Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 20:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_551115a51a0d16151cf2c110075ca883_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_551115a51a0d16151cf2c110075ca883_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-03_551115a51a0d16151cf2c110075ca883_elex_mafia.exe
- Size 520KB
- Sample261104-y46scaef48
- SHA256 5aa494c06c4be74ca230804a293e63f318a377ba9c4674a6b83433744825c9b5
- MD5 551115a51a0d16151cf2c110075ca883
- SHA1 36022c673a37ea785f1060a7610d1358eab69a08
- SHA512 ca2ad3252fb42791fc41cff71a24965911799be87defbacacb8a87456e77ae01e4c3e710c17d544fad0a02d71bc5eb044d94bd424ea42b99c3bcba3e030c043f
- SSDEEP 12288:gj8fuxR21t5i8fkVH5xVVjsoYkpI9g7SVtsKrJ/NZ:gj8fuK1GYsxVVjs6Iq+HPJN
- TLSH T136B4F002B549C032E9D615350A96DBA10BFEBC399B3695C33790367E6FB52C2D63831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1512 B580.tmp 1712 B62C.tmp 4720 B6D8.tmp 1156 B764.tmp 2268 B82F.tmp 4692 B89D.tmp 3272 B91A.tmp 3264 B987.tmp 4640 BA04.tmp 1280 BA91.tmp 4996 BB7B.tmp 5032 BC08.tmp 4904 BCB4.tmp 3796 BD21.tmp 4632 BDCD.tmp 2504 BE3A.tmp 860 BEE6.tmp 3536 BF73.tmp 5004 C00F.tmp 2260 C0CA.tmp 2388 C176.tmp 2528 C203.tmp 3948 C2BE.tmp 2588 C35B.tmp 1032 C3F7.tmp 2436 C484.tmp 4600 C52F.tmp 4592 C5CC.tmp 3716 C658.tmp 4440 C6C6.tmp 468 C762.tmp 2940 C7FE.tmp 3956 C85C.tmp 1860 C8BA.tmp 4448 C908.tmp 3672 C956.tmp 3528 C9A4.tmp 1844 C9F2.tmp 4284 CA40.tmp 3048 CA8E.tmp 3296 CADD.tmp 3828 CB3A.tmp 3880 CB88.tmp 3924 CBD7.tmp 5112 CC25.tmp 752 CC73.tmp 3968 CCD1.tmp 4736 CD1F.tmp 2480 CD7C.tmp 2712 CDCB.tmp 3688 CE19.tmp 2532 CE67.tmp 552 CEC5.tmp 4084 CF22.tmp 4488 CF70.tmp 4216 CFBF.tmp 4724 D00D.tmp 548 D05B.tmp 1224 D0A9.tmp 5044 D0F7.tmp 3920 D155.tmp 4760 D1A3.tmp 2748 D1F1.tmp 3508 D23F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 157D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 770B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 810D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A232.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 1512 1772 2026-11-03_551115a51a0d16151cf2c110075ca883_elex_mafia.exe 85 PID 1512 wrote to memory of 1712 1512 B580.tmp 86 PID 1712 wrote to memory of 4720 1712 B62C.tmp 87 PID 4720 wrote to memory of 1156 4720 B6D8.tmp 88 PID 1156 wrote to memory of 2268 1156 B764.tmp 89 PID 2268 wrote to memory of 4692 2268 B82F.tmp 90 PID 4692 wrote to memory of 3272 4692 B89D.tmp 91 PID 3272 wrote to memory of 3264 3272 B91A.tmp 92 PID 3264 wrote to memory of 4640 3264 B987.tmp 93 PID 4640 wrote to memory of 1280 4640 BA04.tmp 94 PID 1280 wrote to memory of 4996 1280 BA91.tmp 95 PID 4996 wrote to memory of 5032 4996 BB7B.tmp 96 PID 5032 wrote to memory of 4904 5032 BC08.tmp 97 PID 4904 wrote to memory of 3796 4904 BCB4.tmp 98 PID 3796 wrote to memory of 4632 3796 BD21.tmp 99 PID 4632 wrote to memory of 2504 4632 BDCD.tmp 100 PID 2504 wrote to memory of 860 2504 BE3A.tmp 101 PID 860 wrote to memory of 3536 860 BEE6.tmp 102 PID 3536 wrote to memory of 5004 3536 BF73.tmp 103 PID 5004 wrote to memory of 2260 5004 C00F.tmp 104 PID 2260 wrote to memory of 2388 2260 C0CA.tmp 105 PID 2388 wrote to memory of 2528 2388 C176.tmp 106 PID 2528 wrote to memory of 3948 2528 C203.tmp 107 PID 3948 wrote to memory of 2588 3948 C2BE.tmp 108 PID 2588 wrote to memory of 1032 2588 C35B.tmp 109 PID 1032 wrote to memory of 2436 1032 C3F7.tmp 110 PID 2436 wrote to memory of 4600 2436 C484.tmp 113 PID 4600 wrote to memory of 4592 4600 C52F.tmp 114 PID 4592 wrote to memory of 3716 4592 C5CC.tmp 115 PID 3716 wrote to memory of 4440 3716 C658.tmp 116 PID 4440 wrote to memory of 468 4440 C6C6.tmp 117 PID 468 wrote to memory of 2940 468 C762.tmp 118 PID 2940 wrote to memory of 3956 2940 C7FE.tmp 119 PID 3956 wrote to memory of 1860 3956 C85C.tmp 120 PID 1860 wrote to memory of 4448 1860 C8BA.tmp 121 PID 4448 wrote to memory of 3672 4448 C908.tmp 123 PID 3672 wrote to memory of 3528 3672 C956.tmp 124 PID 3528 wrote to memory of 1844 3528 C9A4.tmp 126 PID 1844 wrote to memory of 4284 1844 C9F2.tmp 127 PID 4284 wrote to memory of 3048 4284 CA40.tmp 128 PID 3048 wrote to memory of 3296 3048 CA8E.tmp 129 PID 3296 wrote to memory of 3828 3296 CADD.tmp 130 PID 3828 wrote to memory of 3880 3828 CB3A.tmp 131 PID 3880 wrote to memory of 3924 3880 CB88.tmp 132 PID 3924 wrote to memory of 5112 3924 CBD7.tmp 133 PID 5112 wrote to memory of 752 5112 CC25.tmp 134 PID 752 wrote to memory of 3968 752 CC73.tmp 135 PID 3968 wrote to memory of 4736 3968 CCD1.tmp 136 PID 4736 wrote to memory of 2480 4736 CD1F.tmp 137 PID 2480 wrote to memory of 2712 2480 CD7C.tmp 138 PID 2712 wrote to memory of 3688 2712 CDCB.tmp 139 PID 3688 wrote to memory of 2532 3688 CE19.tmp 140 PID 2532 wrote to memory of 552 2532 CE67.tmp 141 PID 552 wrote to memory of 4084 552 CEC5.tmp 142 PID 4084 wrote to memory of 4488 4084 CF22.tmp 143 PID 4488 wrote to memory of 4216 4488 CF70.tmp 144 PID 4216 wrote to memory of 4724 4216 CFBF.tmp 145 PID 4724 wrote to memory of 548 4724 D00D.tmp 146 PID 548 wrote to memory of 1224 548 D05B.tmp 147 PID 1224 wrote to memory of 5044 1224 D0A9.tmp 148 PID 5044 wrote to memory of 3920 5044 D0F7.tmp 149 PID 3920 wrote to memory of 4760 3920 D155.tmp 150 PID 4760 wrote to memory of 2748 4760 D1A3.tmp 151 PID 2748 wrote to memory of 3508 2748 D1F1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_551115a51a0d16151cf2c110075ca883_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_551115a51a0d16151cf2c110075ca883_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\B580.tmp"C:\Users\Admin\AppData\Local\Temp\B580.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B62C.tmp"C:\Users\Admin\AppData\Local\Temp\B62C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"C:\Users\Admin\AppData\Local\Temp\B6D8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\B987.tmp"C:\Users\Admin\AppData\Local\Temp\B987.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\BA04.tmp"C:\Users\Admin\AppData\Local\Temp\BA04.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\BA91.tmp"C:\Users\Admin\AppData\Local\Temp\BA91.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\BCB4.tmp"C:\Users\Admin\AppData\Local\Temp\BCB4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\C00F.tmp"C:\Users\Admin\AppData\Local\Temp\C00F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C52F.tmp"C:\Users\Admin\AppData\Local\Temp\C52F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\C658.tmp"C:\Users\Admin\AppData\Local\Temp\C658.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C85C.tmp"C:\Users\Admin\AppData\Local\Temp\C85C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\C956.tmp"C:\Users\Admin\AppData\Local\Temp\C956.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\CA40.tmp"C:\Users\Admin\AppData\Local\Temp\CA40.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\CE67.tmp"C:\Users\Admin\AppData\Local\Temp\CE67.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"65⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"66⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"67⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"68⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"69⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"70⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"71⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\D4A1.tmp"C:\Users\Admin\AppData\Local\Temp\D4A1.tmp"72⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"73⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\D53D.tmp"C:\Users\Admin\AppData\Local\Temp\D53D.tmp"74⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\D58B.tmp"C:\Users\Admin\AppData\Local\Temp\D58B.tmp"75⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"76⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"77⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"78⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"79⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"80⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"81⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\D7CD.tmp"C:\Users\Admin\AppData\Local\Temp\D7CD.tmp"82⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"83⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"84⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"85⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"86⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"87⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"88⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"89⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"90⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\DADA.tmp"C:\Users\Admin\AppData\Local\Temp\DADA.tmp"91⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"92⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"93⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\DC32.tmp"C:\Users\Admin\AppData\Local\Temp\DC32.tmp"94⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"95⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"96⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"97⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"98⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"99⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"100⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"102⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"103⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"104⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\E00A.tmp"C:\Users\Admin\AppData\Local\Temp\E00A.tmp"105⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\E078.tmp"C:\Users\Admin\AppData\Local\Temp\E078.tmp"106⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"107⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"108⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"109⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"110⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\E21E.tmp"C:\Users\Admin\AppData\Local\Temp\E21E.tmp"111⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"112⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"113⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"114⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"115⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"116⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"117⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"118⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\E51B.tmp"C:\Users\Admin\AppData\Local\Temp\E51B.tmp"119⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"120⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"121⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\E615.tmp"C:\Users\Admin\AppData\Local\Temp\E615.tmp"122⤵PID:4308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-