Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_e59904f664654012dbed99ffd645bedf_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_e59904f664654012dbed99ffd645bedf_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-19_e59904f664654012dbed99ffd645bedf_elex_mafia.exe
- Size 518KB
- Sample260419-tybb2abz4t
- SHA256 d8f948dbdc7faeab835b154f45b36d3047cc13f92edb6b9c9a79b15cb3484961
- MD5 e59904f664654012dbed99ffd645bedf
- SHA1 22058606350e3710589594ad01fd4d33000835c1
- SHA512 b87ca945b153025606d1f7c9f2e5569277c95a8a6e7cf1a08cfeb3995827fb21bfa47a06baa7bdb9326311a8978c98dbc2b876bd1a1e7f6b5686ede91992293c
- SSDEEP 12288:anTpha1Jvu4k3BqhH+nfisdO6E5sOokMNZ:any1E4k3G+nKsdg5szFN
- TLSH T176B4F111B589C032F1D211388B66EBA6593E7C319B25A4C77BC4367EAFB12C1D27931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4828 2565.tmp 4624 25F2.tmp 4436 2650.tmp 5548 26BD.tmp 3812 273A.tmp 4800 2788.tmp 2948 2815.tmp 1940 2892.tmp 3320 28E0.tmp 3236 295D.tmp 5056 29BB.tmp 5844 2A38.tmp 4860 2AA5.tmp 3500 2B03.tmp 6004 2B60.tmp 5032 2BCE.tmp 5576 2C2C.tmp 5144 2C99.tmp 400 2CE7.tmp 3768 2D64.tmp 4752 2DC2.tmp 5484 2E3F.tmp 4072 2EBC.tmp 5112 2F39.tmp 5180 2FB6.tmp 3024 3023.tmp 5800 3091.tmp 2352 30FE.tmp 4504 316B.tmp 2224 31F8.tmp 6088 3265.tmp 5404 32D3.tmp 5452 3340.tmp 636 339E.tmp 6016 33FC.tmp 4832 3459.tmp 2268 34B7.tmp 5988 3505.tmp 4236 3553.tmp 4824 35B1.tmp 1244 35FF.tmp 6020 365D.tmp 5200 36AB.tmp 5068 36EA.tmp 3440 3738.tmp 3296 3795.tmp 3316 37F3.tmp 3928 3841.tmp 3008 388F.tmp 4920 38DE.tmp 1960 392C.tmp 2780 3989.tmp 3496 39D8.tmp 2264 3A35.tmp 5272 3A83.tmp 2536 3AE1.tmp 404 3B2F.tmp 392 3B8D.tmp 1788 3BEB.tmp 5292 3C29.tmp 1680 3C77.tmp 648 3CC6.tmp 1312 3D14.tmp 3356 3D52.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6911.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 4828 4608 2026-04-19_e59904f664654012dbed99ffd645bedf_elex_mafia.exe 84 PID 4828 wrote to memory of 4624 4828 2565.tmp 85 PID 4624 wrote to memory of 4436 4624 25F2.tmp 86 PID 4436 wrote to memory of 5548 4436 2650.tmp 87 PID 5548 wrote to memory of 3812 5548 26BD.tmp 88 PID 3812 wrote to memory of 4800 3812 273A.tmp 89 PID 4800 wrote to memory of 2948 4800 2788.tmp 90 PID 2948 wrote to memory of 1940 2948 2815.tmp 91 PID 1940 wrote to memory of 3320 1940 2892.tmp 92 PID 3320 wrote to memory of 3236 3320 28E0.tmp 93 PID 3236 wrote to memory of 5056 3236 295D.tmp 94 PID 5056 wrote to memory of 5844 5056 29BB.tmp 95 PID 5844 wrote to memory of 4860 5844 2A38.tmp 96 PID 4860 wrote to memory of 3500 4860 2AA5.tmp 97 PID 3500 wrote to memory of 6004 3500 2B03.tmp 98 PID 6004 wrote to memory of 5032 6004 2B60.tmp 99 PID 5032 wrote to memory of 5576 5032 2BCE.tmp 100 PID 5576 wrote to memory of 5144 5576 2C2C.tmp 101 PID 5144 wrote to memory of 400 5144 2C99.tmp 102 PID 400 wrote to memory of 3768 400 2CE7.tmp 103 PID 3768 wrote to memory of 4752 3768 2D64.tmp 104 PID 4752 wrote to memory of 5484 4752 2DC2.tmp 105 PID 5484 wrote to memory of 4072 5484 2E3F.tmp 106 PID 4072 wrote to memory of 5112 4072 2EBC.tmp 107 PID 5112 wrote to memory of 5180 5112 2F39.tmp 108 PID 5180 wrote to memory of 3024 5180 2FB6.tmp 109 PID 3024 wrote to memory of 5800 3024 3023.tmp 110 PID 5800 wrote to memory of 2352 5800 3091.tmp 111 PID 2352 wrote to memory of 4504 2352 30FE.tmp 112 PID 4504 wrote to memory of 2224 4504 316B.tmp 113 PID 2224 wrote to memory of 6088 2224 31F8.tmp 114 PID 6088 wrote to memory of 5404 6088 3265.tmp 115 PID 5404 wrote to memory of 5452 5404 32D3.tmp 116 PID 5452 wrote to memory of 636 5452 3340.tmp 117 PID 636 wrote to memory of 6016 636 339E.tmp 118 PID 6016 wrote to memory of 4832 6016 33FC.tmp 119 PID 4832 wrote to memory of 2268 4832 3459.tmp 120 PID 2268 wrote to memory of 5988 2268 34B7.tmp 121 PID 5988 wrote to memory of 4236 5988 3505.tmp 122 PID 4236 wrote to memory of 4824 4236 3553.tmp 123 PID 4824 wrote to memory of 1244 4824 35B1.tmp 124 PID 1244 wrote to memory of 6020 1244 35FF.tmp 125 PID 6020 wrote to memory of 5200 6020 365D.tmp 126 PID 5200 wrote to memory of 5068 5200 36AB.tmp 127 PID 5068 wrote to memory of 3440 5068 36EA.tmp 128 PID 3440 wrote to memory of 3296 3440 3738.tmp 129 PID 3296 wrote to memory of 3316 3296 3795.tmp 130 PID 3316 wrote to memory of 3928 3316 37F3.tmp 131 PID 3928 wrote to memory of 3008 3928 3841.tmp 132 PID 3008 wrote to memory of 4920 3008 388F.tmp 133 PID 4920 wrote to memory of 1960 4920 38DE.tmp 134 PID 1960 wrote to memory of 2780 1960 392C.tmp 135 PID 2780 wrote to memory of 3496 2780 3989.tmp 136 PID 3496 wrote to memory of 2264 3496 39D8.tmp 137 PID 2264 wrote to memory of 5272 2264 3A35.tmp 138 PID 5272 wrote to memory of 2536 5272 3A83.tmp 139 PID 2536 wrote to memory of 404 2536 3AE1.tmp 140 PID 404 wrote to memory of 392 404 3B2F.tmp 141 PID 392 wrote to memory of 1788 392 3B8D.tmp 142 PID 1788 wrote to memory of 5292 1788 3BEB.tmp 143 PID 5292 wrote to memory of 1680 5292 3C29.tmp 144 PID 1680 wrote to memory of 648 1680 3C77.tmp 145 PID 648 wrote to memory of 1312 648 3CC6.tmp 146 PID 1312 wrote to memory of 3356 1312 3D14.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_e59904f664654012dbed99ffd645bedf_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_e59904f664654012dbed99ffd645bedf_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\3C77.tmp"C:\Users\Admin\AppData\Local\Temp\3C77.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"65⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"66⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"67⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"68⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"69⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"70⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"71⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"72⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"73⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"74⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"75⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"76⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"77⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"78⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"79⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"80⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"81⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"82⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"84⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"85⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"86⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"87⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"88⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"90⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"91⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"92⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"93⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"94⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"95⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"96⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"97⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"98⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"99⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"100⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"101⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"102⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"104⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"105⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"106⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"107⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"108⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"109⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"110⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"111⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"112⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"113⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"114⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"115⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"116⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"118⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"119⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"120⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"121⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"122⤵PID:3240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-