Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe
- Size 520KB
- Sample260503-dcl9eaet4p
- SHA256 77fc35b428dcfd795efd83bd10bb08004932196d5bf017798dc0b207868cfac2
- MD5 065fc5412da26e602706a2082d6514d0
- SHA1 c9ed0d3b9e73e32b869cbf93d79f96557abff430
- SHA512 68a4b79e4e2a26edc1cb04ce1ec31f2985e0d396d32799601857b9550112aac6740d1dfcf25e64521b457ea7ac74b6be9ae516a93c94b9ce73e4ac1362dbbdce
- SSDEEP 12288:gj8fuxR21t5i8fy3yk270V7EG/5D82/CM+0HBXApq+gFauW4NZ6:gj8fuK1GY5xC9n6M3XApMNI
- TLSH T101B4F112B889C032E99301314B66DB624BBF7D355B66A6C737843A6E6FB42C1D73530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3104 F695.tmp 3824 F731.tmp 4104 F79E.tmp 2360 F86A.tmp 2828 F8F6.tmp 4016 F973.tmp 1456 F9D1.tmp 2992 FA3E.tmp 2816 FA9C.tmp 3024 FAFA.tmp 644 FB58.tmp 4960 FBD5.tmp 4376 FC42.tmp 4488 FCAF.tmp 688 FD2C.tmp 3436 FD9A.tmp 3908 FE07.tmp 3944 FE94.tmp 4340 FF20.tmp 3152 FF7E.tmp 4472 FFDC.tmp 4180 49.tmp 1696 B7.tmp 4380 105.tmp 848 172.tmp 2292 1C0.tmp 1156 22E.tmp 3080 2BA.tmp 4744 347.tmp 972 3A5.tmp 1836 412.tmp 1300 460.tmp 312 4DD.tmp 5084 53B.tmp 2580 589.tmp 3552 5D7.tmp 1768 625.tmp 3444 673.tmp 3976 6D1.tmp 1884 71F.tmp 3616 76D.tmp 892 7AC.tmp 4760 7EA.tmp 4936 838.tmp 1880 887.tmp 2072 8D5.tmp 4060 932.tmp 2856 981.tmp 3928 9CF.tmp 3516 A0D.tmp 5088 A4C.tmp 4540 AA9.tmp 4796 AF8.tmp 3888 B46.tmp 4200 B94.tmp 4100 BF2.tmp 2832 C4F.tmp 4360 C8E.tmp 3136 CEC.tmp 1772 D2A.tmp 4252 D78.tmp 4416 DC6.tmp 3528 E24.tmp 4324 E72.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C02E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9527.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 380E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 304D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 389F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 581E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 624F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 196A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 233E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 3104 4056 2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe 85 PID 3104 wrote to memory of 3824 3104 F695.tmp 86 PID 3824 wrote to memory of 4104 3824 F731.tmp 87 PID 4104 wrote to memory of 2360 4104 F79E.tmp 88 PID 2360 wrote to memory of 2828 2360 F86A.tmp 89 PID 2828 wrote to memory of 4016 2828 F8F6.tmp 90 PID 4016 wrote to memory of 1456 4016 F973.tmp 91 PID 1456 wrote to memory of 2992 1456 F9D1.tmp 92 PID 2992 wrote to memory of 2816 2992 FA3E.tmp 93 PID 2816 wrote to memory of 3024 2816 FA9C.tmp 94 PID 3024 wrote to memory of 644 3024 FAFA.tmp 95 PID 644 wrote to memory of 4960 644 FB58.tmp 96 PID 4960 wrote to memory of 4376 4960 FBD5.tmp 97 PID 4376 wrote to memory of 4488 4376 FC42.tmp 98 PID 4488 wrote to memory of 688 4488 FCAF.tmp 99 PID 688 wrote to memory of 3436 688 FD2C.tmp 100 PID 3436 wrote to memory of 3908 3436 FD9A.tmp 101 PID 3908 wrote to memory of 3944 3908 FE07.tmp 102 PID 3944 wrote to memory of 4340 3944 FE94.tmp 103 PID 4340 wrote to memory of 3152 4340 FF20.tmp 104 PID 3152 wrote to memory of 4472 3152 FF7E.tmp 105 PID 4472 wrote to memory of 4180 4472 FFDC.tmp 106 PID 4180 wrote to memory of 1696 4180 49.tmp 107 PID 1696 wrote to memory of 4380 1696 B7.tmp 108 PID 4380 wrote to memory of 848 4380 105.tmp 109 PID 848 wrote to memory of 2292 848 172.tmp 110 PID 2292 wrote to memory of 1156 2292 1C0.tmp 111 PID 1156 wrote to memory of 3080 1156 22E.tmp 112 PID 3080 wrote to memory of 4744 3080 2BA.tmp 113 PID 4744 wrote to memory of 972 4744 347.tmp 114 PID 972 wrote to memory of 1836 972 3A5.tmp 115 PID 1836 wrote to memory of 1300 1836 412.tmp 116 PID 1300 wrote to memory of 312 1300 460.tmp 117 PID 312 wrote to memory of 5084 312 4DD.tmp 118 PID 5084 wrote to memory of 2580 5084 53B.tmp 119 PID 2580 wrote to memory of 3552 2580 589.tmp 120 PID 3552 wrote to memory of 1768 3552 5D7.tmp 121 PID 1768 wrote to memory of 3444 1768 625.tmp 122 PID 3444 wrote to memory of 3976 3444 673.tmp 125 PID 3976 wrote to memory of 1884 3976 6D1.tmp 126 PID 1884 wrote to memory of 3616 1884 71F.tmp 127 PID 3616 wrote to memory of 892 3616 76D.tmp 128 PID 892 wrote to memory of 4760 892 7AC.tmp 129 PID 4760 wrote to memory of 4936 4760 7EA.tmp 130 PID 4936 wrote to memory of 1880 4936 838.tmp 131 PID 1880 wrote to memory of 2072 1880 887.tmp 132 PID 2072 wrote to memory of 4060 2072 8D5.tmp 133 PID 4060 wrote to memory of 2856 4060 932.tmp 134 PID 2856 wrote to memory of 3928 2856 981.tmp 135 PID 3928 wrote to memory of 3516 3928 9CF.tmp 136 PID 3516 wrote to memory of 5088 3516 A0D.tmp 137 PID 5088 wrote to memory of 4540 5088 A4C.tmp 139 PID 4540 wrote to memory of 4796 4540 AA9.tmp 140 PID 4796 wrote to memory of 3888 4796 AF8.tmp 142 PID 3888 wrote to memory of 4200 3888 B46.tmp 143 PID 4200 wrote to memory of 4100 4200 B94.tmp 144 PID 4100 wrote to memory of 2832 4100 BF2.tmp 145 PID 2832 wrote to memory of 4360 2832 C4F.tmp 146 PID 4360 wrote to memory of 3136 4360 C8E.tmp 147 PID 3136 wrote to memory of 1772 3136 CEC.tmp 148 PID 1772 wrote to memory of 4252 1772 D2A.tmp 149 PID 4252 wrote to memory of 4416 4252 D78.tmp 150 PID 4416 wrote to memory of 3528 4416 DC6.tmp 151 PID 3528 wrote to memory of 4324 3528 E24.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"65⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"66⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"67⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"68⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"69⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"70⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:368 -
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"72⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"73⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"74⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"75⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"76⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"77⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"78⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"79⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"80⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"81⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"82⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"83⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"84⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"85⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"86⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"87⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"88⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"89⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"90⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"91⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"92⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"93⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"94⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"95⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"96⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"97⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"98⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"99⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"100⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"101⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"102⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"103⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"104⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"105⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"106⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"107⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"108⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"109⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"110⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"111⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"112⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"113⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"114⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"115⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"116⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"117⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"118⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"119⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"120⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"122⤵PID:896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-