43C.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_f265b0db4013f7e71c570db417683ec7_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_f265b0db4013f7e71c570db417683ec7_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\E990.tmp"C:\Users\Admin\AppData\Local\Temp\E990.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\EB94.tmp"C:\Users\Admin\AppData\Local\Temp\EB94.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\EC20.tmp"C:\Users\Admin\AppData\Local\Temp\EC20.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\EC8E.tmp"C:\Users\Admin\AppData\Local\Temp\EC8E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\F037.tmp"C:\Users\Admin\AppData\Local\Temp\F037.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\F0D3.tmp"C:\Users\Admin\AppData\Local\Temp\F0D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\F141.tmp"C:\Users\Admin\AppData\Local\Temp\F141.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\F529.tmp"C:\Users\Admin\AppData\Local\Temp\F529.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"C:\Users\Admin\AppData\Local\Temp\F5B5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\F642.tmp"C:\Users\Admin\AppData\Local\Temp\F642.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\F807.tmp"C:\Users\Admin\AppData\Local\Temp\F807.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\F894.tmp"C:\Users\Admin\AppData\Local\Temp\F894.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\F911.tmp"C:\Users\Admin\AppData\Local\Temp\F911.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\F99D.tmp"C:\Users\Admin\AppData\Local\Temp\F99D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\FA88.tmp"C:\Users\Admin\AppData\Local\Temp\FA88.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\FB34.tmp"C:\Users\Admin\AppData\Local\Temp\FB34.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\FB91.tmp"C:\Users\Admin\AppData\Local\Temp\FB91.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\FD18.tmp"C:\Users\Admin\AppData\Local\Temp\FD18.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\FE02.tmp"C:\Users\Admin\AppData\Local\Temp\FE02.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\FE50.tmp"C:\Users\Admin\AppData\Local\Temp\FE50.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\FEED.tmp"C:\Users\Admin\AppData\Local\Temp\FEED.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\83.tmp"C:\Users\Admin\AppData\Local\Temp\83.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\D1.tmp"C:\Users\Admin\AppData\Local\Temp\D1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\16D.tmp"C:\Users\Admin\AppData\Local\Temp\16D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\1BB.tmp"C:\Users\Admin\AppData\Local\Temp\1BB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\20A.tmp"C:\Users\Admin\AppData\Local\Temp\20A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3A0.tmp"C:\Users\Admin\AppData\Local\Temp\3A0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\3EE.tmp"C:\Users\Admin\AppData\Local\Temp\3EE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"65⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"66⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\526.tmp"C:\Users\Admin\AppData\Local\Temp\526.tmp"67⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"68⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"69⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"70⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\69D.tmp"C:\Users\Admin\AppData\Local\Temp\69D.tmp"71⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\6FB.tmp"C:\Users\Admin\AppData\Local\Temp\6FB.tmp"72⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"73⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"74⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"75⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"76⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"77⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"78⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"79⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\99B.tmp"C:\Users\Admin\AppData\Local\Temp\99B.tmp"80⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\9E9.tmp"C:\Users\Admin\AppData\Local\Temp\9E9.tmp"81⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"82⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"83⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"84⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\B31.tmp"C:\Users\Admin\AppData\Local\Temp\B31.tmp"85⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B7F.tmp"C:\Users\Admin\AppData\Local\Temp\B7F.tmp"86⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"87⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"88⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\C89.tmp"C:\Users\Admin\AppData\Local\Temp\C89.tmp"89⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\CE7.tmp"C:\Users\Admin\AppData\Local\Temp\CE7.tmp"90⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\D35.tmp"C:\Users\Admin\AppData\Local\Temp\D35.tmp"91⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"92⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\DF0.tmp"C:\Users\Admin\AppData\Local\Temp\DF0.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\E3F.tmp"C:\Users\Admin\AppData\Local\Temp\E3F.tmp"94⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"95⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\EDB.tmp"C:\Users\Admin\AppData\Local\Temp\EDB.tmp"96⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\F39.tmp"C:\Users\Admin\AppData\Local\Temp\F39.tmp"97⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"98⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\FD5.tmp"C:\Users\Admin\AppData\Local\Temp\FD5.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\1071.tmp"C:\Users\Admin\AppData\Local\Temp\1071.tmp"101⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"102⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\10FE.tmp"C:\Users\Admin\AppData\Local\Temp\10FE.tmp"103⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\114C.tmp"C:\Users\Admin\AppData\Local\Temp\114C.tmp"104⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\119A.tmp"C:\Users\Admin\AppData\Local\Temp\119A.tmp"105⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\11E8.tmp"C:\Users\Admin\AppData\Local\Temp\11E8.tmp"106⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"107⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"108⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\12D2.tmp"C:\Users\Admin\AppData\Local\Temp\12D2.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1321.tmp"C:\Users\Admin\AppData\Local\Temp\1321.tmp"110⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\138E.tmp"C:\Users\Admin\AppData\Local\Temp\138E.tmp"111⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\13DC.tmp"C:\Users\Admin\AppData\Local\Temp\13DC.tmp"112⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"113⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"114⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\14D6.tmp"C:\Users\Admin\AppData\Local\Temp\14D6.tmp"115⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"116⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\1592.tmp"C:\Users\Admin\AppData\Local\Temp\1592.tmp"117⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\15E0.tmp"C:\Users\Admin\AppData\Local\Temp\15E0.tmp"118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"119⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\168C.tmp"C:\Users\Admin\AppData\Local\Temp\168C.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"121⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\1747.tmp"C:\Users\Admin\AppData\Local\Temp\1747.tmp"122⤵PID:4880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-