Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 12:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_533d05e03eb8aed156173421371a055a_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_533d05e03eb8aed156173421371a055a_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-23_533d05e03eb8aed156173421371a055a_elex_mafia.exe
- Size 518KB
- Sample260423-n9dnmscs7w
- SHA256 3c9495f9a75d906e55a8f1641c86434212fc29c0c5a7db27258f2098d24c9ba5
- MD5 533d05e03eb8aed156173421371a055a
- SHA1 2ff2f8cb92cb0a856645b99c044cd3c1bf9923b0
- SHA512 36c77560b580993dde56b5c62cc4aa706c479d1954b562650e744ecf4f2f0a17cf8bc20913956ffc6ab1dcd7f5795779d31e69c3f37e211c69d2a530cb8f4f83
- SSDEEP 12288:Jf1yBOtIZdpH+IKeyGmVQVkNmMktvpu917kdArRyxPN1+NZ:JfcBzZdcIKVGmmHDu91YCrVN
- TLSH T1EBB4F115B984C036E5D202318A11EBA24D3A7D759B36A4CBBBD426BD6FF03C2D639347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5100 7C9D.tmp 3964 7D2A.tmp 1524 7DA7.tmp 4212 7E62.tmp 4336 7EFF.tmp 3768 7F8B.tmp 4796 8018.tmp 3912 80A5.tmp 3848 8112.tmp 556 817F.tmp 4312 820C.tmp 1436 8279.tmp 4608 8306.tmp 3108 8373.tmp 1688 8400.tmp 3760 845E.tmp 2352 8519.tmp 2540 85B5.tmp 2284 8652.tmp 1416 86BF.tmp 1556 873C.tmp 4932 87A9.tmp 632 8846.tmp 1868 88C3.tmp 1740 894F.tmp 1484 89EC.tmp 1512 8A59.tmp 3028 8AF5.tmp 308 8B72.tmp 4980 8BEF.tmp 3464 8C7C.tmp 4548 8CE9.tmp 4828 8D57.tmp 3124 8DB4.tmp 2064 8E02.tmp 4832 8E41.tmp 4128 8EAE.tmp 2400 8F0C.tmp 2760 8F79.tmp 700 8FD7.tmp 920 9025.tmp 2732 9093.tmp 4204 90F0.tmp 4052 915E.tmp 4628 91AC.tmp 1700 91FA.tmp 1880 9258.tmp 1996 92C5.tmp 1028 9313.tmp 1156 9352.tmp 4284 93BF.tmp 4328 940D.tmp 2836 945B.tmp 3668 94B9.tmp 4736 9507.tmp 3460 9555.tmp 1044 95A4.tmp 1864 95F2.tmp 1692 964F.tmp 3820 969E.tmp 1984 970B.tmp 1208 9759.tmp 1916 97B7.tmp 8 97F5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8311.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 5100 1964 2026-04-23_533d05e03eb8aed156173421371a055a_elex_mafia.exe 84 PID 5100 wrote to memory of 3964 5100 7C9D.tmp 85 PID 3964 wrote to memory of 1524 3964 7D2A.tmp 86 PID 1524 wrote to memory of 4212 1524 7DA7.tmp 87 PID 4212 wrote to memory of 4336 4212 7E62.tmp 88 PID 4336 wrote to memory of 3768 4336 7EFF.tmp 89 PID 3768 wrote to memory of 4796 3768 7F8B.tmp 90 PID 4796 wrote to memory of 3912 4796 8018.tmp 91 PID 3912 wrote to memory of 3848 3912 80A5.tmp 92 PID 3848 wrote to memory of 556 3848 8112.tmp 93 PID 556 wrote to memory of 4312 556 817F.tmp 94 PID 4312 wrote to memory of 1436 4312 820C.tmp 95 PID 1436 wrote to memory of 4608 1436 8279.tmp 96 PID 4608 wrote to memory of 3108 4608 8306.tmp 97 PID 3108 wrote to memory of 1688 3108 8373.tmp 98 PID 1688 wrote to memory of 3760 1688 8400.tmp 99 PID 3760 wrote to memory of 2352 3760 845E.tmp 100 PID 2352 wrote to memory of 2540 2352 8519.tmp 101 PID 2540 wrote to memory of 2284 2540 85B5.tmp 102 PID 2284 wrote to memory of 1416 2284 8652.tmp 103 PID 1416 wrote to memory of 1556 1416 86BF.tmp 104 PID 1556 wrote to memory of 4932 1556 873C.tmp 105 PID 4932 wrote to memory of 632 4932 87A9.tmp 106 PID 632 wrote to memory of 1868 632 8846.tmp 107 PID 1868 wrote to memory of 1740 1868 88C3.tmp 108 PID 1740 wrote to memory of 1484 1740 894F.tmp 109 PID 1484 wrote to memory of 1512 1484 89EC.tmp 110 PID 1512 wrote to memory of 3028 1512 8A59.tmp 111 PID 3028 wrote to memory of 308 3028 8AF5.tmp 112 PID 308 wrote to memory of 4980 308 8B72.tmp 113 PID 4980 wrote to memory of 3464 4980 8BEF.tmp 114 PID 3464 wrote to memory of 4548 3464 8C7C.tmp 115 PID 4548 wrote to memory of 4828 4548 8CE9.tmp 116 PID 4828 wrote to memory of 3124 4828 8D57.tmp 117 PID 3124 wrote to memory of 2064 3124 8DB4.tmp 118 PID 2064 wrote to memory of 4832 2064 8E02.tmp 119 PID 4832 wrote to memory of 4128 4832 8E41.tmp 120 PID 4128 wrote to memory of 2400 4128 8EAE.tmp 121 PID 2400 wrote to memory of 2760 2400 8F0C.tmp 122 PID 2760 wrote to memory of 700 2760 8F79.tmp 123 PID 700 wrote to memory of 920 700 8FD7.tmp 124 PID 920 wrote to memory of 2732 920 9025.tmp 125 PID 2732 wrote to memory of 4204 2732 9093.tmp 126 PID 4204 wrote to memory of 4052 4204 90F0.tmp 127 PID 4052 wrote to memory of 4628 4052 915E.tmp 128 PID 4628 wrote to memory of 1700 4628 91AC.tmp 129 PID 1700 wrote to memory of 1880 1700 91FA.tmp 130 PID 1880 wrote to memory of 1996 1880 9258.tmp 131 PID 1996 wrote to memory of 1028 1996 92C5.tmp 132 PID 1028 wrote to memory of 1156 1028 9313.tmp 133 PID 1156 wrote to memory of 4284 1156 9352.tmp 134 PID 4284 wrote to memory of 4328 4284 93BF.tmp 135 PID 4328 wrote to memory of 2836 4328 940D.tmp 136 PID 2836 wrote to memory of 3668 2836 945B.tmp 137 PID 3668 wrote to memory of 4736 3668 94B9.tmp 138 PID 4736 wrote to memory of 3460 4736 9507.tmp 139 PID 3460 wrote to memory of 1044 3460 9555.tmp 140 PID 1044 wrote to memory of 1864 1044 95A4.tmp 141 PID 1864 wrote to memory of 1692 1864 95F2.tmp 142 PID 1692 wrote to memory of 3820 1692 964F.tmp 143 PID 3820 wrote to memory of 1984 3820 969E.tmp 144 PID 1984 wrote to memory of 1208 1984 970B.tmp 145 PID 1208 wrote to memory of 1916 1208 9759.tmp 146 PID 1916 wrote to memory of 8 1916 97B7.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_533d05e03eb8aed156173421371a055a_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_533d05e03eb8aed156173421371a055a_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\7D2A.tmp"C:\Users\Admin\AppData\Local\Temp\7D2A.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\8306.tmp"C:\Users\Admin\AppData\Local\Temp\8306.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\87A9.tmp"C:\Users\Admin\AppData\Local\Temp\87A9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8846.tmp"C:\Users\Admin\AppData\Local\Temp\8846.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\88C3.tmp"C:\Users\Admin\AppData\Local\Temp\88C3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\8B72.tmp"C:\Users\Admin\AppData\Local\Temp\8B72.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"C:\Users\Admin\AppData\Local\Temp\8CE9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\8E02.tmp"C:\Users\Admin\AppData\Local\Temp\8E02.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\8E41.tmp"C:\Users\Admin\AppData\Local\Temp\8E41.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\9025.tmp"C:\Users\Admin\AppData\Local\Temp\9025.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9093.tmp"C:\Users\Admin\AppData\Local\Temp\9093.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\92C5.tmp"C:\Users\Admin\AppData\Local\Temp\92C5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9313.tmp"C:\Users\Admin\AppData\Local\Temp\9313.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\93BF.tmp"C:\Users\Admin\AppData\Local\Temp\93BF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\940D.tmp"C:\Users\Admin\AppData\Local\Temp\940D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\9507.tmp"C:\Users\Admin\AppData\Local\Temp\9507.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\95A4.tmp"C:\Users\Admin\AppData\Local\Temp\95A4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\95F2.tmp"C:\Users\Admin\AppData\Local\Temp\95F2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\964F.tmp"C:\Users\Admin\AppData\Local\Temp\964F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"65⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"66⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\98B1.tmp"C:\Users\Admin\AppData\Local\Temp\98B1.tmp"67⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"68⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\995D.tmp"C:\Users\Admin\AppData\Local\Temp\995D.tmp"69⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\99AB.tmp"C:\Users\Admin\AppData\Local\Temp\99AB.tmp"70⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\99F9.tmp"C:\Users\Admin\AppData\Local\Temp\99F9.tmp"71⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\9A57.tmp"C:\Users\Admin\AppData\Local\Temp\9A57.tmp"72⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"73⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"74⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"75⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"76⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"77⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"78⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"79⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"80⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"81⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"C:\Users\Admin\AppData\Local\Temp\9DA2.tmp"82⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"C:\Users\Admin\AppData\Local\Temp\9DF1.tmp"83⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"84⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"C:\Users\Admin\AppData\Local\Temp\9E8D.tmp"85⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"86⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\9F19.tmp"C:\Users\Admin\AppData\Local\Temp\9F19.tmp"87⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"88⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"89⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"90⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\A062.tmp"C:\Users\Admin\AppData\Local\Temp\A062.tmp"91⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"92⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"93⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\A16B.tmp"C:\Users\Admin\AppData\Local\Temp\A16B.tmp"94⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"95⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A207.tmp"C:\Users\Admin\AppData\Local\Temp\A207.tmp"96⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\A265.tmp"C:\Users\Admin\AppData\Local\Temp\A265.tmp"97⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"98⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"99⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\A350.tmp"C:\Users\Admin\AppData\Local\Temp\A350.tmp"100⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"101⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"102⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\A44A.tmp"C:\Users\Admin\AppData\Local\Temp\A44A.tmp"103⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\A488.tmp"C:\Users\Admin\AppData\Local\Temp\A488.tmp"104⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A524.tmp"C:\Users\Admin\AppData\Local\Temp\A524.tmp"106⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A572.tmp"C:\Users\Admin\AppData\Local\Temp\A572.tmp"107⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"108⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"109⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\A66C.tmp"C:\Users\Admin\AppData\Local\Temp\A66C.tmp"110⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"111⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"112⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"113⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"114⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"115⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\A851.tmp"C:\Users\Admin\AppData\Local\Temp\A851.tmp"116⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"117⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"118⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"119⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"120⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"121⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"122⤵PID:4172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-