Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 02:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_5c171c747dc8ef5a489d1186571a73db_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_5c171c747dc8ef5a489d1186571a73db_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_5c171c747dc8ef5a489d1186571a73db_elex_mafia.exe
- Size 524KB
- Sample260511-c3cbfsav3z
- SHA256 4fd9f2958b9979421ffd2a7a6bafc69cabeaf538661dc9f4ae13d1708b0af05e
- MD5 5c171c747dc8ef5a489d1186571a73db
- SHA1 5ba98a4d70d40bb188e910236ac06c5e41adabce
- SHA512 4f315a3da32a44cf66772bae29eb3a08bc01b3d0c38c2c823669eaef4f0da109d96529385e8432a0a66f5ced14ff66ede6cb0e2465021867af268d2d95a6dd04
- SSDEEP 12288:TRyZzqyL66TBxIdjFEDneDyirxn4xKoHNZ:TRyQylT/IdhEDeDLn4xHHN
- TLSH T1DAB4F019B649C432F6D205328B66EB62593F7C715B26A0CB77852A3D2EF13E1E274307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4020 1FF7.tmp 2872 219C.tmp 3620 2333.tmp 540 247B.tmp 4824 2630.tmp 764 2788.tmp 4580 28D0.tmp 4248 29F9.tmp 5116 2B80.tmp 2996 2CC8.tmp 4196 2DE1.tmp 3448 2F48.tmp 4544 3081.tmp 4148 319A.tmp 4904 3321.tmp 3264 3469.tmp 3408 35B1.tmp 680 36CA.tmp 5000 3832.tmp 624 39A9.tmp 1152 3AC2.tmp 4340 3C49.tmp 3492 3DCF.tmp 2604 3F27.tmp 3848 4040.tmp 3136 4159.tmp 3304 42C1.tmp 5108 4428.tmp 3484 4580.tmp 3956 46E7.tmp 3852 4801.tmp 2188 4958.tmp 4136 4AA0.tmp 708 4B8B.tmp 4948 4C46.tmp 1904 4D40.tmp 3068 4DFC.tmp 2228 4EB7.tmp 2184 4FD1.tmp 3860 50AB.tmp 848 5176.tmp 1584 5232.tmp 2236 534B.tmp 1028 5416.tmp 4080 5520.tmp 2700 562A.tmp 4420 5743.tmp 1276 583D.tmp 4760 58F8.tmp 2440 5995.tmp 976 5A21.tmp 1788 5A9E.tmp 2004 5B4A.tmp 1912 5B98.tmp 2748 5C73.tmp 4924 5D00.tmp 1896 5D7D.tmp 3228 5DFA.tmp 1400 5E77.tmp 3456 5ED4.tmp 2104 5F32.tmp 4680 5FEE.tmp 4676 607A.tmp 3580 6116.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8364.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 993D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 862E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 4020 4436 2026-05-11_5c171c747dc8ef5a489d1186571a73db_elex_mafia.exe 85 PID 4020 wrote to memory of 2872 4020 1FF7.tmp 86 PID 2872 wrote to memory of 3620 2872 219C.tmp 87 PID 3620 wrote to memory of 540 3620 2333.tmp 88 PID 540 wrote to memory of 4824 540 247B.tmp 89 PID 4824 wrote to memory of 764 4824 2630.tmp 90 PID 764 wrote to memory of 4580 764 2788.tmp 91 PID 4580 wrote to memory of 4248 4580 28D0.tmp 92 PID 4248 wrote to memory of 5116 4248 29F9.tmp 93 PID 5116 wrote to memory of 2996 5116 2B80.tmp 94 PID 2996 wrote to memory of 4196 2996 2CC8.tmp 95 PID 4196 wrote to memory of 3448 4196 2DE1.tmp 96 PID 3448 wrote to memory of 4544 3448 2F48.tmp 97 PID 4544 wrote to memory of 4148 4544 3081.tmp 100 PID 4148 wrote to memory of 4904 4148 319A.tmp 101 PID 4904 wrote to memory of 3264 4904 3321.tmp 102 PID 3264 wrote to memory of 3408 3264 3469.tmp 103 PID 3408 wrote to memory of 680 3408 35B1.tmp 105 PID 680 wrote to memory of 5000 680 36CA.tmp 107 PID 5000 wrote to memory of 624 5000 3832.tmp 108 PID 624 wrote to memory of 1152 624 39A9.tmp 109 PID 1152 wrote to memory of 4340 1152 3AC2.tmp 110 PID 4340 wrote to memory of 3492 4340 3C49.tmp 111 PID 3492 wrote to memory of 2604 3492 3DCF.tmp 112 PID 2604 wrote to memory of 3848 2604 3F27.tmp 113 PID 3848 wrote to memory of 3136 3848 4040.tmp 114 PID 3136 wrote to memory of 3304 3136 4159.tmp 116 PID 3304 wrote to memory of 5108 3304 42C1.tmp 117 PID 5108 wrote to memory of 3484 5108 4428.tmp 118 PID 3484 wrote to memory of 3956 3484 4580.tmp 119 PID 3956 wrote to memory of 3852 3956 46E7.tmp 120 PID 3852 wrote to memory of 2188 3852 4801.tmp 121 PID 2188 wrote to memory of 4136 2188 4958.tmp 122 PID 4136 wrote to memory of 708 4136 4AA0.tmp 123 PID 708 wrote to memory of 4948 708 4B8B.tmp 124 PID 4948 wrote to memory of 1904 4948 4C46.tmp 125 PID 1904 wrote to memory of 3068 1904 4D40.tmp 126 PID 3068 wrote to memory of 2228 3068 4DFC.tmp 128 PID 2228 wrote to memory of 2184 2228 4EB7.tmp 131 PID 2184 wrote to memory of 3860 2184 4FD1.tmp 132 PID 3860 wrote to memory of 848 3860 50AB.tmp 133 PID 848 wrote to memory of 1584 848 5176.tmp 134 PID 1584 wrote to memory of 2236 1584 5232.tmp 136 PID 2236 wrote to memory of 1028 2236 534B.tmp 137 PID 1028 wrote to memory of 4080 1028 5416.tmp 138 PID 4080 wrote to memory of 2700 4080 5520.tmp 139 PID 2700 wrote to memory of 4420 2700 562A.tmp 140 PID 4420 wrote to memory of 1276 4420 5743.tmp 141 PID 1276 wrote to memory of 4760 1276 583D.tmp 142 PID 4760 wrote to memory of 2440 4760 58F8.tmp 143 PID 2440 wrote to memory of 976 2440 5995.tmp 144 PID 976 wrote to memory of 1788 976 5A21.tmp 145 PID 1788 wrote to memory of 2004 1788 5A9E.tmp 146 PID 2004 wrote to memory of 1912 2004 5B4A.tmp 147 PID 1912 wrote to memory of 2748 1912 5B98.tmp 148 PID 2748 wrote to memory of 4924 2748 5C73.tmp 149 PID 4924 wrote to memory of 1896 4924 5D00.tmp 150 PID 1896 wrote to memory of 3228 1896 5D7D.tmp 151 PID 3228 wrote to memory of 1400 3228 5DFA.tmp 152 PID 1400 wrote to memory of 3456 1400 5E77.tmp 153 PID 3456 wrote to memory of 2104 3456 5ED4.tmp 154 PID 2104 wrote to memory of 4680 2104 5F32.tmp 155 PID 4680 wrote to memory of 4676 4680 5FEE.tmp 156 PID 4676 wrote to memory of 3580 4676 607A.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5c171c747dc8ef5a489d1186571a73db_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5c171c747dc8ef5a489d1186571a73db_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4040.tmp"C:\Users\Admin\AppData\Local\Temp\4040.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\42C1.tmp"C:\Users\Admin\AppData\Local\Temp\42C1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5743.tmp"C:\Users\Admin\AppData\Local\Temp\5743.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"65⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"66⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"67⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"68⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"69⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"70⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"71⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"72⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"73⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"74⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"75⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"76⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"77⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"78⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"79⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"80⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"81⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"82⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"83⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"84⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"85⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"86⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"87⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"88⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"89⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"90⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"91⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"92⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"93⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"94⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\6B67.tmp"C:\Users\Admin\AppData\Local\Temp\6B67.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"96⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"97⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"98⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"99⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"100⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"101⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"102⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"103⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"104⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"105⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"106⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"107⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"109⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"110⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"111⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"112⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\7182.tmp"C:\Users\Admin\AppData\Local\Temp\7182.tmp"113⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\71D0.tmp"C:\Users\Admin\AppData\Local\Temp\71D0.tmp"114⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"115⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"116⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"117⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"118⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"119⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"120⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"121⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-