Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 16:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_b5ea326003798bd024899c65d1af6f52_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_b5ea326003798bd024899c65d1af6f52_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-15_b5ea326003798bd024899c65d1af6f52_elex_mafia.exe
- Size 521KB
- Sample260415-t9pc2aev3n
- SHA256 fc23f4fac94dbcfef709fb0c61e7401a702a08b8e16c2ad222cb3d224d1a8628
- MD5 b5ea326003798bd024899c65d1af6f52
- SHA1 47a7d3b8624ed9e95f821d2ede142270f35c91c0
- SHA512 afe75847086ec0f6faa45dba7fbce0c71454e8e39d00f67449ddcb3dfa0e07401e5e2442c626406234854858737e34b21b9965ce22ac2ec4ca83fdacdb6edfa7
- SSDEEP 12288:EDlpiJRz2jkKBldFQF0WUGOoQv4C+G1QNZi:EDSJAjkK/LQFxUVoK43G+Ng
- TLSH T122B4F121BD84C132FA9326351A61EBA20D3ABC255B26A5C777C4327E6FB42D1DB74343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 960 8C0E.tmp 5184 8C7C.tmp 5616 8D08.tmp 4052 8D57.tmp 5124 8DA5.tmp 4692 8DE3.tmp 2720 8E31.tmp 1728 8EAE.tmp 5228 8F0C.tmp 3512 8F79.tmp 4636 8FC8.tmp 3192 9016.tmp 2556 9083.tmp 1972 90D1.tmp 5404 911F.tmp 1420 916D.tmp 4588 91BC.tmp 3312 9239.tmp 996 9296.tmp 5332 92E4.tmp 6012 9352.tmp 5084 93A0.tmp 4564 93FE.tmp 5168 944C.tmp 1836 949A.tmp 5428 94E8.tmp 4344 9555.tmp 3384 95A4.tmp 1744 95E2.tmp 5640 9640.tmp 4816 968E.tmp 1672 96DC.tmp 956 973A.tmp 1048 9778.tmp 5304 97B7.tmp 5476 9805.tmp 5176 9843.tmp 5708 9882.tmp 5024 98C0.tmp 5940 990F.tmp 5128 994D.tmp 4716 998C.tmp 4304 99CA.tmp 2632 9A18.tmp 2972 9A66.tmp 2880 9AA5.tmp 6000 9AF3.tmp 3636 9B41.tmp 6056 9B80.tmp 6084 9BBE.tmp 4624 9BFD.tmp 4420 9C3B.tmp 6096 9C7A.tmp 3944 9CB8.tmp 4988 9CF7.tmp 2308 9D35.tmp 1980 9D74.tmp 3956 9DB2.tmp 2148 9E00.tmp 1988 9E3F.tmp 5804 9E7D.tmp 2472 9EBC.tmp 1168 9EFA.tmp 5928 9F39.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A033.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1227.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 697E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B38C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3792 wrote to memory of 960 3792 2026-04-15_b5ea326003798bd024899c65d1af6f52_elex_mafia.exe 79 PID 960 wrote to memory of 5184 960 8C0E.tmp 80 PID 5184 wrote to memory of 5616 5184 8C7C.tmp 81 PID 5616 wrote to memory of 4052 5616 8D08.tmp 82 PID 4052 wrote to memory of 5124 4052 8D57.tmp 83 PID 5124 wrote to memory of 4692 5124 8DA5.tmp 84 PID 4692 wrote to memory of 2720 4692 8DE3.tmp 85 PID 2720 wrote to memory of 1728 2720 8E31.tmp 86 PID 1728 wrote to memory of 5228 1728 8EAE.tmp 87 PID 5228 wrote to memory of 3512 5228 8F0C.tmp 88 PID 3512 wrote to memory of 4636 3512 8F79.tmp 89 PID 4636 wrote to memory of 3192 4636 8FC8.tmp 90 PID 3192 wrote to memory of 2556 3192 9016.tmp 91 PID 2556 wrote to memory of 1972 2556 9083.tmp 92 PID 1972 wrote to memory of 5404 1972 90D1.tmp 93 PID 5404 wrote to memory of 1420 5404 911F.tmp 94 PID 1420 wrote to memory of 4588 1420 916D.tmp 95 PID 4588 wrote to memory of 3312 4588 91BC.tmp 96 PID 3312 wrote to memory of 996 3312 9239.tmp 97 PID 996 wrote to memory of 5332 996 9296.tmp 98 PID 5332 wrote to memory of 6012 5332 92E4.tmp 99 PID 6012 wrote to memory of 5084 6012 9352.tmp 100 PID 5084 wrote to memory of 4564 5084 93A0.tmp 101 PID 4564 wrote to memory of 5168 4564 93FE.tmp 102 PID 5168 wrote to memory of 1836 5168 944C.tmp 103 PID 1836 wrote to memory of 5428 1836 949A.tmp 104 PID 5428 wrote to memory of 4344 5428 94E8.tmp 105 PID 4344 wrote to memory of 3384 4344 9555.tmp 106 PID 3384 wrote to memory of 1744 3384 95A4.tmp 107 PID 1744 wrote to memory of 5640 1744 95E2.tmp 108 PID 5640 wrote to memory of 4816 5640 9640.tmp 109 PID 4816 wrote to memory of 1672 4816 968E.tmp 110 PID 1672 wrote to memory of 956 1672 96DC.tmp 111 PID 956 wrote to memory of 1048 956 973A.tmp 112 PID 1048 wrote to memory of 5304 1048 9778.tmp 113 PID 5304 wrote to memory of 5476 5304 97B7.tmp 114 PID 5476 wrote to memory of 5176 5476 9805.tmp 115 PID 5176 wrote to memory of 5708 5176 9843.tmp 116 PID 5708 wrote to memory of 5024 5708 9882.tmp 117 PID 5024 wrote to memory of 5940 5024 98C0.tmp 118 PID 5940 wrote to memory of 5128 5940 990F.tmp 119 PID 5128 wrote to memory of 4716 5128 994D.tmp 120 PID 4716 wrote to memory of 4304 4716 998C.tmp 121 PID 4304 wrote to memory of 2632 4304 99CA.tmp 122 PID 2632 wrote to memory of 2972 2632 9A18.tmp 123 PID 2972 wrote to memory of 2880 2972 9A66.tmp 124 PID 2880 wrote to memory of 6000 2880 9AA5.tmp 125 PID 6000 wrote to memory of 3636 6000 9AF3.tmp 126 PID 3636 wrote to memory of 6056 3636 9B41.tmp 127 PID 6056 wrote to memory of 6084 6056 9B80.tmp 128 PID 6084 wrote to memory of 4624 6084 9BBE.tmp 129 PID 4624 wrote to memory of 4420 4624 9BFD.tmp 130 PID 4420 wrote to memory of 6096 4420 9C3B.tmp 131 PID 6096 wrote to memory of 3944 6096 9C7A.tmp 132 PID 3944 wrote to memory of 4988 3944 9CB8.tmp 133 PID 4988 wrote to memory of 2308 4988 9CF7.tmp 134 PID 2308 wrote to memory of 1980 2308 9D35.tmp 135 PID 1980 wrote to memory of 3956 1980 9D74.tmp 136 PID 3956 wrote to memory of 2148 3956 9DB2.tmp 137 PID 2148 wrote to memory of 1988 2148 9E00.tmp 138 PID 1988 wrote to memory of 5804 1988 9E3F.tmp 139 PID 5804 wrote to memory of 2472 5804 9E7D.tmp 140 PID 2472 wrote to memory of 1168 2472 9EBC.tmp 141 PID 1168 wrote to memory of 5928 1168 9EFA.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_b5ea326003798bd024899c65d1af6f52_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_b5ea326003798bd024899c65d1af6f52_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\8C0E.tmp"C:\Users\Admin\AppData\Local\Temp\8C0E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"C:\Users\Admin\AppData\Local\Temp\8FC8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\9016.tmp"C:\Users\Admin\AppData\Local\Temp\9016.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\90D1.tmp"C:\Users\Admin\AppData\Local\Temp\90D1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\91BC.tmp"C:\Users\Admin\AppData\Local\Temp\91BC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\944C.tmp"C:\Users\Admin\AppData\Local\Temp\944C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\949A.tmp"C:\Users\Admin\AppData\Local\Temp\949A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\95A4.tmp"C:\Users\Admin\AppData\Local\Temp\95A4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\95E2.tmp"C:\Users\Admin\AppData\Local\Temp\95E2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9640.tmp"C:\Users\Admin\AppData\Local\Temp\9640.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\968E.tmp"C:\Users\Admin\AppData\Local\Temp\968E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\96DC.tmp"C:\Users\Admin\AppData\Local\Temp\96DC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\973A.tmp"C:\Users\Admin\AppData\Local\Temp\973A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9778.tmp"C:\Users\Admin\AppData\Local\Temp\9778.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\9805.tmp"C:\Users\Admin\AppData\Local\Temp\9805.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\9843.tmp"C:\Users\Admin\AppData\Local\Temp\9843.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\9882.tmp"C:\Users\Admin\AppData\Local\Temp\9882.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\994D.tmp"C:\Users\Admin\AppData\Local\Temp\994D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\998C.tmp"C:\Users\Admin\AppData\Local\Temp\998C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9A18.tmp"C:\Users\Admin\AppData\Local\Temp\9A18.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\9F39.tmp"C:\Users\Admin\AppData\Local\Temp\9F39.tmp"65⤵
- Executes dropped EXE
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"66⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"67⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"68⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\A033.tmp"C:\Users\Admin\AppData\Local\Temp\A033.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:744 -
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"70⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"71⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"72⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"73⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\A18A.tmp"C:\Users\Admin\AppData\Local\Temp\A18A.tmp"74⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"75⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\A207.tmp"C:\Users\Admin\AppData\Local\Temp\A207.tmp"76⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"77⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"78⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"79⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\A311.tmp"C:\Users\Admin\AppData\Local\Temp\A311.tmp"80⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\A350.tmp"C:\Users\Admin\AppData\Local\Temp\A350.tmp"81⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"82⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\A3DC.tmp"C:\Users\Admin\AppData\Local\Temp\A3DC.tmp"83⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\A41B.tmp"C:\Users\Admin\AppData\Local\Temp\A41B.tmp"84⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\A459.tmp"C:\Users\Admin\AppData\Local\Temp\A459.tmp"85⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"86⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"87⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\A534.tmp"C:\Users\Admin\AppData\Local\Temp\A534.tmp"88⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\A582.tmp"C:\Users\Admin\AppData\Local\Temp\A582.tmp"89⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"90⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"91⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"92⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"93⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"94⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"95⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"96⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"97⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"98⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\A832.tmp"C:\Users\Admin\AppData\Local\Temp\A832.tmp"99⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A870.tmp"C:\Users\Admin\AppData\Local\Temp\A870.tmp"100⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"101⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\A8ED.tmp"C:\Users\Admin\AppData\Local\Temp\A8ED.tmp"102⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\A92C.tmp"C:\Users\Admin\AppData\Local\Temp\A92C.tmp"103⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\A97A.tmp"C:\Users\Admin\AppData\Local\Temp\A97A.tmp"104⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"106⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"107⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"108⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"109⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"110⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"111⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"112⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"113⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"115⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\AD14.tmp"C:\Users\Admin\AppData\Local\Temp\AD14.tmp"116⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"117⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"118⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\AE4C.tmp"C:\Users\Admin\AppData\Local\Temp\AE4C.tmp"119⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"120⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"121⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\AF65.tmp"C:\Users\Admin\AppData\Local\Temp\AF65.tmp"122⤵PID:2300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-