Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_3b67667ecf96d3aea1d35cd8202f8141_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_3b67667ecf96d3aea1d35cd8202f8141_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-15_3b67667ecf96d3aea1d35cd8202f8141_elex_mafia.exe
- Size 816KB
- Sample260415-15wpwadv3t
- SHA256 69dadfa0180bc2d9fbdab8a389426c651aaa383ec76221a81f6ce5b135f10fdc
- MD5 3b67667ecf96d3aea1d35cd8202f8141
- SHA1 e2ec6da84f9066dbd8040e8f940e522d37a7ebe0
- SHA512 9a528f67d7c43036efbb42fb63dc218620cce97e7930c4022355fa5d24dc2facce7abe26b4e01debe681611f8104d2fbca1d09d671ca6d925cdefff2258b82b2
- SSDEEP 6144:2fzZD/P+lZs2rdEkyc54b8DsanxRl9DPGF545hRsUZ3KcJVpthEcWwpzTrkTsH35:+mF/W8Dsy3ZGX4OUZTXpuCQ43Z
- TLSH T17105F121F654C032E69211394E5AFB62093A7D615B23A9C7BBD0366E6FB03D1EB75303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4624 9258.tmp 2072 92F4.tmp 5100 9381.tmp 1708 943C.tmp 3720 94B9.tmp 4832 9536.tmp 560 95C3.tmp 2336 9630.tmp 2476 96BD.tmp 3852 9769.tmp 2596 97C6.tmp 2324 9853.tmp 3736 98D0.tmp 3440 994D.tmp 2740 99CA.tmp 3836 9A37.tmp 4228 9AC4.tmp 2844 9B41.tmp 1012 9BBE.tmp 5080 9C3B.tmp 3060 9CB8.tmp 556 9D06.tmp 3276 9D93.tmp 4744 9E00.tmp 4756 9E8D.tmp 2392 9F0A.tmp 2000 9F77.tmp 4608 9FC5.tmp 116 A052.tmp 1916 A0BF.tmp 2920 A14C.tmp 1852 A1D9.tmp 3332 A236.tmp 1864 A284.tmp 1084 A2E2.tmp 4280 A340.tmp 4144 A38E.tmp 3296 A3EC.tmp 4552 A43A.tmp 924 A498.tmp 772 A4F5.tmp 1036 A544.tmp 4380 A592.tmp 3732 A5D0.tmp 1108 A60F.tmp 4116 A65D.tmp 4612 A6BB.tmp 1644 A6F9.tmp 748 A757.tmp 1280 A7A5.tmp 4664 A7F3.tmp 1796 A832.tmp 1628 A88F.tmp 1396 A8CE.tmp 2120 A91C.tmp 916 A96A.tmp 3692 A9B8.tmp 4900 AA16.tmp 4084 AA64.tmp 2248 AAB2.tmp 5088 AB00.tmp 2296 AB4E.tmp 696 AB9D.tmp 4512 ABEB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4624 3156 2026-04-15_3b67667ecf96d3aea1d35cd8202f8141_elex_mafia.exe 83 PID 4624 wrote to memory of 2072 4624 9258.tmp 84 PID 2072 wrote to memory of 5100 2072 92F4.tmp 85 PID 5100 wrote to memory of 1708 5100 9381.tmp 86 PID 1708 wrote to memory of 3720 1708 943C.tmp 87 PID 3720 wrote to memory of 4832 3720 94B9.tmp 88 PID 4832 wrote to memory of 560 4832 9536.tmp 89 PID 560 wrote to memory of 2336 560 95C3.tmp 90 PID 2336 wrote to memory of 2476 2336 9630.tmp 92 PID 2476 wrote to memory of 3852 2476 96BD.tmp 93 PID 3852 wrote to memory of 2596 3852 9769.tmp 94 PID 2596 wrote to memory of 2324 2596 97C6.tmp 95 PID 2324 wrote to memory of 3736 2324 9853.tmp 96 PID 3736 wrote to memory of 3440 3736 98D0.tmp 97 PID 3440 wrote to memory of 2740 3440 994D.tmp 98 PID 2740 wrote to memory of 3836 2740 99CA.tmp 99 PID 3836 wrote to memory of 4228 3836 9A37.tmp 100 PID 4228 wrote to memory of 2844 4228 9AC4.tmp 101 PID 2844 wrote to memory of 1012 2844 9B41.tmp 102 PID 1012 wrote to memory of 5080 1012 9BBE.tmp 103 PID 5080 wrote to memory of 3060 5080 9C3B.tmp 104 PID 3060 wrote to memory of 556 3060 9CB8.tmp 105 PID 556 wrote to memory of 3276 556 9D06.tmp 106 PID 3276 wrote to memory of 4744 3276 9D93.tmp 107 PID 4744 wrote to memory of 4756 4744 9E00.tmp 108 PID 4756 wrote to memory of 2392 4756 9E8D.tmp 109 PID 2392 wrote to memory of 2000 2392 9F0A.tmp 110 PID 2000 wrote to memory of 4608 2000 9F77.tmp 111 PID 4608 wrote to memory of 116 4608 9FC5.tmp 112 PID 116 wrote to memory of 1916 116 A052.tmp 113 PID 1916 wrote to memory of 2920 1916 A0BF.tmp 114 PID 2920 wrote to memory of 1852 2920 A14C.tmp 115 PID 1852 wrote to memory of 3332 1852 A1D9.tmp 116 PID 3332 wrote to memory of 1864 3332 A236.tmp 117 PID 1864 wrote to memory of 1084 1864 A284.tmp 118 PID 1084 wrote to memory of 4280 1084 A2E2.tmp 119 PID 4280 wrote to memory of 4144 4280 A340.tmp 120 PID 4144 wrote to memory of 3296 4144 A38E.tmp 121 PID 3296 wrote to memory of 4552 3296 A3EC.tmp 122 PID 4552 wrote to memory of 924 4552 A43A.tmp 123 PID 924 wrote to memory of 772 924 A498.tmp 124 PID 772 wrote to memory of 1036 772 A4F5.tmp 125 PID 1036 wrote to memory of 4380 1036 A544.tmp 126 PID 4380 wrote to memory of 3732 4380 A592.tmp 127 PID 3732 wrote to memory of 1108 3732 A5D0.tmp 128 PID 1108 wrote to memory of 4116 1108 A60F.tmp 129 PID 4116 wrote to memory of 4612 4116 A65D.tmp 130 PID 4612 wrote to memory of 1644 4612 A6BB.tmp 131 PID 1644 wrote to memory of 748 1644 A6F9.tmp 132 PID 748 wrote to memory of 1280 748 A757.tmp 133 PID 1280 wrote to memory of 4664 1280 A7A5.tmp 134 PID 4664 wrote to memory of 1796 4664 A7F3.tmp 135 PID 1796 wrote to memory of 1628 1796 A832.tmp 136 PID 1628 wrote to memory of 1396 1628 A88F.tmp 137 PID 1396 wrote to memory of 2120 1396 A8CE.tmp 138 PID 2120 wrote to memory of 916 2120 A91C.tmp 139 PID 916 wrote to memory of 3692 916 A96A.tmp 140 PID 3692 wrote to memory of 4900 3692 A9B8.tmp 141 PID 4900 wrote to memory of 4084 4900 AA16.tmp 142 PID 4084 wrote to memory of 2248 4084 AA64.tmp 143 PID 2248 wrote to memory of 5088 2248 AAB2.tmp 144 PID 5088 wrote to memory of 2296 5088 AB00.tmp 145 PID 2296 wrote to memory of 696 2296 AB4E.tmp 146 PID 696 wrote to memory of 4512 696 AB9D.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3b67667ecf96d3aea1d35cd8202f8141_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3b67667ecf96d3aea1d35cd8202f8141_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\92F4.tmp"C:\Users\Admin\AppData\Local\Temp\92F4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\9381.tmp"C:\Users\Admin\AppData\Local\Temp\9381.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9536.tmp"C:\Users\Admin\AppData\Local\Temp\9536.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\9630.tmp"C:\Users\Admin\AppData\Local\Temp\9630.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\96BD.tmp"C:\Users\Admin\AppData\Local\Temp\96BD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9769.tmp"C:\Users\Admin\AppData\Local\Temp\9769.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\98D0.tmp"C:\Users\Admin\AppData\Local\Temp\98D0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\994D.tmp"C:\Users\Admin\AppData\Local\Temp\994D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A14C.tmp"C:\Users\Admin\AppData\Local\Temp\A14C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\A236.tmp"C:\Users\Admin\AppData\Local\Temp\A236.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\A284.tmp"C:\Users\Admin\AppData\Local\Temp\A284.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\A340.tmp"C:\Users\Admin\AppData\Local\Temp\A340.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\A832.tmp"C:\Users\Admin\AppData\Local\Temp\A832.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\AA64.tmp"C:\Users\Admin\AppData\Local\Temp\AA64.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\AB00.tmp"C:\Users\Admin\AppData\Local\Temp\AB00.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\AB4E.tmp"C:\Users\Admin\AppData\Local\Temp\AB4E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\ABEB.tmp"C:\Users\Admin\AppData\Local\Temp\ABEB.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\AC39.tmp"C:\Users\Admin\AppData\Local\Temp\AC39.tmp"66⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\AC77.tmp"C:\Users\Admin\AppData\Local\Temp\AC77.tmp"67⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"68⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"69⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\AD81.tmp"C:\Users\Admin\AppData\Local\Temp\AD81.tmp"70⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"71⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"73⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"74⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"75⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\AF56.tmp"C:\Users\Admin\AppData\Local\Temp\AF56.tmp"76⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"77⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"78⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B050.tmp"C:\Users\Admin\AppData\Local\Temp\B050.tmp"79⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"80⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"81⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\B13A.tmp"C:\Users\Admin\AppData\Local\Temp\B13A.tmp"82⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"83⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"84⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"85⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\B282.tmp"C:\Users\Admin\AppData\Local\Temp\B282.tmp"86⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"C:\Users\Admin\AppData\Local\Temp\B2E0.tmp"87⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"88⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"89⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"90⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\B428.tmp"C:\Users\Admin\AppData\Local\Temp\B428.tmp"91⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\B476.tmp"C:\Users\Admin\AppData\Local\Temp\B476.tmp"92⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"93⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\B503.tmp"C:\Users\Admin\AppData\Local\Temp\B503.tmp"94⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\B561.tmp"C:\Users\Admin\AppData\Local\Temp\B561.tmp"95⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"96⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"97⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"98⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"99⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\B706.tmp"C:\Users\Admin\AppData\Local\Temp\B706.tmp"100⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\B755.tmp"C:\Users\Admin\AppData\Local\Temp\B755.tmp"101⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"102⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\B800.tmp"C:\Users\Admin\AppData\Local\Temp\B800.tmp"103⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\B85E.tmp"C:\Users\Admin\AppData\Local\Temp\B85E.tmp"104⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"105⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"106⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"107⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"108⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\BA14.tmp"C:\Users\Admin\AppData\Local\Temp\BA14.tmp"109⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\BA71.tmp"C:\Users\Admin\AppData\Local\Temp\BA71.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"C:\Users\Admin\AppData\Local\Temp\BAB0.tmp"111⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"112⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"113⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"114⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"115⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\BC46.tmp"C:\Users\Admin\AppData\Local\Temp\BC46.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"117⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"118⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\BD31.tmp"C:\Users\Admin\AppData\Local\Temp\BD31.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"120⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"121⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-