Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_0eacee224ba3cbc5881c39682e023ec5_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_0eacee224ba3cbc5881c39682e023ec5_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-17_0eacee224ba3cbc5881c39682e023ec5_elex_mafia.exe
- Size 520KB
- Sample260417-p54vpsev5m
- SHA256 b550da82cd0952b08475ca3b36cef34d4bd4ae5ba7408ed3e8b22d6ba12cb4df
- MD5 0eacee224ba3cbc5881c39682e023ec5
- SHA1 abae7bd5fbe5b28eecb093874e890c9751e78d57
- SHA512 06fff550425b331f2e0b192ca49d6674c82bfd4b026dcd3a9732b3324d03b94e8af896458c0688ccce590fa697dc29b86b2c05160708812649da96b232e9f5fe
- SSDEEP 12288:gj8fuxR21t5i8fRPz6rFwB8fNpMylogqGek7D4YY2RANZ6:gj8fuK1GY1z6ro8fNp+gBek78YYRNI
- TLSH T13AB4F0127585C033E9E325314A52DBA51BBEBC789B3591C73BC4366D6FB42D2A63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3060 4FE0.tmp 3660 50EA.tmp 4428 5196.tmp 2392 52AF.tmp 4964 53B9.tmp 4688 55CC.tmp 3856 56C6.tmp 3384 5791.tmp 4884 585C.tmp 1308 5927.tmp 3028 59C3.tmp 2616 5AFC.tmp 4968 5B79.tmp 2680 5C83.tmp 1548 5D5D.tmp 4216 5E38.tmp 4212 5F13.tmp 1536 5FCE.tmp 3044 60A9.tmp 1656 6174.tmp 4624 626E.tmp 2556 6368.tmp 4332 6453.tmp 2864 658B.tmp 2500 6656.tmp 4592 6760.tmp 4872 6879.tmp 3296 6954.tmp 1384 6A3E.tmp 2000 6B48.tmp 1492 6C13.tmp 2580 6CCE.tmp 3784 6DC8.tmp 4768 6E65.tmp 3812 6EC2.tmp 1768 6F8E.tmp 3804 7039.tmp 1364 70E5.tmp 4784 7162.tmp 4036 71DF.tmp 3196 724D.tmp 376 72D9.tmp 3008 7366.tmp 5060 7402.tmp 1156 748F.tmp 3680 74FC.tmp 4384 7579.tmp 2784 75E7.tmp 1252 76A2.tmp 1608 772F.tmp 632 77BB.tmp 3080 7867.tmp 4724 78F4.tmp 2344 7961.tmp 2220 79DE.tmp 1540 7AB9.tmp 2780 7B74.tmp 4652 7BE2.tmp 3388 7C4F.tmp 1512 7CDC.tmp 3968 7D59.tmp 4000 7DE5.tmp 1184 7E62.tmp 2592 7EFF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B84A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3668 wrote to memory of 3060 3668 2026-04-17_0eacee224ba3cbc5881c39682e023ec5_elex_mafia.exe 87 PID 3060 wrote to memory of 3660 3060 4FE0.tmp 88 PID 3660 wrote to memory of 4428 3660 50EA.tmp 89 PID 4428 wrote to memory of 2392 4428 5196.tmp 90 PID 2392 wrote to memory of 4964 2392 52AF.tmp 91 PID 4964 wrote to memory of 4688 4964 53B9.tmp 92 PID 4688 wrote to memory of 3856 4688 55CC.tmp 93 PID 3856 wrote to memory of 3384 3856 56C6.tmp 94 PID 3384 wrote to memory of 4884 3384 5791.tmp 95 PID 4884 wrote to memory of 1308 4884 585C.tmp 96 PID 1308 wrote to memory of 3028 1308 5927.tmp 97 PID 3028 wrote to memory of 2616 3028 59C3.tmp 98 PID 2616 wrote to memory of 4968 2616 5AFC.tmp 99 PID 4968 wrote to memory of 2680 4968 5B79.tmp 100 PID 2680 wrote to memory of 1548 2680 5C83.tmp 101 PID 1548 wrote to memory of 4216 1548 5D5D.tmp 102 PID 4216 wrote to memory of 4212 4216 5E38.tmp 103 PID 4212 wrote to memory of 1536 4212 5F13.tmp 104 PID 1536 wrote to memory of 3044 1536 5FCE.tmp 105 PID 3044 wrote to memory of 1656 3044 60A9.tmp 106 PID 1656 wrote to memory of 4624 1656 6174.tmp 107 PID 4624 wrote to memory of 2556 4624 626E.tmp 108 PID 2556 wrote to memory of 4332 2556 6368.tmp 109 PID 4332 wrote to memory of 2864 4332 6453.tmp 110 PID 2864 wrote to memory of 2500 2864 658B.tmp 111 PID 2500 wrote to memory of 4592 2500 6656.tmp 112 PID 4592 wrote to memory of 4872 4592 6760.tmp 113 PID 4872 wrote to memory of 3296 4872 6879.tmp 114 PID 3296 wrote to memory of 1384 3296 6954.tmp 115 PID 1384 wrote to memory of 2000 1384 6A3E.tmp 116 PID 2000 wrote to memory of 1492 2000 6B48.tmp 117 PID 1492 wrote to memory of 2580 1492 6C13.tmp 118 PID 2580 wrote to memory of 3784 2580 6CCE.tmp 119 PID 3784 wrote to memory of 4768 3784 6DC8.tmp 120 PID 4768 wrote to memory of 3812 4768 6E65.tmp 121 PID 3812 wrote to memory of 1768 3812 6EC2.tmp 122 PID 1768 wrote to memory of 3804 1768 6F8E.tmp 123 PID 3804 wrote to memory of 1364 3804 7039.tmp 124 PID 1364 wrote to memory of 4784 1364 70E5.tmp 125 PID 4784 wrote to memory of 4036 4784 7162.tmp 126 PID 4036 wrote to memory of 3196 4036 71DF.tmp 127 PID 3196 wrote to memory of 376 3196 724D.tmp 128 PID 376 wrote to memory of 3008 376 72D9.tmp 129 PID 3008 wrote to memory of 5060 3008 7366.tmp 130 PID 5060 wrote to memory of 1156 5060 7402.tmp 131 PID 1156 wrote to memory of 3680 1156 748F.tmp 132 PID 3680 wrote to memory of 4384 3680 74FC.tmp 133 PID 4384 wrote to memory of 2784 4384 7579.tmp 134 PID 2784 wrote to memory of 1252 2784 75E7.tmp 135 PID 1252 wrote to memory of 1608 1252 76A2.tmp 136 PID 1608 wrote to memory of 632 1608 772F.tmp 137 PID 632 wrote to memory of 3080 632 77BB.tmp 138 PID 3080 wrote to memory of 4724 3080 7867.tmp 139 PID 4724 wrote to memory of 2344 4724 78F4.tmp 140 PID 2344 wrote to memory of 2220 2344 7961.tmp 141 PID 2220 wrote to memory of 1540 2220 79DE.tmp 142 PID 1540 wrote to memory of 2780 1540 7AB9.tmp 143 PID 2780 wrote to memory of 4652 2780 7B74.tmp 144 PID 4652 wrote to memory of 3388 4652 7BE2.tmp 145 PID 3388 wrote to memory of 1512 3388 7C4F.tmp 146 PID 1512 wrote to memory of 3968 1512 7CDC.tmp 147 PID 3968 wrote to memory of 4000 3968 7D59.tmp 148 PID 4000 wrote to memory of 1184 4000 7DE5.tmp 149 PID 1184 wrote to memory of 2592 1184 7E62.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_0eacee224ba3cbc5881c39682e023ec5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_0eacee224ba3cbc5881c39682e023ec5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\53B9.tmp"C:\Users\Admin\AppData\Local\Temp\53B9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\6760.tmp"C:\Users\Admin\AppData\Local\Temp\6760.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\6879.tmp"C:\Users\Admin\AppData\Local\Temp\6879.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\7366.tmp"C:\Users\Admin\AppData\Local\Temp\7366.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\748F.tmp"C:\Users\Admin\AppData\Local\Temp\748F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\772F.tmp"C:\Users\Admin\AppData\Local\Temp\772F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\7961.tmp"C:\Users\Admin\AppData\Local\Temp\7961.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\7AB9.tmp"C:\Users\Admin\AppData\Local\Temp\7AB9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"65⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"66⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"67⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"68⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"69⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"70⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"71⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"72⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"73⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\8299.tmp"C:\Users\Admin\AppData\Local\Temp\8299.tmp"74⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"76⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\8383.tmp"C:\Users\Admin\AppData\Local\Temp\8383.tmp"77⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\83D1.tmp"C:\Users\Admin\AppData\Local\Temp\83D1.tmp"78⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"80⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\850A.tmp"C:\Users\Admin\AppData\Local\Temp\850A.tmp"81⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"82⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\85D5.tmp"C:\Users\Admin\AppData\Local\Temp\85D5.tmp"83⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"84⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\8690.tmp"C:\Users\Admin\AppData\Local\Temp\8690.tmp"85⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"86⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"87⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\87A9.tmp"C:\Users\Admin\AppData\Local\Temp\87A9.tmp"88⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"89⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"90⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\88C3.tmp"C:\Users\Admin\AppData\Local\Temp\88C3.tmp"91⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\8920.tmp"C:\Users\Admin\AppData\Local\Temp\8920.tmp"92⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"93⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"94⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"95⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"96⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"97⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"98⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"99⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"100⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"101⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"102⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8E41.tmp"C:\Users\Admin\AppData\Local\Temp\8E41.tmp"105⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"106⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"107⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\8F99.tmp"C:\Users\Admin\AppData\Local\Temp\8F99.tmp"108⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"110⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\90C2.tmp"C:\Users\Admin\AppData\Local\Temp\90C2.tmp"111⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"112⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"113⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\91BC.tmp"C:\Users\Admin\AppData\Local\Temp\91BC.tmp"114⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\9219.tmp"C:\Users\Admin\AppData\Local\Temp\9219.tmp"115⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"116⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"117⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"118⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\94C9.tmp"C:\Users\Admin\AppData\Local\Temp\94C9.tmp"119⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"120⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\95E2.tmp"C:\Users\Admin\AppData\Local\Temp\95E2.tmp"122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-