Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_bfceb4fc6c9a426132785149b8ebae59_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_bfceb4fc6c9a426132785149b8ebae59_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-03_bfceb4fc6c9a426132785149b8ebae59_elex_mafia.exe
- Size 524KB
- Sample260503-vx752sh16m
- SHA256 078d4e66c72f7969fd025d7b8e519eea34b227e898975727afdc6da82054f0af
- MD5 bfceb4fc6c9a426132785149b8ebae59
- SHA1 21a1fbe520766b5af8839e49889502a387c84811
- SHA512 f922d565a2fd1c980183255c4a1b9bda9ba74d69fbd7d50f06d471c3a485f2eafc8fdc6ea8581a9d3e2ea222b5262e1b212fd6be0e42fd0e20fe0c5606a6e7f6
- SSDEEP 12288:TRyZzqyL66TIPMvH4d1KzGxLY+fYAl8NZ:TRyQylTIUvH4nKzahf5aN
- TLSH T180B4F1167985C432E6D201728F62EB92597B7C71AB36A4C73B843A7D6EF03E19274313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4904 F973.tmp 660 F9C1.tmp 4452 FA0F.tmp 4384 FA6D.tmp 1816 FABB.tmp 3796 FB09.tmp 2416 FBA6.tmp 884 FC23.tmp 544 FC90.tmp 3472 FCDE.tmp 4408 FD5B.tmp 3952 FDB9.tmp 60 FE17.tmp 5712 FE65.tmp 3772 FED2.tmp 2728 FF20.tmp 6132 FF6E.tmp 5160 FFDC.tmp 3780 2A.tmp 5708 88.tmp 3968 E5.tmp 4196 153.tmp 5060 1B1.tmp 1100 1FF.tmp 2044 28B.tmp 636 376.tmp 5868 3E3.tmp 4696 431.tmp 4224 47F.tmp 6092 51C.tmp 6032 5C7.tmp 5756 635.tmp 1712 693.tmp 5896 710.tmp 3236 78D.tmp 1336 7EA.tmp 4376 848.tmp 2660 8B5.tmp 3208 904.tmp 1228 9A0.tmp 5780 9EE.tmp 3108 A4C.tmp 5384 AA9.tmp 1716 AF8.tmp 3604 B46.tmp 220 BA3.tmp 3740 BF2.tmp 3200 C4F.tmp 1628 C9D.tmp 5256 CEC.tmp 3328 D3A.tmp 4404 D88.tmp 5016 DD6.tmp 4572 E34.tmp 5888 E82.tmp 5492 ED0.tmp 1960 F1E.tmp 568 F6C.tmp 2376 FBA.tmp 1796 1018.tmp 2688 1085.tmp 6116 10D4.tmp 2996 1122.tmp 1512 117F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8940.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 117F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 525C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C57E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 756A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F170.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F98E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7606.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CD5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4904 4784 2026-05-03_bfceb4fc6c9a426132785149b8ebae59_elex_mafia.exe 85 PID 4904 wrote to memory of 660 4904 F973.tmp 86 PID 660 wrote to memory of 4452 660 F9C1.tmp 87 PID 4452 wrote to memory of 4384 4452 FA0F.tmp 88 PID 4384 wrote to memory of 1816 4384 FA6D.tmp 89 PID 1816 wrote to memory of 3796 1816 FABB.tmp 90 PID 3796 wrote to memory of 2416 3796 FB09.tmp 91 PID 2416 wrote to memory of 884 2416 FBA6.tmp 92 PID 884 wrote to memory of 544 884 FC23.tmp 93 PID 544 wrote to memory of 3472 544 FC90.tmp 94 PID 3472 wrote to memory of 4408 3472 FCDE.tmp 96 PID 4408 wrote to memory of 3952 4408 FD5B.tmp 97 PID 3952 wrote to memory of 60 3952 FDB9.tmp 98 PID 60 wrote to memory of 5712 60 FE17.tmp 99 PID 5712 wrote to memory of 3772 5712 FE65.tmp 100 PID 3772 wrote to memory of 2728 3772 FED2.tmp 101 PID 2728 wrote to memory of 6132 2728 FF20.tmp 102 PID 6132 wrote to memory of 5160 6132 FF6E.tmp 103 PID 5160 wrote to memory of 3780 5160 FFDC.tmp 104 PID 3780 wrote to memory of 5708 3780 2A.tmp 105 PID 5708 wrote to memory of 3968 5708 88.tmp 106 PID 3968 wrote to memory of 4196 3968 E5.tmp 107 PID 4196 wrote to memory of 5060 4196 153.tmp 108 PID 5060 wrote to memory of 1100 5060 1B1.tmp 109 PID 1100 wrote to memory of 2044 1100 1FF.tmp 110 PID 2044 wrote to memory of 636 2044 28B.tmp 111 PID 636 wrote to memory of 5868 636 376.tmp 112 PID 5868 wrote to memory of 4696 5868 3E3.tmp 113 PID 4696 wrote to memory of 4224 4696 431.tmp 114 PID 4224 wrote to memory of 6092 4224 47F.tmp 115 PID 6092 wrote to memory of 6032 6092 51C.tmp 116 PID 6032 wrote to memory of 5756 6032 5C7.tmp 117 PID 5756 wrote to memory of 1712 5756 635.tmp 118 PID 1712 wrote to memory of 5896 1712 693.tmp 121 PID 5896 wrote to memory of 3236 5896 710.tmp 122 PID 3236 wrote to memory of 1336 3236 78D.tmp 123 PID 1336 wrote to memory of 4376 1336 7EA.tmp 124 PID 4376 wrote to memory of 2660 4376 848.tmp 125 PID 2660 wrote to memory of 3208 2660 8B5.tmp 126 PID 3208 wrote to memory of 1228 3208 904.tmp 127 PID 1228 wrote to memory of 5780 1228 9A0.tmp 128 PID 5780 wrote to memory of 3108 5780 9EE.tmp 129 PID 3108 wrote to memory of 5384 3108 A4C.tmp 130 PID 5384 wrote to memory of 1716 5384 AA9.tmp 131 PID 1716 wrote to memory of 3604 1716 AF8.tmp 134 PID 3604 wrote to memory of 220 3604 B46.tmp 136 PID 220 wrote to memory of 3740 220 BA3.tmp 137 PID 3740 wrote to memory of 3200 3740 BF2.tmp 138 PID 3200 wrote to memory of 1628 3200 C4F.tmp 139 PID 1628 wrote to memory of 5256 1628 C9D.tmp 140 PID 5256 wrote to memory of 3328 5256 CEC.tmp 141 PID 3328 wrote to memory of 4404 3328 D3A.tmp 142 PID 4404 wrote to memory of 5016 4404 D88.tmp 143 PID 5016 wrote to memory of 4572 5016 DD6.tmp 144 PID 4572 wrote to memory of 5888 4572 E34.tmp 145 PID 5888 wrote to memory of 5492 5888 E82.tmp 146 PID 5492 wrote to memory of 1960 5492 ED0.tmp 147 PID 1960 wrote to memory of 568 1960 F1E.tmp 148 PID 568 wrote to memory of 2376 568 F6C.tmp 149 PID 2376 wrote to memory of 1796 2376 FBA.tmp 150 PID 1796 wrote to memory of 2688 1796 1018.tmp 151 PID 2688 wrote to memory of 6116 2688 1085.tmp 152 PID 6116 wrote to memory of 2996 6116 10D4.tmp 153 PID 2996 wrote to memory of 1512 2996 1122.tmp 154
Processes
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_bfceb4fc6c9a426132785149b8ebae59_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_bfceb4fc6c9a426132785149b8ebae59_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"66⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"67⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"68⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"69⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"70⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"72⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"73⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"74⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"75⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"76⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"77⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\1596.tmp"C:\Users\Admin\AppData\Local\Temp\1596.tmp"78⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"79⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"80⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"81⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"82⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"83⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"84⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"85⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"86⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"87⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"88⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"89⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"90⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"91⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"92⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"93⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"94⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"95⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"96⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"97⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"98⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"99⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"100⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"101⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"102⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"103⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"104⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"105⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"106⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"107⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"108⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"109⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"110⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"111⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"112⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"114⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"115⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"116⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"117⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"118⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"119⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"120⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"121⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"122⤵PID:3448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-