Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2026, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_691b129f9566aa9ef6691d6ef4ddb3d0_elex_mafia.exe
Resource
win10v2004-20250619-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_691b129f9566aa9ef6691d6ef4ddb3d0_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_691b129f9566aa9ef6691d6ef4ddb3d0_elex_mafia.exe
- Size 520KB
- Sample260511-dbwrfsaw5t
- SHA256 06f14bf9d4fdc848f06a5cad9d841401d500aa6530fe02bcb4f539cbc064e166
- MD5 691b129f9566aa9ef6691d6ef4ddb3d0
- SHA1 968cc33083895f8bec4a713469047bdfa8f43c79
- SHA512 c524a325218670825abf76766ce8eb5a2044815a90c83ad047b2834cbe878c735c6c5e7b531759f52f13d99ec50598b2ebb6fec8a5ab774db078090f109502dd
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLKiIzdwOhzJJEQbpGijIfuhw+90jP1GB+mHjsw:roRXOQjmOy6VdhDECGijgg9i1KRoNZE
- TLSH T16AB4F022B549C032E5D265308B26DBA11B3E7D329B2A56C73BC43A6D6FF02C1DA75347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4356 92BA.tmp 5504 9347.tmp 5100 9395.tmp 3856 93E3.tmp 2740 94BE.tmp 3300 953B.tmp 5928 95B8.tmp 5376 9606.tmp 1640 9664.tmp 2796 96C2.tmp 952 9710.tmp 3712 978D.tmp 116 97FA.tmp 5360 9858.tmp 6104 98B6.tmp 5136 9923.tmp 5264 9990.tmp 5476 99EE.tmp 4040 9A3C.tmp 5284 9AC9.tmp 3680 9B17.tmp 4600 9B94.tmp 4564 9BF2.tmp 4684 9C5F.tmp 4724 9CCC.tmp 4768 9D49.tmp 4920 9DB7.tmp 3724 9E15.tmp 4640 9E72.tmp 4076 9EEF.tmp 2996 9F5D.tmp 1496 9FCA.tmp 1124 A028.tmp 5960 A086.tmp 4812 A0D4.tmp 5032 A131.tmp 4980 A180.tmp 4856 A1DD.tmp 4912 A23B.tmp 5364 A289.tmp 4492 A2E7.tmp 5220 A345.tmp 4936 A393.tmp 5496 A3F1.tmp 5748 A43F.tmp 4748 A49C.tmp 1144 A4EB.tmp 1556 A539.tmp 1952 A596.tmp 5736 A5F4.tmp 3244 A652.tmp 3536 A6A0.tmp 4060 A6EE.tmp 4244 A73C.tmp 4132 A79A.tmp 408 A7E8.tmp 6116 A836.tmp 5572 A884.tmp 1420 A8D3.tmp 4256 A930.tmp 5140 A98E.tmp 2944 A9DC.tmp 6112 AA3A.tmp 3588 AA88.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A345.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A43F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1558.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 582D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 631A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D472.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E395.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E62A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A539.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 4356 2544 2026-05-11_691b129f9566aa9ef6691d6ef4ddb3d0_elex_mafia.exe 84 PID 4356 wrote to memory of 5504 4356 92BA.tmp 85 PID 5504 wrote to memory of 5100 5504 9347.tmp 86 PID 5100 wrote to memory of 3856 5100 9395.tmp 87 PID 3856 wrote to memory of 2740 3856 93E3.tmp 88 PID 2740 wrote to memory of 3300 2740 94BE.tmp 89 PID 3300 wrote to memory of 5928 3300 953B.tmp 90 PID 5928 wrote to memory of 5376 5928 95B8.tmp 91 PID 5376 wrote to memory of 1640 5376 9606.tmp 92 PID 1640 wrote to memory of 2796 1640 9664.tmp 93 PID 2796 wrote to memory of 952 2796 96C2.tmp 94 PID 952 wrote to memory of 3712 952 9710.tmp 95 PID 3712 wrote to memory of 116 3712 978D.tmp 96 PID 116 wrote to memory of 5360 116 97FA.tmp 97 PID 5360 wrote to memory of 6104 5360 9858.tmp 98 PID 6104 wrote to memory of 5136 6104 98B6.tmp 99 PID 5136 wrote to memory of 5264 5136 9923.tmp 100 PID 5264 wrote to memory of 5476 5264 9990.tmp 101 PID 5476 wrote to memory of 4040 5476 99EE.tmp 102 PID 4040 wrote to memory of 5284 4040 9A3C.tmp 103 PID 5284 wrote to memory of 3680 5284 9AC9.tmp 104 PID 3680 wrote to memory of 4600 3680 9B17.tmp 105 PID 4600 wrote to memory of 4564 4600 9B94.tmp 106 PID 4564 wrote to memory of 4684 4564 9BF2.tmp 107 PID 4684 wrote to memory of 4724 4684 9C5F.tmp 108 PID 4724 wrote to memory of 4768 4724 9CCC.tmp 109 PID 4768 wrote to memory of 4920 4768 9D49.tmp 110 PID 4920 wrote to memory of 3724 4920 9DB7.tmp 111 PID 3724 wrote to memory of 4640 3724 9E15.tmp 112 PID 4640 wrote to memory of 4076 4640 9E72.tmp 113 PID 4076 wrote to memory of 2996 4076 9EEF.tmp 114 PID 2996 wrote to memory of 1496 2996 9F5D.tmp 115 PID 1496 wrote to memory of 1124 1496 9FCA.tmp 116 PID 1124 wrote to memory of 5960 1124 A028.tmp 117 PID 5960 wrote to memory of 4812 5960 A086.tmp 118 PID 4812 wrote to memory of 5032 4812 A0D4.tmp 119 PID 5032 wrote to memory of 4980 5032 A131.tmp 120 PID 4980 wrote to memory of 4856 4980 A180.tmp 121 PID 4856 wrote to memory of 4912 4856 A1DD.tmp 122 PID 4912 wrote to memory of 5364 4912 A23B.tmp 123 PID 5364 wrote to memory of 4492 5364 A289.tmp 124 PID 4492 wrote to memory of 5220 4492 A2E7.tmp 125 PID 5220 wrote to memory of 4936 5220 A345.tmp 126 PID 4936 wrote to memory of 5496 4936 A393.tmp 127 PID 5496 wrote to memory of 5748 5496 A3F1.tmp 128 PID 5748 wrote to memory of 4748 5748 A43F.tmp 129 PID 4748 wrote to memory of 1144 4748 A49C.tmp 130 PID 1144 wrote to memory of 1556 1144 A4EB.tmp 131 PID 1556 wrote to memory of 1952 1556 A539.tmp 132 PID 1952 wrote to memory of 5736 1952 A596.tmp 133 PID 5736 wrote to memory of 3244 5736 A5F4.tmp 134 PID 3244 wrote to memory of 3536 3244 A652.tmp 135 PID 3536 wrote to memory of 4060 3536 A6A0.tmp 136 PID 4060 wrote to memory of 4244 4060 A6EE.tmp 137 PID 4244 wrote to memory of 4132 4244 A73C.tmp 138 PID 4132 wrote to memory of 408 4132 A79A.tmp 139 PID 408 wrote to memory of 6116 408 A7E8.tmp 140 PID 6116 wrote to memory of 5572 6116 A836.tmp 141 PID 5572 wrote to memory of 1420 5572 A884.tmp 142 PID 1420 wrote to memory of 4256 1420 A8D3.tmp 143 PID 4256 wrote to memory of 5140 4256 A930.tmp 144 PID 5140 wrote to memory of 2944 5140 A98E.tmp 145 PID 2944 wrote to memory of 6112 2944 A9DC.tmp 146 PID 6112 wrote to memory of 3588 6112 AA3A.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_691b129f9566aa9ef6691d6ef4ddb3d0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_691b129f9566aa9ef6691d6ef4ddb3d0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"65⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"67⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"68⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"70⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"71⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"72⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"73⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"74⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"75⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"76⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"77⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"78⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"79⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"80⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"81⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"82⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"83⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"84⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"85⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"86⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"87⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"88⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"89⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"90⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"91⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"92⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"93⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"94⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"95⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"97⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"98⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"99⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"100⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"101⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:336 -
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"103⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"104⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"105⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"106⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"107⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"108⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"109⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"110⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"112⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"113⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"114⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"115⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"116⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"119⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"120⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"121⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"122⤵PID:5416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-