Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-17_e8baf1511a0a1e583a0f1dca43297235_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_e8baf1511a0a1e583a0f1dca43297235_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-17_e8baf1511a0a1e583a0f1dca43297235_elex_mafia.exe
- Size 524KB
- Sample260517-nl22bsfx3v
- SHA256 15f636527efa7f2a2aec8b62a7b801c59b3e11377c21ee549d8dd6d9305bd23a
- MD5 e8baf1511a0a1e583a0f1dca43297235
- SHA1 602ba237457294f599c925e0b0fe4a12fc089b6e
- SHA512 d55bafa2e85a0c850063506dcd66881297044260000a4d2344cf9a1f4a25209158da7583ccf4e819cd2143e23f6ef5fc443b5b1699c27a805bc50c118935d34b
- SSDEEP 12288:TRyZzqyL66T2S5d2sgb3CyHzmXgoNuzlmACJAiNZ:TRyQylTJ5d2scSBNuz8VJAiN
- TLSH T19AB4F116B589C036E2D205724E26EB91597ABC75AB2765CB3BC42A3D2FF03D1E374306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3200 8FE7.tmp 3760 9296.tmp 768 9371.tmp 3496 946B.tmp 4664 9517.tmp 472 95D2.tmp 1668 969E.tmp 4836 9769.tmp 1732 97F5.tmp 3236 98B1.tmp 4172 996C.tmp 4876 99F9.tmp 1656 9A95.tmp 2792 9B60.tmp 4312 9C1C.tmp 4460 9CC8.tmp 4844 9D83.tmp 2540 9E00.tmp 4808 9EBC.tmp 1608 9F68.tmp 2880 A023.tmp 3536 A0CF.tmp 5112 A17B.tmp 4448 A236.tmp 3928 A2E2.tmp 2012 A37E.tmp 4036 A43A.tmp 3268 A4F5.tmp 4688 A5A1.tmp 4468 A65D.tmp 2336 A718.tmp 5004 A7D4.tmp 1356 A8AF.tmp 4452 A91C.tmp 660 A9A9.tmp 1288 AA35.tmp 4260 AAC2.tmp 4792 AB20.tmp 1276 ABCB.tmp 3500 AC58.tmp 3468 ACC5.tmp 2988 AD23.tmp 3936 ADB0.tmp 3216 AE1D.tmp 4992 AEAA.tmp 3740 AF36.tmp 1936 AFA4.tmp 2360 B002.tmp 3316 B08E.tmp 4316 B0DC.tmp 2412 B12A.tmp 3140 B179.tmp 4208 B1C7.tmp 216 B215.tmp 204 B263.tmp 3540 B2B1.tmp 4980 B2FF.tmp 2404 B34D.tmp 2436 B3AB.tmp 2548 B3F9.tmp 4936 B447.tmp 1592 B495.tmp 2612 B4E4.tmp 1588 B532.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5971.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A55E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E441.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 932E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E77D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2939.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4600 wrote to memory of 3200 4600 2026-05-17_e8baf1511a0a1e583a0f1dca43297235_elex_mafia.exe 87 PID 3200 wrote to memory of 3760 3200 8FE7.tmp 89 PID 3760 wrote to memory of 768 3760 9296.tmp 90 PID 768 wrote to memory of 3496 768 9371.tmp 91 PID 3496 wrote to memory of 4664 3496 946B.tmp 92 PID 4664 wrote to memory of 472 4664 9517.tmp 93 PID 472 wrote to memory of 1668 472 95D2.tmp 94 PID 1668 wrote to memory of 4836 1668 969E.tmp 95 PID 4836 wrote to memory of 1732 4836 9769.tmp 96 PID 1732 wrote to memory of 3236 1732 97F5.tmp 97 PID 3236 wrote to memory of 4172 3236 98B1.tmp 98 PID 4172 wrote to memory of 4876 4172 996C.tmp 99 PID 4876 wrote to memory of 1656 4876 99F9.tmp 100 PID 1656 wrote to memory of 2792 1656 9A95.tmp 101 PID 2792 wrote to memory of 4312 2792 9B60.tmp 102 PID 4312 wrote to memory of 4460 4312 9C1C.tmp 103 PID 4460 wrote to memory of 4844 4460 9CC8.tmp 104 PID 4844 wrote to memory of 2540 4844 9D83.tmp 105 PID 2540 wrote to memory of 4808 2540 9E00.tmp 106 PID 4808 wrote to memory of 1608 4808 9EBC.tmp 107 PID 1608 wrote to memory of 2880 1608 9F68.tmp 108 PID 2880 wrote to memory of 3536 2880 A023.tmp 109 PID 3536 wrote to memory of 5112 3536 A0CF.tmp 110 PID 5112 wrote to memory of 4448 5112 A17B.tmp 111 PID 4448 wrote to memory of 3928 4448 A236.tmp 112 PID 3928 wrote to memory of 2012 3928 A2E2.tmp 113 PID 2012 wrote to memory of 4036 2012 A37E.tmp 114 PID 4036 wrote to memory of 3268 4036 A43A.tmp 115 PID 3268 wrote to memory of 4688 3268 A4F5.tmp 116 PID 4688 wrote to memory of 4468 4688 A5A1.tmp 117 PID 4468 wrote to memory of 2336 4468 A65D.tmp 118 PID 2336 wrote to memory of 5004 2336 A718.tmp 119 PID 5004 wrote to memory of 1356 5004 A7D4.tmp 120 PID 1356 wrote to memory of 4452 1356 A8AF.tmp 121 PID 4452 wrote to memory of 660 4452 A91C.tmp 122 PID 660 wrote to memory of 1288 660 A9A9.tmp 123 PID 1288 wrote to memory of 4260 1288 AA35.tmp 124 PID 4260 wrote to memory of 4792 4260 AAC2.tmp 125 PID 4792 wrote to memory of 1276 4792 AB20.tmp 126 PID 1276 wrote to memory of 3500 1276 ABCB.tmp 127 PID 3500 wrote to memory of 3468 3500 AC58.tmp 128 PID 3468 wrote to memory of 2988 3468 ACC5.tmp 129 PID 2988 wrote to memory of 3936 2988 AD23.tmp 130 PID 3936 wrote to memory of 3216 3936 ADB0.tmp 131 PID 3216 wrote to memory of 4992 3216 AE1D.tmp 132 PID 4992 wrote to memory of 3740 4992 AEAA.tmp 133 PID 3740 wrote to memory of 1936 3740 AF36.tmp 134 PID 1936 wrote to memory of 2360 1936 AFA4.tmp 135 PID 2360 wrote to memory of 3316 2360 B002.tmp 136 PID 3316 wrote to memory of 4316 3316 B08E.tmp 137 PID 4316 wrote to memory of 2412 4316 B0DC.tmp 138 PID 2412 wrote to memory of 3140 2412 B12A.tmp 139 PID 3140 wrote to memory of 4208 3140 B179.tmp 140 PID 4208 wrote to memory of 216 4208 B1C7.tmp 141 PID 216 wrote to memory of 204 216 B215.tmp 142 PID 204 wrote to memory of 3540 204 B263.tmp 143 PID 3540 wrote to memory of 4980 3540 B2B1.tmp 144 PID 4980 wrote to memory of 2404 4980 B2FF.tmp 145 PID 2404 wrote to memory of 2436 2404 B34D.tmp 146 PID 2436 wrote to memory of 2548 2436 B3AB.tmp 147 PID 2548 wrote to memory of 4936 2548 B3F9.tmp 148 PID 4936 wrote to memory of 1592 4936 B447.tmp 149 PID 1592 wrote to memory of 2612 1592 B495.tmp 150 PID 2612 wrote to memory of 1588 2612 B4E4.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_e8baf1511a0a1e583a0f1dca43297235_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_e8baf1511a0a1e583a0f1dca43297235_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9371.tmp"C:\Users\Admin\AppData\Local\Temp\9371.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\946B.tmp"C:\Users\Admin\AppData\Local\Temp\946B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\9517.tmp"C:\Users\Admin\AppData\Local\Temp\9517.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\95D2.tmp"C:\Users\Admin\AppData\Local\Temp\95D2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\9769.tmp"C:\Users\Admin\AppData\Local\Temp\9769.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\98B1.tmp"C:\Users\Admin\AppData\Local\Temp\98B1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\996C.tmp"C:\Users\Admin\AppData\Local\Temp\996C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\99F9.tmp"C:\Users\Admin\AppData\Local\Temp\99F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"C:\Users\Admin\AppData\Local\Temp\9C1C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9D83.tmp"C:\Users\Admin\AppData\Local\Temp\9D83.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\A023.tmp"C:\Users\Admin\AppData\Local\Temp\A023.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\A17B.tmp"C:\Users\Admin\AppData\Local\Temp\A17B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A236.tmp"C:\Users\Admin\AppData\Local\Temp\A236.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\A37E.tmp"C:\Users\Admin\AppData\Local\Temp\A37E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"C:\Users\Admin\AppData\Local\Temp\A8AF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\AA35.tmp"C:\Users\Admin\AppData\Local\Temp\AA35.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\AB20.tmp"C:\Users\Admin\AppData\Local\Temp\AB20.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\AF36.tmp"C:\Users\Admin\AppData\Local\Temp\AF36.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\B002.tmp"C:\Users\Admin\AppData\Local\Temp\B002.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\B179.tmp"C:\Users\Admin\AppData\Local\Temp\B179.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\B215.tmp"C:\Users\Admin\AppData\Local\Temp\B215.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\B263.tmp"C:\Users\Admin\AppData\Local\Temp\B263.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\B447.tmp"C:\Users\Admin\AppData\Local\Temp\B447.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\B495.tmp"C:\Users\Admin\AppData\Local\Temp\B495.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\B532.tmp"C:\Users\Admin\AppData\Local\Temp\B532.tmp"65⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\B58F.tmp"C:\Users\Admin\AppData\Local\Temp\B58F.tmp"66⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"67⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\B62C.tmp"C:\Users\Admin\AppData\Local\Temp\B62C.tmp"68⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\B67A.tmp"C:\Users\Admin\AppData\Local\Temp\B67A.tmp"69⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"70⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"71⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"72⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"73⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B820.tmp"C:\Users\Admin\AppData\Local\Temp\B820.tmp"74⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"75⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"76⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\B90A.tmp"C:\Users\Admin\AppData\Local\Temp\B90A.tmp"77⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\B958.tmp"C:\Users\Admin\AppData\Local\Temp\B958.tmp"78⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"79⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\BA04.tmp"C:\Users\Admin\AppData\Local\Temp\BA04.tmp"80⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\BA62.tmp"C:\Users\Admin\AppData\Local\Temp\BA62.tmp"81⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"82⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"C:\Users\Admin\AppData\Local\Temp\BB1D.tmp"83⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"84⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"85⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"86⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\BC56.tmp"C:\Users\Admin\AppData\Local\Temp\BC56.tmp"87⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\BCA4.tmp"C:\Users\Admin\AppData\Local\Temp\BCA4.tmp"88⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"89⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"90⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"91⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"93⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\BE98.tmp"C:\Users\Admin\AppData\Local\Temp\BE98.tmp"94⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"95⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"96⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\BF82.tmp"C:\Users\Admin\AppData\Local\Temp\BF82.tmp"97⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"98⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\C01F.tmp"C:\Users\Admin\AppData\Local\Temp\C01F.tmp"99⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"100⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"101⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"102⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\C52F.tmp"C:\Users\Admin\AppData\Local\Temp\C52F.tmp"103⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"104⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"105⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"106⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\C687.tmp"C:\Users\Admin\AppData\Local\Temp\C687.tmp"107⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"108⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"109⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C772.tmp"C:\Users\Admin\AppData\Local\Temp\C772.tmp"110⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"111⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"112⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"113⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"114⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"115⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C956.tmp"C:\Users\Admin\AppData\Local\Temp\C956.tmp"116⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"117⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\CA02.tmp"C:\Users\Admin\AppData\Local\Temp\CA02.tmp"118⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\CA50.tmp"C:\Users\Admin\AppData\Local\Temp\CA50.tmp"119⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"120⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"121⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"122⤵PID:3988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-