Analysis
- max time kernel
150s - max time network
102s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-20_94eadc290d72c63ae3e4d308bfeda3d0_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-20_94eadc290d72c63ae3e4d308bfeda3d0_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-20_94eadc290d72c63ae3e4d308bfeda3d0_elex_mafia.exe
- Size 521KB
- Sample260420-e13rqscy3z
- SHA256 7b80d30d2bc05774698c831a9db401b757f3d139096120cea2bcdd138dd7c1a0
- MD5 94eadc290d72c63ae3e4d308bfeda3d0
- SHA1 ba848b3500dd82035dd057a0e1ca1eb0e5b796b0
- SHA512 33bcf1dda1147ae35c36412f95f37535d05f3eaee171b9a8aa793fd0e2f47d431b0c50bf6743ee96d13d54e85b00c5a944835d78e1df5a70fc3a5660de37b1d3
- SSDEEP 12288:gOlvWUTES1A/HUzx3gxOHUKLtoZegTGWONZi:gOkU/1kghgtZvnONg
- TLSH T175B4E021B689C033E19301354F62EBB2683F7C259B2695C72B953A7D6EB02D1D7B470B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4636 2BBE.tmp 2212 2C4B.tmp 3676 2CC8.tmp 3868 2D26.tmp 4888 2DB2.tmp 1784 2E10.tmp 4904 2E6E.tmp 3068 2EBC.tmp 2680 2F29.tmp 3076 2F77.tmp 884 2FC5.tmp 3244 3014.tmp 2204 30A0.tmp 1240 310E.tmp 3912 318B.tmp 2560 31E8.tmp 1472 3246.tmp 3404 32A4.tmp 4308 32F2.tmp 5116 337F.tmp 1064 341B.tmp 5064 3498.tmp 4220 34E6.tmp 1780 3563.tmp 844 35F0.tmp 392 363E.tmp 2088 36BB.tmp 2472 3738.tmp 3856 37A5.tmp 1940 3822.tmp 1088 3870.tmp 348 38CE.tmp 2564 394B.tmp 4164 39A9.tmp 1372 3A06.tmp 4268 3A55.tmp 924 3AC2.tmp 1812 3B10.tmp 1484 3B5E.tmp 4788 3BAC.tmp 1592 3BFA.tmp 1608 3C58.tmp 3636 3CC6.tmp 1996 3D23.tmp 2844 3D71.tmp 1864 3DDF.tmp 3156 3E4C.tmp 4032 3EBA.tmp 3936 3F17.tmp 3368 3F65.tmp 2832 3FB4.tmp 3844 4002.tmp 4336 4050.tmp 1084 409E.tmp 3232 40EC.tmp 1420 413A.tmp 3712 4188.tmp 4820 41D6.tmp 3148 4244.tmp 1884 4292.tmp 3732 42F0.tmp 1500 434D.tmp 1944 439C.tmp 2044 43EA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 677A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 501F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4244.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 870D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4731.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 524C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4748 wrote to memory of 4636 4748 2026-04-20_94eadc290d72c63ae3e4d308bfeda3d0_elex_mafia.exe 80 PID 4636 wrote to memory of 2212 4636 2BBE.tmp 81 PID 2212 wrote to memory of 3676 2212 2C4B.tmp 82 PID 3676 wrote to memory of 3868 3676 2CC8.tmp 83 PID 3868 wrote to memory of 4888 3868 2D26.tmp 84 PID 4888 wrote to memory of 1784 4888 2DB2.tmp 85 PID 1784 wrote to memory of 4904 1784 2E10.tmp 86 PID 4904 wrote to memory of 3068 4904 2E6E.tmp 87 PID 3068 wrote to memory of 2680 3068 2EBC.tmp 88 PID 2680 wrote to memory of 3076 2680 2F29.tmp 89 PID 3076 wrote to memory of 884 3076 2F77.tmp 90 PID 884 wrote to memory of 3244 884 2FC5.tmp 91 PID 3244 wrote to memory of 2204 3244 3014.tmp 92 PID 2204 wrote to memory of 1240 2204 30A0.tmp 93 PID 1240 wrote to memory of 3912 1240 310E.tmp 94 PID 3912 wrote to memory of 2560 3912 318B.tmp 95 PID 2560 wrote to memory of 1472 2560 31E8.tmp 96 PID 1472 wrote to memory of 3404 1472 3246.tmp 97 PID 3404 wrote to memory of 4308 3404 32A4.tmp 98 PID 4308 wrote to memory of 5116 4308 32F2.tmp 99 PID 5116 wrote to memory of 1064 5116 337F.tmp 100 PID 1064 wrote to memory of 5064 1064 341B.tmp 101 PID 5064 wrote to memory of 4220 5064 3498.tmp 102 PID 4220 wrote to memory of 1780 4220 34E6.tmp 103 PID 1780 wrote to memory of 844 1780 3563.tmp 104 PID 844 wrote to memory of 392 844 35F0.tmp 105 PID 392 wrote to memory of 2088 392 363E.tmp 106 PID 2088 wrote to memory of 2472 2088 36BB.tmp 107 PID 2472 wrote to memory of 3856 2472 3738.tmp 108 PID 3856 wrote to memory of 1940 3856 37A5.tmp 109 PID 1940 wrote to memory of 1088 1940 3822.tmp 110 PID 1088 wrote to memory of 348 1088 3870.tmp 111 PID 348 wrote to memory of 2564 348 38CE.tmp 112 PID 2564 wrote to memory of 4164 2564 394B.tmp 113 PID 4164 wrote to memory of 1372 4164 39A9.tmp 114 PID 1372 wrote to memory of 4268 1372 3A06.tmp 115 PID 4268 wrote to memory of 924 4268 3A55.tmp 116 PID 924 wrote to memory of 1812 924 3AC2.tmp 117 PID 1812 wrote to memory of 1484 1812 3B10.tmp 118 PID 1484 wrote to memory of 4788 1484 3B5E.tmp 119 PID 4788 wrote to memory of 1592 4788 3BAC.tmp 120 PID 1592 wrote to memory of 1608 1592 3BFA.tmp 121 PID 1608 wrote to memory of 3636 1608 3C58.tmp 122 PID 3636 wrote to memory of 1996 3636 3CC6.tmp 123 PID 1996 wrote to memory of 2844 1996 3D23.tmp 124 PID 2844 wrote to memory of 1864 2844 3D71.tmp 125 PID 1864 wrote to memory of 3156 1864 3DDF.tmp 126 PID 3156 wrote to memory of 4032 3156 3E4C.tmp 127 PID 4032 wrote to memory of 3936 4032 3EBA.tmp 128 PID 3936 wrote to memory of 3368 3936 3F17.tmp 129 PID 3368 wrote to memory of 2832 3368 3F65.tmp 130 PID 2832 wrote to memory of 3844 2832 3FB4.tmp 131 PID 3844 wrote to memory of 4336 3844 4002.tmp 132 PID 4336 wrote to memory of 1084 4336 4050.tmp 133 PID 1084 wrote to memory of 3232 1084 409E.tmp 134 PID 3232 wrote to memory of 1420 3232 40EC.tmp 135 PID 1420 wrote to memory of 3712 1420 413A.tmp 136 PID 3712 wrote to memory of 4820 3712 4188.tmp 137 PID 4820 wrote to memory of 3148 4820 41D6.tmp 138 PID 3148 wrote to memory of 1884 3148 4244.tmp 139 PID 1884 wrote to memory of 3732 1884 4292.tmp 140 PID 3732 wrote to memory of 1500 3732 42F0.tmp 141 PID 1500 wrote to memory of 1944 1500 434D.tmp 142 PID 1944 wrote to memory of 2044 1944 439C.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_94eadc290d72c63ae3e4d308bfeda3d0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_94eadc290d72c63ae3e4d308bfeda3d0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\37A5.tmp"C:\Users\Admin\AppData\Local\Temp\37A5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\434D.tmp"C:\Users\Admin\AppData\Local\Temp\434D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"65⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"66⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"67⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"68⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"69⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"70⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"71⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"72⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"73⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"74⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"75⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"76⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"77⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"78⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"79⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"80⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"81⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"82⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"83⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"84⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"85⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"86⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"87⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"88⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"89⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"90⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"91⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"92⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"93⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"94⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"95⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"96⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"97⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"98⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"99⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"100⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"101⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"103⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"104⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"105⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"106⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"108⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"109⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"110⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"111⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"112⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"113⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"114⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"115⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"116⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"117⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"118⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"119⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"120⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"121⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"122⤵PID:1316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-