Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 13:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_53b391eed27a8c4eb0c75ba35aa1f1db_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_53b391eed27a8c4eb0c75ba35aa1f1db_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_53b391eed27a8c4eb0c75ba35aa1f1db_elex_mafia.exe
- Size 521KB
- Sample261024-qdr79sy16k
- SHA256 ce86a96df8c53fbf5d7874cee8f58e0cc888d45daa0262bca70b3afc6eb63d1e
- MD5 53b391eed27a8c4eb0c75ba35aa1f1db
- SHA1 e6564ccd1ccb82fc392b0aa9e5212bfed4805e3d
- SHA512 a1d6655e30cd3d20a0e172bc2b8dfec693f8ddf9d05120b451d9102491bc7c6e79ca908b0bb9a14a50f2f6f03ebb64af0783eabc52ddc12df07de855a453c040
- SSDEEP 6144:zvLUgXFL4l/0QbRHR45HfGmxGb0XsF5MnDl3rR0kIIwuR+yod5a0X9P2Jt1AsGPZ:klBHR2HtxGbzMh7HgbawP2Ws0hcNZi
- TLSH T1A7B4F1147545C032E5D211384B66EBA249BE7E729B2AE4C73B91363E6FB93C4D278307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3416 7402.tmp 4100 74AE.tmp 4460 754A.tmp 4292 75D7.tmp 4224 7683.tmp 2300 7700.tmp 1324 777D.tmp 3428 77EA.tmp 2652 7867.tmp 888 7903.tmp 404 79A0.tmp 2352 7A0D.tmp 4976 7A8A.tmp 3616 7B07.tmp 3632 7BA3.tmp 3300 7C40.tmp 4644 7CAD.tmp 4964 7D3A.tmp 2736 7DC6.tmp 3396 7E91.tmp 4896 7F2E.tmp 456 7FD9.tmp 5032 8047.tmp 4836 80D3.tmp 3508 8150.tmp 5056 81AE.tmp 4576 824A.tmp 204 82D7.tmp 2740 8393.tmp 880 843E.tmp 3288 84BB.tmp 312 8567.tmp 3528 8632.tmp 4756 8690.tmp 1092 86EE.tmp 3464 874C.tmp 3708 87A9.tmp 3108 8807.tmp 2928 8855.tmp 4764 88A3.tmp 2440 8901.tmp 4844 894F.tmp 4208 899D.tmp 4464 89EC.tmp 2844 8A3A.tmp 2944 8A88.tmp 3172 8AE6.tmp 8 8B34.tmp 5088 8B82.tmp 4780 8BD0.tmp 1108 8C1E.tmp 4180 8C6C.tmp 1196 8CBA.tmp 3064 8D08.tmp 4340 8D57.tmp 3160 8DB4.tmp 1592 8E02.tmp 5008 8E51.tmp 4200 8E9F.tmp 4064 8EED.tmp 4352 8F4B.tmp 2160 8FA8.tmp 3364 8FF6.tmp 564 9045.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C290.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 790E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C59D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F846.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9AD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 3416 1756 2026-10-22_53b391eed27a8c4eb0c75ba35aa1f1db_elex_mafia.exe 85 PID 3416 wrote to memory of 4100 3416 7402.tmp 86 PID 4100 wrote to memory of 4460 4100 74AE.tmp 87 PID 4460 wrote to memory of 4292 4460 754A.tmp 88 PID 4292 wrote to memory of 4224 4292 75D7.tmp 89 PID 4224 wrote to memory of 2300 4224 7683.tmp 90 PID 2300 wrote to memory of 1324 2300 7700.tmp 91 PID 1324 wrote to memory of 3428 1324 777D.tmp 92 PID 3428 wrote to memory of 2652 3428 77EA.tmp 93 PID 2652 wrote to memory of 888 2652 7867.tmp 94 PID 888 wrote to memory of 404 888 7903.tmp 95 PID 404 wrote to memory of 2352 404 79A0.tmp 96 PID 2352 wrote to memory of 4976 2352 7A0D.tmp 97 PID 4976 wrote to memory of 3616 4976 7A8A.tmp 98 PID 3616 wrote to memory of 3632 3616 7B07.tmp 99 PID 3632 wrote to memory of 3300 3632 7BA3.tmp 100 PID 3300 wrote to memory of 4644 3300 7C40.tmp 101 PID 4644 wrote to memory of 4964 4644 7CAD.tmp 102 PID 4964 wrote to memory of 2736 4964 7D3A.tmp 103 PID 2736 wrote to memory of 3396 2736 7DC6.tmp 104 PID 3396 wrote to memory of 4896 3396 7E91.tmp 107 PID 4896 wrote to memory of 456 4896 7F2E.tmp 108 PID 456 wrote to memory of 5032 456 7FD9.tmp 109 PID 5032 wrote to memory of 4836 5032 8047.tmp 110 PID 4836 wrote to memory of 3508 4836 80D3.tmp 111 PID 3508 wrote to memory of 5056 3508 8150.tmp 112 PID 5056 wrote to memory of 4576 5056 81AE.tmp 113 PID 4576 wrote to memory of 204 4576 824A.tmp 114 PID 204 wrote to memory of 2740 204 82D7.tmp 116 PID 2740 wrote to memory of 880 2740 8393.tmp 118 PID 880 wrote to memory of 3288 880 843E.tmp 119 PID 3288 wrote to memory of 312 3288 84BB.tmp 120 PID 312 wrote to memory of 3528 312 8567.tmp 121 PID 3528 wrote to memory of 4756 3528 8632.tmp 122 PID 4756 wrote to memory of 1092 4756 8690.tmp 123 PID 1092 wrote to memory of 3464 1092 86EE.tmp 124 PID 3464 wrote to memory of 3708 3464 874C.tmp 125 PID 3708 wrote to memory of 3108 3708 87A9.tmp 126 PID 3108 wrote to memory of 2928 3108 8807.tmp 127 PID 2928 wrote to memory of 4764 2928 8855.tmp 128 PID 4764 wrote to memory of 2440 4764 88A3.tmp 129 PID 2440 wrote to memory of 4844 2440 8901.tmp 130 PID 4844 wrote to memory of 4208 4844 894F.tmp 131 PID 4208 wrote to memory of 4464 4208 899D.tmp 132 PID 4464 wrote to memory of 2844 4464 89EC.tmp 133 PID 2844 wrote to memory of 2944 2844 8A3A.tmp 134 PID 2944 wrote to memory of 3172 2944 8A88.tmp 135 PID 3172 wrote to memory of 8 3172 8AE6.tmp 136 PID 8 wrote to memory of 5088 8 8B34.tmp 137 PID 5088 wrote to memory of 4780 5088 8B82.tmp 138 PID 4780 wrote to memory of 1108 4780 8BD0.tmp 139 PID 1108 wrote to memory of 4180 1108 8C1E.tmp 140 PID 4180 wrote to memory of 1196 4180 8C6C.tmp 141 PID 1196 wrote to memory of 3064 1196 8CBA.tmp 142 PID 3064 wrote to memory of 4340 3064 8D08.tmp 143 PID 4340 wrote to memory of 3160 4340 8D57.tmp 144 PID 3160 wrote to memory of 1592 3160 8DB4.tmp 145 PID 1592 wrote to memory of 5008 1592 8E02.tmp 146 PID 5008 wrote to memory of 4200 5008 8E51.tmp 147 PID 4200 wrote to memory of 4064 4200 8E9F.tmp 148 PID 4064 wrote to memory of 4352 4064 8EED.tmp 150 PID 4352 wrote to memory of 2160 4352 8F4B.tmp 151 PID 2160 wrote to memory of 3364 2160 8FA8.tmp 152 PID 3364 wrote to memory of 564 3364 8FF6.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_53b391eed27a8c4eb0c75ba35aa1f1db_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_53b391eed27a8c4eb0c75ba35aa1f1db_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\74AE.tmp"C:\Users\Admin\AppData\Local\Temp\74AE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\75D7.tmp"C:\Users\Admin\AppData\Local\Temp\75D7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\77EA.tmp"C:\Users\Admin\AppData\Local\Temp\77EA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7903.tmp"C:\Users\Admin\AppData\Local\Temp\7903.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\7A0D.tmp"C:\Users\Admin\AppData\Local\Temp\7A0D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\7C40.tmp"C:\Users\Admin\AppData\Local\Temp\7C40.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\7E91.tmp"C:\Users\Admin\AppData\Local\Temp\7E91.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\84BB.tmp"C:\Users\Admin\AppData\Local\Temp\84BB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\8690.tmp"C:\Users\Admin\AppData\Local\Temp\8690.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\87A9.tmp"C:\Users\Admin\AppData\Local\Temp\87A9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8B34.tmp"C:\Users\Admin\AppData\Local\Temp\8B34.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\8E02.tmp"C:\Users\Admin\AppData\Local\Temp\8E02.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\9045.tmp"C:\Users\Admin\AppData\Local\Temp\9045.tmp"65⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\9093.tmp"C:\Users\Admin\AppData\Local\Temp\9093.tmp"66⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"67⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\912F.tmp"C:\Users\Admin\AppData\Local\Temp\912F.tmp"68⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"69⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"70⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"71⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\9287.tmp"C:\Users\Admin\AppData\Local\Temp\9287.tmp"72⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"73⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"74⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"75⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\93EE.tmp"C:\Users\Admin\AppData\Local\Temp\93EE.tmp"76⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\944C.tmp"C:\Users\Admin\AppData\Local\Temp\944C.tmp"77⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\949A.tmp"C:\Users\Admin\AppData\Local\Temp\949A.tmp"78⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"79⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"80⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"81⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\95E2.tmp"C:\Users\Admin\AppData\Local\Temp\95E2.tmp"82⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"83⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\966F.tmp"C:\Users\Admin\AppData\Local\Temp\966F.tmp"84⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\96BD.tmp"C:\Users\Admin\AppData\Local\Temp\96BD.tmp"85⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"86⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\9769.tmp"C:\Users\Admin\AppData\Local\Temp\9769.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"88⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\9805.tmp"C:\Users\Admin\AppData\Local\Temp\9805.tmp"89⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"91⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\991E.tmp"C:\Users\Admin\AppData\Local\Temp\991E.tmp"92⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\996C.tmp"C:\Users\Admin\AppData\Local\Temp\996C.tmp"93⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"94⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"95⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\9A86.tmp"C:\Users\Admin\AppData\Local\Temp\9A86.tmp"96⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"97⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\9B22.tmp"C:\Users\Admin\AppData\Local\Temp\9B22.tmp"98⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\9B70.tmp"C:\Users\Admin\AppData\Local\Temp\9B70.tmp"99⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\9BCE.tmp"C:\Users\Admin\AppData\Local\Temp\9BCE.tmp"100⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"101⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"102⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"103⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"104⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"105⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"106⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"107⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"108⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"109⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"110⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\9F58.tmp"C:\Users\Admin\AppData\Local\Temp\9F58.tmp"111⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\9FA6.tmp"C:\Users\Admin\AppData\Local\Temp\9FA6.tmp"112⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"113⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"114⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"115⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"116⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"117⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\A19A.tmp"C:\Users\Admin\AppData\Local\Temp\A19A.tmp"118⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"119⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"120⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"C:\Users\Admin\AppData\Local\Temp\A2A4.tmp"121⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-