Analysis
- max time kernel
150s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe
- Size 520KB
- Sample260415-29ms7sd15y
- SHA256 cda6dbb3f0f99136ae831b9bf705664d18d94e3d70493fddfd6cd8ea7129318a
- MD5 44949a5cdfdb976ffc95ea6956522ce2
- SHA1 f401f0299c06c03346ba5e08f405a1e46e567ba4
- SHA512 2072c38d2b86744bb648fe11acc68ae0fdb2e7235680413df965f02ff4f74066760e25e4ac3991551e881d9ae784963919449b72894a044155b4d40abb0b6cbd
- SSDEEP 6144:pXT6Oq8HBh4huuAOBdRFyh1T55i8fkbtfbhzZ7x+eAg+azrvo4TsWWD1+PFmOo+O:gj8fuxR21t5i8fAlrvK18QOo+fNZ6
- TLSH T1D5B4F121B549C032E8E219314A26DFA54BBABC355B6695C73BC0367D6FB52C2D73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5148 13D1.tmp 4312 144E.tmp 6076 14FA.tmp 5224 15A6.tmp 5800 1623.tmp 4476 1681.tmp 4456 170D.tmp 4432 179A.tmp 4396 1836.tmp 1968 1894.tmp 4884 18F2.tmp 5764 196F.tmp 6008 1A0B.tmp 5592 1A78.tmp 2672 1AD6.tmp 3768 1B63.tmp 4276 1BE0.tmp 6044 1C4D.tmp 1328 1D09.tmp 2340 1D86.tmp 5400 1E12.tmp 1476 1E8F.tmp 512 1F0C.tmp 3280 1F7A.tmp 5856 1FF7.tmp 5716 2054.tmp 3712 20C2.tmp 5836 2110.tmp 2228 217D.tmp 4176 21FA.tmp 5440 2268.tmp 2988 22F4.tmp 912 2371.tmp 1744 241D.tmp 4168 247B.tmp 808 24C9.tmp 4628 2517.tmp 60 2584.tmp 5176 25E2.tmp 3960 2630.tmp 3660 267E.tmp 1244 26EC.tmp 764 274A.tmp 3788 27B7.tmp 3704 2805.tmp 668 2853.tmp 4104 28B1.tmp 5720 290F.tmp 2936 296C.tmp 5744 29BB.tmp 5320 2A09.tmp 4808 2A86.tmp 5684 2AF3.tmp 624 2B51.tmp 5356 2BBE.tmp 5344 2C1C.tmp 1424 2C7A.tmp 5008 2CC8.tmp 888 2D26.tmp 5476 2D83.tmp 5012 2DF1.tmp 4060 2E4E.tmp 4148 2EBC.tmp 2148 2F1A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4419.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 487E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A256.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 318B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7664.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 913F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5985.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 5148 4192 2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe 84 PID 5148 wrote to memory of 4312 5148 13D1.tmp 85 PID 4312 wrote to memory of 6076 4312 144E.tmp 86 PID 6076 wrote to memory of 5224 6076 14FA.tmp 87 PID 5224 wrote to memory of 5800 5224 15A6.tmp 88 PID 5800 wrote to memory of 4476 5800 1623.tmp 89 PID 4476 wrote to memory of 4456 4476 1681.tmp 90 PID 4456 wrote to memory of 4432 4456 170D.tmp 91 PID 4432 wrote to memory of 4396 4432 179A.tmp 92 PID 4396 wrote to memory of 1968 4396 1836.tmp 93 PID 1968 wrote to memory of 4884 1968 1894.tmp 94 PID 4884 wrote to memory of 5764 4884 18F2.tmp 95 PID 5764 wrote to memory of 6008 5764 196F.tmp 96 PID 6008 wrote to memory of 5592 6008 1A0B.tmp 97 PID 5592 wrote to memory of 2672 5592 1A78.tmp 98 PID 2672 wrote to memory of 3768 2672 1AD6.tmp 99 PID 3768 wrote to memory of 4276 3768 1B63.tmp 100 PID 4276 wrote to memory of 6044 4276 1BE0.tmp 101 PID 6044 wrote to memory of 1328 6044 1C4D.tmp 102 PID 1328 wrote to memory of 2340 1328 1D09.tmp 103 PID 2340 wrote to memory of 5400 2340 1D86.tmp 104 PID 5400 wrote to memory of 1476 5400 1E12.tmp 105 PID 1476 wrote to memory of 512 1476 1E8F.tmp 106 PID 512 wrote to memory of 3280 512 1F0C.tmp 107 PID 3280 wrote to memory of 5856 3280 1F7A.tmp 108 PID 5856 wrote to memory of 5716 5856 1FF7.tmp 109 PID 5716 wrote to memory of 3712 5716 2054.tmp 110 PID 3712 wrote to memory of 5836 3712 20C2.tmp 111 PID 5836 wrote to memory of 2228 5836 2110.tmp 112 PID 2228 wrote to memory of 4176 2228 217D.tmp 113 PID 4176 wrote to memory of 5440 4176 21FA.tmp 114 PID 5440 wrote to memory of 2988 5440 2268.tmp 115 PID 2988 wrote to memory of 912 2988 22F4.tmp 116 PID 912 wrote to memory of 1744 912 2371.tmp 117 PID 1744 wrote to memory of 4168 1744 241D.tmp 118 PID 4168 wrote to memory of 808 4168 247B.tmp 119 PID 808 wrote to memory of 4628 808 24C9.tmp 120 PID 4628 wrote to memory of 60 4628 2517.tmp 121 PID 60 wrote to memory of 5176 60 2584.tmp 122 PID 5176 wrote to memory of 3960 5176 25E2.tmp 123 PID 3960 wrote to memory of 3660 3960 2630.tmp 124 PID 3660 wrote to memory of 1244 3660 267E.tmp 125 PID 1244 wrote to memory of 764 1244 26EC.tmp 126 PID 764 wrote to memory of 3788 764 274A.tmp 127 PID 3788 wrote to memory of 3704 3788 27B7.tmp 128 PID 3704 wrote to memory of 668 3704 2805.tmp 129 PID 668 wrote to memory of 4104 668 2853.tmp 130 PID 4104 wrote to memory of 5720 4104 28B1.tmp 131 PID 5720 wrote to memory of 2936 5720 290F.tmp 132 PID 2936 wrote to memory of 5744 2936 296C.tmp 133 PID 5744 wrote to memory of 5320 5744 29BB.tmp 134 PID 5320 wrote to memory of 4808 5320 2A09.tmp 135 PID 4808 wrote to memory of 5684 4808 2A86.tmp 136 PID 5684 wrote to memory of 624 5684 2AF3.tmp 137 PID 624 wrote to memory of 5356 624 2B51.tmp 138 PID 5356 wrote to memory of 5344 5356 2BBE.tmp 139 PID 5344 wrote to memory of 1424 5344 2C1C.tmp 140 PID 1424 wrote to memory of 5008 1424 2C7A.tmp 141 PID 5008 wrote to memory of 888 5008 2CC8.tmp 142 PID 888 wrote to memory of 5476 888 2D26.tmp 143 PID 5476 wrote to memory of 5012 5476 2D83.tmp 144 PID 5012 wrote to memory of 4060 5012 2DF1.tmp 145 PID 4060 wrote to memory of 4148 4060 2E4E.tmp 146 PID 4148 wrote to memory of 2148 4148 2EBC.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_44949a5cdfdb976ffc95ea6956522ce2_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"65⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"66⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"68⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"69⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"70⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"73⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"74⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"75⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"76⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"77⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"78⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"79⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"80⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"81⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"82⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"83⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"84⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"85⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"86⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"88⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"89⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"90⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"91⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"92⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"93⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"94⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"95⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"96⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"97⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"98⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"99⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"100⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"101⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"102⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"103⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"104⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"105⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"106⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"107⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"108⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"109⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"111⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"112⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"113⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"114⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"115⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"116⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"117⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"118⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"119⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"120⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\430F.tmp"C:\Users\Admin\AppData\Local\Temp\430F.tmp"121⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"122⤵PID:1808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-