Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_5c321ea7898336841c7de2baa9d605e5_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_5c321ea7898336841c7de2baa9d605e5_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_5c321ea7898336841c7de2baa9d605e5_elex_mafia.exe
- Size 816KB
- Sample260511-mla26sax2j
- SHA256 b2c4a2b6b00489f1ec1aa79cad9fad4c6d9042c370e81b5a46f66f3ea5ee0a09
- MD5 5c321ea7898336841c7de2baa9d605e5
- SHA1 5b952ed1a7d7864730c7179e0a82aab8b74706c5
- SHA512 e98039b9a885939e5730dbf80e6101f4e0e79ee0dfbdfcffdc290e375c991d1b647e0361c5635b47e74e01505a5cdeb1196b08a26e1b3c2a97409f244817e65c
- SSDEEP 6144:2fzZD/P+lZs2rdEkyc54b8DsanxRl9DqylH2xJLqyf6R5befzQZmZlEv29MsH3HZ:+mF/W8Dsy3EgoJLd6jbecwlGE3Z
- TLSH T17A05F121F684C432E69310394A6AEBA2497B7D719727A4C77B90367E6FB03C1DA35307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4744 1FE7.tmp 4140 20D1.tmp 2612 2296.tmp 972 23A0.tmp 720 24C9.tmp 2072 25C3.tmp 3476 269E.tmp 4236 2798.tmp 3796 2892.tmp 400 29BB.tmp 4280 2AC4.tmp 1720 2BCE.tmp 5056 2D06.tmp 1584 2DD1.tmp 1988 2EAC.tmp 4632 2FD5.tmp 4112 3091.tmp 752 316B.tmp 1628 3236.tmp 2796 3350.tmp 392 343A.tmp 3704 3573.tmp 60 36CA.tmp 2984 37D4.tmp 224 38AF.tmp 2120 39C8.tmp 680 3AE1.tmp 2440 3C39.tmp 2488 3D23.tmp 3348 3E8B.tmp 4328 3FA4.tmp 3952 409E.tmp 4852 4198.tmp 928 4225.tmp 64 42A2.tmp 5044 432E.tmp 4924 43BB.tmp 1896 4438.tmp 2208 4496.tmp 1252 4522.tmp 3136 459F.tmp 2284 463B.tmp 4300 46E7.tmp 536 4793.tmp 3412 4810.tmp 2416 48BC.tmp 4676 4939.tmp 4364 4997.tmp 3960 4A43.tmp 2760 4AC0.tmp 1904 4B4C.tmp 5032 4BC9.tmp 3904 4C46.tmp 2084 4CD3.tmp 3876 4D6F.tmp 2924 4DDD.tmp 4428 4E5A.tmp 4588 4ED7.tmp 4648 4FC1.tmp 3488 505D.tmp 5052 5119.tmp 4624 51B5.tmp 4460 5251.tmp 2232 52ED.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 680C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 744C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 384C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 432E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4744 4764 2026-05-11_5c321ea7898336841c7de2baa9d605e5_elex_mafia.exe 85 PID 4744 wrote to memory of 4140 4744 1FE7.tmp 86 PID 4140 wrote to memory of 2612 4140 20D1.tmp 87 PID 2612 wrote to memory of 972 2612 2296.tmp 88 PID 972 wrote to memory of 720 972 23A0.tmp 89 PID 720 wrote to memory of 2072 720 24C9.tmp 90 PID 2072 wrote to memory of 3476 2072 25C3.tmp 91 PID 3476 wrote to memory of 4236 3476 269E.tmp 92 PID 4236 wrote to memory of 3796 4236 2798.tmp 93 PID 3796 wrote to memory of 400 3796 2892.tmp 94 PID 400 wrote to memory of 4280 400 29BB.tmp 95 PID 4280 wrote to memory of 1720 4280 2AC4.tmp 96 PID 1720 wrote to memory of 5056 1720 2BCE.tmp 97 PID 5056 wrote to memory of 1584 5056 2D06.tmp 98 PID 1584 wrote to memory of 1988 1584 2DD1.tmp 99 PID 1988 wrote to memory of 4632 1988 2EAC.tmp 100 PID 4632 wrote to memory of 4112 4632 2FD5.tmp 101 PID 4112 wrote to memory of 752 4112 3091.tmp 102 PID 752 wrote to memory of 1628 752 316B.tmp 103 PID 1628 wrote to memory of 2796 1628 3236.tmp 104 PID 2796 wrote to memory of 392 2796 3350.tmp 105 PID 392 wrote to memory of 3704 392 343A.tmp 106 PID 3704 wrote to memory of 60 3704 3573.tmp 107 PID 60 wrote to memory of 2984 60 36CA.tmp 108 PID 2984 wrote to memory of 224 2984 37D4.tmp 109 PID 224 wrote to memory of 2120 224 38AF.tmp 110 PID 2120 wrote to memory of 680 2120 39C8.tmp 111 PID 680 wrote to memory of 2440 680 3AE1.tmp 112 PID 2440 wrote to memory of 2488 2440 3C39.tmp 113 PID 2488 wrote to memory of 3348 2488 3D23.tmp 114 PID 3348 wrote to memory of 4328 3348 3E8B.tmp 115 PID 4328 wrote to memory of 3952 4328 3FA4.tmp 116 PID 3952 wrote to memory of 4852 3952 409E.tmp 117 PID 4852 wrote to memory of 928 4852 4198.tmp 118 PID 928 wrote to memory of 64 928 4225.tmp 119 PID 64 wrote to memory of 5044 64 42A2.tmp 120 PID 5044 wrote to memory of 4924 5044 432E.tmp 121 PID 4924 wrote to memory of 1896 4924 43BB.tmp 122 PID 1896 wrote to memory of 2208 1896 4438.tmp 123 PID 2208 wrote to memory of 1252 2208 4496.tmp 124 PID 1252 wrote to memory of 3136 1252 4522.tmp 125 PID 3136 wrote to memory of 2284 3136 459F.tmp 126 PID 2284 wrote to memory of 4300 2284 463B.tmp 127 PID 4300 wrote to memory of 536 4300 46E7.tmp 128 PID 536 wrote to memory of 3412 536 4793.tmp 129 PID 3412 wrote to memory of 2416 3412 4810.tmp 131 PID 2416 wrote to memory of 4676 2416 48BC.tmp 133 PID 4676 wrote to memory of 4364 4676 4939.tmp 134 PID 4364 wrote to memory of 3960 4364 4997.tmp 135 PID 3960 wrote to memory of 2760 3960 4A43.tmp 136 PID 2760 wrote to memory of 1904 2760 4AC0.tmp 137 PID 1904 wrote to memory of 5032 1904 4B4C.tmp 138 PID 5032 wrote to memory of 3904 5032 4BC9.tmp 139 PID 3904 wrote to memory of 2084 3904 4C46.tmp 140 PID 2084 wrote to memory of 3876 2084 4CD3.tmp 141 PID 3876 wrote to memory of 2924 3876 4D6F.tmp 142 PID 2924 wrote to memory of 4428 2924 4DDD.tmp 143 PID 4428 wrote to memory of 4588 4428 4E5A.tmp 144 PID 4588 wrote to memory of 4648 4588 4ED7.tmp 145 PID 4648 wrote to memory of 3488 4648 4FC1.tmp 146 PID 3488 wrote to memory of 5052 3488 505D.tmp 147 PID 5052 wrote to memory of 4624 5052 5119.tmp 148 PID 4624 wrote to memory of 4460 4624 51B5.tmp 149 PID 4460 wrote to memory of 2232 4460 5251.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5c321ea7898336841c7de2baa9d605e5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5c321ea7898336841c7de2baa9d605e5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"65⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"66⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"67⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"68⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"69⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"70⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"71⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"72⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"73⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"74⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"75⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"76⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"77⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"78⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"79⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"80⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"81⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"82⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"83⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"84⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"85⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"86⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"87⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"88⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"89⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"90⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"91⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"92⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"93⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"94⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"95⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"96⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"98⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"100⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"101⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"102⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"103⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"104⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"105⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"106⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"107⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"108⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"109⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\61F1.tmp"C:\Users\Admin\AppData\Local\Temp\61F1.tmp"110⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"111⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"112⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"113⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"114⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"115⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"116⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"117⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"118⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"119⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"120⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"121⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-