Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_50c5cfcfc81d008c6717f9d79525d6ba_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_50c5cfcfc81d008c6717f9d79525d6ba_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-19_50c5cfcfc81d008c6717f9d79525d6ba_elex_mafia.exe
- Size 581KB
- Sample260419-vdaqfaez6n
- SHA256 efa2b2caa17d47d6541ec3873d76d269293460ccc0b7991803a852d3cb0277bd
- MD5 50c5cfcfc81d008c6717f9d79525d6ba
- SHA1 a5bfd2dcda0b22b9e468fe037684270fc5bc265b
- SHA512 de4e0b65e12b0dd70d4b41f87aef275473c2b73bfbdd6a49a5e20bfeac5dec4ee23b8e6cd7c1346cd09abda9f577f69b972fd72ac11799ee615e4348b1236759
- SSDEEP 12288:yZ355mztdeUIHsrqb/76j6vxV/DiQdJT9B3TdJKJZghqZoXWjdqW:yZ3qzaUISqbj6j6DpdJT9B3TqqGhT
- TLSH T1B5C4F120B585C036E4E206354E26EB6649BB7D339B2698CF7790772D6FB02D1E336306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5168 F6A4.tmp 5692 F78F.tmp 5064 F84A.tmp 5944 F925.tmp 3640 F9D1.tmp 1956 FA8C.tmp 1556 FB58.tmp 1248 FC13.tmp 4516 FCAF.tmp 1676 FD5B.tmp 3464 FE26.tmp 3544 FF30.tmp 2724 FFFB.tmp 6116 B7.tmp 2096 172.tmp 5384 1DF.tmp 3604 27C.tmp 5864 347.tmp 2876 422.tmp 5312 4ED.tmp 5472 616.tmp 1968 6A2.tmp 2504 76D.tmp 2768 838.tmp 456 8E4.tmp 5968 981.tmp 5508 A6B.tmp 1832 B26.tmp 3364 BD2.tmp 4188 C4F.tmp 2936 CEC.tmp 4352 DD6.tmp 4552 EB1.tmp 3820 F0E.tmp 3740 FAB.tmp 1852 1008.tmp 2332 1066.tmp 4868 10D4.tmp 1604 1160.tmp 3896 11BE.tmp 5524 124B.tmp 3004 12E7.tmp 60 1364.tmp 3484 13F0.tmp 1828 144E.tmp 3292 14AC.tmp 3184 1529.tmp 3128 15B6.tmp 4012 1652.tmp 3328 16DE.tmp 4940 174C.tmp 4836 17C9.tmp 640 1836.tmp 5460 18C3.tmp 376 1930.tmp 5744 19AD.tmp 4828 1A1B.tmp 5424 1A88.tmp 5260 1AE6.tmp 4056 1B82.tmp 5024 1BEF.tmp 3984 1C6C.tmp 2824 1CF9.tmp 1792 1D95.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2390.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 388F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5049.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C290.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 355E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 818A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 5168 412 2026-04-19_50c5cfcfc81d008c6717f9d79525d6ba_elex_mafia.exe 84 PID 5168 wrote to memory of 5692 5168 F6A4.tmp 85 PID 5692 wrote to memory of 5064 5692 F78F.tmp 86 PID 5064 wrote to memory of 5944 5064 F84A.tmp 87 PID 5944 wrote to memory of 3640 5944 F925.tmp 88 PID 3640 wrote to memory of 1956 3640 F9D1.tmp 89 PID 1956 wrote to memory of 1556 1956 FA8C.tmp 90 PID 1556 wrote to memory of 1248 1556 FB58.tmp 91 PID 1248 wrote to memory of 4516 1248 FC13.tmp 92 PID 4516 wrote to memory of 1676 4516 FCAF.tmp 93 PID 1676 wrote to memory of 3464 1676 FD5B.tmp 94 PID 3464 wrote to memory of 3544 3464 FE26.tmp 95 PID 3544 wrote to memory of 2724 3544 FF30.tmp 96 PID 2724 wrote to memory of 6116 2724 FFFB.tmp 97 PID 6116 wrote to memory of 2096 6116 B7.tmp 98 PID 2096 wrote to memory of 5384 2096 172.tmp 99 PID 5384 wrote to memory of 3604 5384 1DF.tmp 100 PID 3604 wrote to memory of 5864 3604 27C.tmp 101 PID 5864 wrote to memory of 2876 5864 347.tmp 102 PID 2876 wrote to memory of 5312 2876 422.tmp 103 PID 5312 wrote to memory of 5472 5312 4ED.tmp 104 PID 5472 wrote to memory of 1968 5472 616.tmp 105 PID 1968 wrote to memory of 2504 1968 6A2.tmp 106 PID 2504 wrote to memory of 2768 2504 76D.tmp 107 PID 2768 wrote to memory of 456 2768 838.tmp 108 PID 456 wrote to memory of 5968 456 8E4.tmp 109 PID 5968 wrote to memory of 5508 5968 981.tmp 110 PID 5508 wrote to memory of 1832 5508 A6B.tmp 111 PID 1832 wrote to memory of 3364 1832 B26.tmp 112 PID 3364 wrote to memory of 4188 3364 BD2.tmp 113 PID 4188 wrote to memory of 2936 4188 C4F.tmp 114 PID 2936 wrote to memory of 4352 2936 CEC.tmp 115 PID 4352 wrote to memory of 4552 4352 DD6.tmp 116 PID 4552 wrote to memory of 3820 4552 EB1.tmp 117 PID 3820 wrote to memory of 3740 3820 F0E.tmp 118 PID 3740 wrote to memory of 1852 3740 FAB.tmp 119 PID 1852 wrote to memory of 2332 1852 1008.tmp 120 PID 2332 wrote to memory of 4868 2332 1066.tmp 121 PID 4868 wrote to memory of 1604 4868 10D4.tmp 122 PID 1604 wrote to memory of 3896 1604 1160.tmp 123 PID 3896 wrote to memory of 5524 3896 11BE.tmp 124 PID 5524 wrote to memory of 3004 5524 124B.tmp 125 PID 3004 wrote to memory of 60 3004 12E7.tmp 126 PID 60 wrote to memory of 3484 60 1364.tmp 127 PID 3484 wrote to memory of 1828 3484 13F0.tmp 128 PID 1828 wrote to memory of 3292 1828 144E.tmp 129 PID 3292 wrote to memory of 3184 3292 14AC.tmp 130 PID 3184 wrote to memory of 3128 3184 1529.tmp 131 PID 3128 wrote to memory of 4012 3128 15B6.tmp 132 PID 4012 wrote to memory of 3328 4012 1652.tmp 133 PID 3328 wrote to memory of 4940 3328 16DE.tmp 134 PID 4940 wrote to memory of 4836 4940 174C.tmp 135 PID 4836 wrote to memory of 640 4836 17C9.tmp 136 PID 640 wrote to memory of 5460 640 1836.tmp 137 PID 5460 wrote to memory of 376 5460 18C3.tmp 138 PID 376 wrote to memory of 5744 376 1930.tmp 139 PID 5744 wrote to memory of 4828 5744 19AD.tmp 140 PID 4828 wrote to memory of 5424 4828 1A1B.tmp 141 PID 5424 wrote to memory of 5260 5424 1A88.tmp 142 PID 5260 wrote to memory of 4056 5260 1AE6.tmp 143 PID 4056 wrote to memory of 5024 4056 1B82.tmp 144 PID 5024 wrote to memory of 3984 5024 1BEF.tmp 145 PID 3984 wrote to memory of 2824 3984 1C6C.tmp 146 PID 2824 wrote to memory of 1792 2824 1CF9.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_50c5cfcfc81d008c6717f9d79525d6ba_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_50c5cfcfc81d008c6717f9d79525d6ba_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"65⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"66⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"68⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"69⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"70⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"71⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"72⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"73⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"74⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"75⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"76⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"77⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"79⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"80⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"81⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"82⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"83⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"84⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"85⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"86⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"87⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"88⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"89⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"90⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"91⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"92⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"93⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"95⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"96⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"97⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"98⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"99⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"100⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"102⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"103⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"104⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"105⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"106⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"107⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"108⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"109⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"110⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"111⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"112⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"113⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"114⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"115⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"116⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"117⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"118⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"119⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"120⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"121⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"122⤵PID:3668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-