Analysis
- max time kernel
150s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 01:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_a7831ea4260b886cb23a89ee91f0dff7_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_a7831ea4260b886cb23a89ee91f0dff7_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-18_a7831ea4260b886cb23a89ee91f0dff7_elex_mafia.exe
- Size 524KB
- Sample260418-ber7bset7x
- SHA256 02f12c71a19975f2164b733321e34acac14bbaec3ea30cea930eeefb7f21201e
- MD5 a7831ea4260b886cb23a89ee91f0dff7
- SHA1 6af84799a7848449cb68d4f04fa3588554be0343
- SHA512 024a29d3472773bf4bee8e5d40787f7d7ad94095586df79a926183fe8c58c19c3270dd8f9c9346b9918ce4294e9a21a245c0165d665ce44c5c41f659705c9651
- SSDEEP 12288:TRyZzqyL66T5FbfY+r1gzGXPgJrDUSNZ:TRyQylT51tgCXPgxDUSN
- TLSH T187B4F016B684C032E59211328F25EB92997A7D75AB27A4CB3BC5363D6EB03D1D3B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4768 491A.tmp 3152 49B6.tmp 3624 4A52.tmp 3384 4AEF.tmp 1728 4B3D.tmp 2084 4B9A.tmp 3080 4C37.tmp 4568 4CA4.tmp 1484 4D21.tmp 2804 4D8E.tmp 1584 4E1B.tmp 3132 4EE6.tmp 3156 4F92.tmp 3636 500F.tmp 2820 507C.tmp 4856 50EA.tmp 1620 5167.tmp 3188 51D4.tmp 1520 5280.tmp 996 532C.tmp 2092 5407.tmp 4936 5474.tmp 744 5510.tmp 900 557E.tmp 236 561A.tmp 4324 56B6.tmp 8 5752.tmp 4352 57DF.tmp 4860 588B.tmp 3552 5927.tmp 2460 59B4.tmp 3788 5A21.tmp 1444 5ACD.tmp 1792 5B2B.tmp 2464 5B89.tmp 5032 5C06.tmp 3272 5C73.tmp 656 5CD1.tmp 4564 5D1F.tmp 1736 5D7D.tmp 1524 5DDA.tmp 1984 5E38.tmp 2276 5EC5.tmp 3284 5F22.tmp 4696 5F90.tmp 1848 5FEE.tmp 4844 606B.tmp 3792 60D8.tmp 5104 6145.tmp 4412 6193.tmp 3472 61E2.tmp 3364 6230.tmp 4108 627E.tmp 1688 62CC.tmp 1640 631A.tmp 556 6368.tmp 788 63B6.tmp 3544 6404.tmp 3356 6453.tmp 2664 64A1.tmp 4384 64EF.tmp 1256 653D.tmp 3408 658B.tmp 3800 65D9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 500F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 972A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5318.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D50E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8979.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5108 wrote to memory of 4768 5108 2026-04-18_a7831ea4260b886cb23a89ee91f0dff7_elex_mafia.exe 80 PID 4768 wrote to memory of 3152 4768 491A.tmp 81 PID 3152 wrote to memory of 3624 3152 49B6.tmp 82 PID 3624 wrote to memory of 3384 3624 4A52.tmp 83 PID 3384 wrote to memory of 1728 3384 4AEF.tmp 84 PID 1728 wrote to memory of 2084 1728 4B3D.tmp 85 PID 2084 wrote to memory of 3080 2084 4B9A.tmp 86 PID 3080 wrote to memory of 4568 3080 4C37.tmp 87 PID 4568 wrote to memory of 1484 4568 4CA4.tmp 88 PID 1484 wrote to memory of 2804 1484 4D21.tmp 89 PID 2804 wrote to memory of 1584 2804 4D8E.tmp 90 PID 1584 wrote to memory of 3132 1584 4E1B.tmp 91 PID 3132 wrote to memory of 3156 3132 4EE6.tmp 92 PID 3156 wrote to memory of 3636 3156 4F92.tmp 93 PID 3636 wrote to memory of 2820 3636 500F.tmp 94 PID 2820 wrote to memory of 4856 2820 507C.tmp 95 PID 4856 wrote to memory of 1620 4856 50EA.tmp 96 PID 1620 wrote to memory of 3188 1620 5167.tmp 97 PID 3188 wrote to memory of 1520 3188 51D4.tmp 98 PID 1520 wrote to memory of 996 1520 5280.tmp 99 PID 996 wrote to memory of 2092 996 532C.tmp 100 PID 2092 wrote to memory of 4936 2092 5407.tmp 101 PID 4936 wrote to memory of 744 4936 5474.tmp 102 PID 744 wrote to memory of 900 744 5510.tmp 103 PID 900 wrote to memory of 236 900 557E.tmp 104 PID 236 wrote to memory of 4324 236 561A.tmp 105 PID 4324 wrote to memory of 8 4324 56B6.tmp 106 PID 8 wrote to memory of 4352 8 5752.tmp 107 PID 4352 wrote to memory of 4860 4352 57DF.tmp 108 PID 4860 wrote to memory of 3552 4860 588B.tmp 109 PID 3552 wrote to memory of 2460 3552 5927.tmp 110 PID 2460 wrote to memory of 3788 2460 59B4.tmp 111 PID 3788 wrote to memory of 1444 3788 5A21.tmp 112 PID 1444 wrote to memory of 1792 1444 5ACD.tmp 113 PID 1792 wrote to memory of 2464 1792 5B2B.tmp 114 PID 2464 wrote to memory of 5032 2464 5B89.tmp 115 PID 5032 wrote to memory of 3272 5032 5C06.tmp 116 PID 3272 wrote to memory of 656 3272 5C73.tmp 117 PID 656 wrote to memory of 4564 656 5CD1.tmp 118 PID 4564 wrote to memory of 1736 4564 5D1F.tmp 119 PID 1736 wrote to memory of 1524 1736 5D7D.tmp 120 PID 1524 wrote to memory of 1984 1524 5DDA.tmp 121 PID 1984 wrote to memory of 2276 1984 5E38.tmp 122 PID 2276 wrote to memory of 3284 2276 5EC5.tmp 123 PID 3284 wrote to memory of 4696 3284 5F22.tmp 124 PID 4696 wrote to memory of 1848 4696 5F90.tmp 125 PID 1848 wrote to memory of 4844 1848 5FEE.tmp 126 PID 4844 wrote to memory of 3792 4844 606B.tmp 127 PID 3792 wrote to memory of 5104 3792 60D8.tmp 128 PID 5104 wrote to memory of 4412 5104 6145.tmp 129 PID 4412 wrote to memory of 3472 4412 6193.tmp 130 PID 3472 wrote to memory of 3364 3472 61E2.tmp 131 PID 3364 wrote to memory of 4108 3364 6230.tmp 132 PID 4108 wrote to memory of 1688 4108 627E.tmp 133 PID 1688 wrote to memory of 1640 1688 62CC.tmp 134 PID 1640 wrote to memory of 556 1640 631A.tmp 135 PID 556 wrote to memory of 788 556 6368.tmp 136 PID 788 wrote to memory of 3544 788 63B6.tmp 137 PID 3544 wrote to memory of 3356 3544 6404.tmp 138 PID 3356 wrote to memory of 2664 3356 6453.tmp 139 PID 2664 wrote to memory of 4384 2664 64A1.tmp 140 PID 4384 wrote to memory of 1256 4384 64EF.tmp 141 PID 1256 wrote to memory of 3408 1256 653D.tmp 142 PID 3408 wrote to memory of 3800 3408 658B.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_a7831ea4260b886cb23a89ee91f0dff7_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_a7831ea4260b886cb23a89ee91f0dff7_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\57DF.tmp"C:\Users\Admin\AppData\Local\Temp\57DF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\588B.tmp"C:\Users\Admin\AppData\Local\Temp\588B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"65⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"66⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"67⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"68⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"69⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"70⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"71⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"72⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"73⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"74⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"75⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"76⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"77⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"78⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"79⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"80⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"81⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"82⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"83⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"84⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"85⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"86⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"87⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"88⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"89⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"90⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"91⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"92⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"93⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"94⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"95⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"96⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"97⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"98⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"99⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"100⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"102⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"103⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"104⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"105⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"106⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"107⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\7366.tmp"C:\Users\Admin\AppData\Local\Temp\7366.tmp"108⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"109⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"110⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"111⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"112⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"113⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"114⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"116⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"117⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"118⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"119⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"120⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"121⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"122⤵PID:3240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-