Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-29_1e56efb9bc65661d81d0cf7b9728f645_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_1e56efb9bc65661d81d0cf7b9728f645_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-29_1e56efb9bc65661d81d0cf7b9728f645_elex_mafia.exe
- Size 520KB
- Sample260529-nakb5sat3k
- SHA256 3c685325345dc57e438330bb4e460932f5a29758db6b035f0e37f5cfbe06f64b
- MD5 1e56efb9bc65661d81d0cf7b9728f645
- SHA1 267a8518a72de9ce815b3fb5cb0d0d78d86007c3
- SHA512 600a8e82f4a39b514843d7fcb292ae6ca839bebe2d863ae7cfba304ada2d8ad5a5ee0aa5e14a5c96387fbc5f76ecab86a45059045519368223c2c76a374015ae
- SSDEEP 12288:gj8fuxR21t5i8fmVRIRnxWxebZRTuzz1HvOBEH/bNZ6:gj8fuK1GYsYnxOeb36dPk6bNI
- TLSH T1B6B4F1127548C033F8A615314A66DBA20BBE7D794B7A95C73B80327D6FB52D2D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4352 A8CE.tmp 436 A93B.tmp 5052 A9B8.tmp 2768 AA54.tmp 4692 AAE1.tmp 4044 AB7D.tmp 3276 ABDB.tmp 5060 AC68.tmp 4592 ACE5.tmp 1468 AD81.tmp 2340 AE1D.tmp 4140 AE9A.tmp 2124 AF08.tmp 3688 AFB3.tmp 2220 B05F.tmp 3596 B0EC.tmp 416 B188.tmp 220 B205.tmp 3044 B292.tmp 1868 B33E.tmp 4524 B3BB.tmp 3672 B438.tmp 4148 B4B5.tmp 3780 B561.tmp 1432 B5ED.tmp 972 B689.tmp 2256 B726.tmp 3116 B7A3.tmp 3344 B82F.tmp 4216 B89D.tmp 2068 B91A.tmp 4728 B9C6.tmp 2052 BA43.tmp 4164 BA91.tmp 2604 BADF.tmp 5104 BB3D.tmp 3404 BB8B.tmp 860 BBE8.tmp 3444 BC37.tmp 1576 BC85.tmp 4244 BCD3.tmp 2716 BD31.tmp 3804 BD7F.tmp 2856 BDCD.tmp 3624 BE3A.tmp 1076 BE88.tmp 5088 BED6.tmp 3484 BF25.tmp 5048 BF82.tmp 4100 BFD0.tmp 4404 C01F.tmp 2824 C07C.tmp 2760 C0BB.tmp 3176 C109.tmp 3248 C167.tmp 4396 C1B5.tmp 2520 C203.tmp 680 C241.tmp 2672 C290.tmp 4072 C2ED.tmp 1472 C33B.tmp 4308 C38A.tmp 5112 C3D8.tmp 2184 C426.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4352 4928 2026-05-29_1e56efb9bc65661d81d0cf7b9728f645_elex_mafia.exe 84 PID 4352 wrote to memory of 436 4352 A8CE.tmp 85 PID 436 wrote to memory of 5052 436 A93B.tmp 87 PID 5052 wrote to memory of 2768 5052 A9B8.tmp 89 PID 2768 wrote to memory of 4692 2768 AA54.tmp 91 PID 4692 wrote to memory of 4044 4692 AAE1.tmp 92 PID 4044 wrote to memory of 3276 4044 AB7D.tmp 93 PID 3276 wrote to memory of 5060 3276 ABDB.tmp 94 PID 5060 wrote to memory of 4592 5060 AC68.tmp 95 PID 4592 wrote to memory of 1468 4592 ACE5.tmp 96 PID 1468 wrote to memory of 2340 1468 AD81.tmp 97 PID 2340 wrote to memory of 4140 2340 AE1D.tmp 98 PID 4140 wrote to memory of 2124 4140 AE9A.tmp 99 PID 2124 wrote to memory of 3688 2124 AF08.tmp 100 PID 3688 wrote to memory of 2220 3688 AFB3.tmp 101 PID 2220 wrote to memory of 3596 2220 B05F.tmp 102 PID 3596 wrote to memory of 416 3596 B0EC.tmp 103 PID 416 wrote to memory of 220 416 B188.tmp 104 PID 220 wrote to memory of 3044 220 B205.tmp 107 PID 3044 wrote to memory of 1868 3044 B292.tmp 108 PID 1868 wrote to memory of 4524 1868 B33E.tmp 109 PID 4524 wrote to memory of 3672 4524 B3BB.tmp 110 PID 3672 wrote to memory of 4148 3672 B438.tmp 111 PID 4148 wrote to memory of 3780 4148 B4B5.tmp 112 PID 3780 wrote to memory of 1432 3780 B561.tmp 113 PID 1432 wrote to memory of 972 1432 B5ED.tmp 114 PID 972 wrote to memory of 2256 972 B689.tmp 116 PID 2256 wrote to memory of 3116 2256 B726.tmp 117 PID 3116 wrote to memory of 3344 3116 B7A3.tmp 119 PID 3344 wrote to memory of 4216 3344 B82F.tmp 120 PID 4216 wrote to memory of 2068 4216 B89D.tmp 121 PID 2068 wrote to memory of 4728 2068 B91A.tmp 122 PID 4728 wrote to memory of 2052 4728 B9C6.tmp 124 PID 2052 wrote to memory of 4164 2052 BA43.tmp 125 PID 4164 wrote to memory of 2604 4164 BA91.tmp 126 PID 2604 wrote to memory of 5104 2604 BADF.tmp 127 PID 5104 wrote to memory of 3404 5104 BB3D.tmp 128 PID 3404 wrote to memory of 860 3404 BB8B.tmp 129 PID 860 wrote to memory of 3444 860 BBE8.tmp 130 PID 3444 wrote to memory of 1576 3444 BC37.tmp 131 PID 1576 wrote to memory of 4244 1576 BC85.tmp 132 PID 4244 wrote to memory of 2716 4244 BCD3.tmp 133 PID 2716 wrote to memory of 3804 2716 BD31.tmp 134 PID 3804 wrote to memory of 2856 3804 BD7F.tmp 135 PID 2856 wrote to memory of 3624 2856 BDCD.tmp 136 PID 3624 wrote to memory of 1076 3624 BE3A.tmp 137 PID 1076 wrote to memory of 5088 1076 BE88.tmp 138 PID 5088 wrote to memory of 3484 5088 BED6.tmp 139 PID 3484 wrote to memory of 5048 3484 BF25.tmp 140 PID 5048 wrote to memory of 4100 5048 BF82.tmp 141 PID 4100 wrote to memory of 4404 4100 BFD0.tmp 142 PID 4404 wrote to memory of 2824 4404 C01F.tmp 143 PID 2824 wrote to memory of 2760 2824 C07C.tmp 144 PID 2760 wrote to memory of 3176 2760 C0BB.tmp 145 PID 3176 wrote to memory of 3248 3176 C109.tmp 146 PID 3248 wrote to memory of 4396 3248 C167.tmp 147 PID 4396 wrote to memory of 2520 4396 C1B5.tmp 148 PID 2520 wrote to memory of 680 2520 C203.tmp 149 PID 680 wrote to memory of 2672 680 C241.tmp 150 PID 2672 wrote to memory of 4072 2672 C290.tmp 152 PID 4072 wrote to memory of 1472 4072 C2ED.tmp 153 PID 1472 wrote to memory of 4308 1472 C33B.tmp 154 PID 4308 wrote to memory of 5112 4308 C38A.tmp 155 PID 5112 wrote to memory of 2184 5112 C3D8.tmp 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_1e56efb9bc65661d81d0cf7b9728f645_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_1e56efb9bc65661d81d0cf7b9728f645_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\AC68.tmp"C:\Users\Admin\AppData\Local\Temp\AC68.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\AD81.tmp"C:\Users\Admin\AppData\Local\Temp\AD81.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\B292.tmp"C:\Users\Admin\AppData\Local\Temp\B292.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B33E.tmp"C:\Users\Admin\AppData\Local\Temp\B33E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\B3BB.tmp"C:\Users\Admin\AppData\Local\Temp\B3BB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\B438.tmp"C:\Users\Admin\AppData\Local\Temp\B438.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\B4B5.tmp"C:\Users\Admin\AppData\Local\Temp\B4B5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\B561.tmp"C:\Users\Admin\AppData\Local\Temp\B561.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\B726.tmp"C:\Users\Admin\AppData\Local\Temp\B726.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B9C6.tmp"C:\Users\Admin\AppData\Local\Temp\B9C6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\BA91.tmp"C:\Users\Admin\AppData\Local\Temp\BA91.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\BD31.tmp"C:\Users\Admin\AppData\Local\Temp\BD31.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"C:\Users\Admin\AppData\Local\Temp\BD7F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\BED6.tmp"C:\Users\Admin\AppData\Local\Temp\BED6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\BF82.tmp"C:\Users\Admin\AppData\Local\Temp\BF82.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C01F.tmp"C:\Users\Admin\AppData\Local\Temp\C01F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\C07C.tmp"C:\Users\Admin\AppData\Local\Temp\C07C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"C:\Users\Admin\AppData\Local\Temp\C0BB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C241.tmp"C:\Users\Admin\AppData\Local\Temp\C241.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\C33B.tmp"C:\Users\Admin\AppData\Local\Temp\C33B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\C426.tmp"C:\Users\Admin\AppData\Local\Temp\C426.tmp"65⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C474.tmp"C:\Users\Admin\AppData\Local\Temp\C474.tmp"66⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"67⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\C510.tmp"C:\Users\Admin\AppData\Local\Temp\C510.tmp"68⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"69⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"70⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"71⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"72⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"73⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"74⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"75⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"76⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"77⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\C84C.tmp"C:\Users\Admin\AppData\Local\Temp\C84C.tmp"78⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"79⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"80⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"81⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"82⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"83⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"84⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\CACD.tmp"C:\Users\Admin\AppData\Local\Temp\CACD.tmp"85⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"86⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"87⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"88⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"90⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"91⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"92⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"93⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"94⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"95⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"96⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"97⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\CF61.tmp"C:\Users\Admin\AppData\Local\Temp\CF61.tmp"98⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"99⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"100⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\D04B.tmp"C:\Users\Admin\AppData\Local\Temp\D04B.tmp"101⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"102⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"103⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"104⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"105⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"106⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"107⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"108⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"109⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"110⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"113⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"114⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D53D.tmp"C:\Users\Admin\AppData\Local\Temp\D53D.tmp"116⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\D58B.tmp"C:\Users\Admin\AppData\Local\Temp\D58B.tmp"117⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"118⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"119⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"120⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"121⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"122⤵PID:2400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-