Analysis
- max time kernel
150s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe
- Size 520KB
- Sample260503-dcl9eaet4p
- SHA256 77fc35b428dcfd795efd83bd10bb08004932196d5bf017798dc0b207868cfac2
- MD5 065fc5412da26e602706a2082d6514d0
- SHA1 c9ed0d3b9e73e32b869cbf93d79f96557abff430
- SHA512 68a4b79e4e2a26edc1cb04ce1ec31f2985e0d396d32799601857b9550112aac6740d1dfcf25e64521b457ea7ac74b6be9ae516a93c94b9ce73e4ac1362dbbdce
- SSDEEP 12288:gj8fuxR21t5i8fy3yk270V7EG/5D82/CM+0HBXApq+gFauW4NZ6:gj8fuK1GY5xC9n6M3XApMNI
- TLSH T101B4F112B889C032E99301314B66DB624BBF7D355B66A6C737843A6E6FB42C1D73530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4636 CD52.tmp 2504 CDFE.tmp 3976 CEAA.tmp 5288 CF66.tmp 932 D011.tmp 5212 D0BD.tmp 2836 D10B.tmp 2356 D179.tmp 4380 D1D7.tmp 1344 D273.tmp 2044 D2E0.tmp 1896 D37C.tmp 1844 D419.tmp 5864 D4B5.tmp 1380 D542.tmp 4048 D5AF.tmp 1208 D61C.tmp 5824 D67A.tmp 500 D707.tmp 1352 D774.tmp 452 D830.tmp 2500 D8DB.tmp 5744 D949.tmp 5644 D9B6.tmp 2488 DA43.tmp 5268 DACF.tmp 3272 DB3D.tmp 5648 DBAA.tmp 5492 DC66.tmp 3396 DD02.tmp 5332 DD9E.tmp 2548 DDFC.tmp 1680 DE98.tmp 2240 DF06.tmp 2052 DF54.tmp 2188 DFA2.tmp 5660 DFF0.tmp 3044 E04E.tmp 5512 E0AB.tmp 5996 E0FA.tmp 6092 E167.tmp 1560 E1B5.tmp 5140 E203.tmp 3204 E242.tmp 1584 E290.tmp 6052 E2DE.tmp 1656 E32C.tmp 1848 E38A.tmp 2852 E3D8.tmp 3444 E426.tmp 3572 E474.tmp 5436 E4E2.tmp 3960 E53F.tmp 2228 E58D.tmp 4764 E5FB.tmp 5752 E668.tmp 4616 E6B6.tmp 1080 E704.tmp 5296 E762.tmp 2064 E7B0.tmp 2284 E7FE.tmp 5168 E84D.tmp 1728 E89B.tmp 2760 E8E9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 531C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 677F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 441.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4636 4568 2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe 79 PID 4636 wrote to memory of 2504 4636 CD52.tmp 80 PID 2504 wrote to memory of 3976 2504 CDFE.tmp 81 PID 3976 wrote to memory of 5288 3976 CEAA.tmp 82 PID 5288 wrote to memory of 932 5288 CF66.tmp 83 PID 932 wrote to memory of 5212 932 D011.tmp 84 PID 5212 wrote to memory of 2836 5212 D0BD.tmp 85 PID 2836 wrote to memory of 2356 2836 D10B.tmp 86 PID 2356 wrote to memory of 4380 2356 D179.tmp 87 PID 4380 wrote to memory of 1344 4380 D1D7.tmp 88 PID 1344 wrote to memory of 2044 1344 D273.tmp 89 PID 2044 wrote to memory of 1896 2044 D2E0.tmp 90 PID 1896 wrote to memory of 1844 1896 D37C.tmp 91 PID 1844 wrote to memory of 5864 1844 D419.tmp 92 PID 5864 wrote to memory of 1380 5864 D4B5.tmp 93 PID 1380 wrote to memory of 4048 1380 D542.tmp 94 PID 4048 wrote to memory of 1208 4048 D5AF.tmp 95 PID 1208 wrote to memory of 5824 1208 D61C.tmp 96 PID 5824 wrote to memory of 500 5824 D67A.tmp 97 PID 500 wrote to memory of 1352 500 D707.tmp 98 PID 1352 wrote to memory of 452 1352 D774.tmp 99 PID 452 wrote to memory of 2500 452 D830.tmp 100 PID 2500 wrote to memory of 5744 2500 D8DB.tmp 101 PID 5744 wrote to memory of 5644 5744 D949.tmp 102 PID 5644 wrote to memory of 2488 5644 D9B6.tmp 103 PID 2488 wrote to memory of 5268 2488 DA43.tmp 104 PID 5268 wrote to memory of 3272 5268 DACF.tmp 105 PID 3272 wrote to memory of 5648 3272 DB3D.tmp 106 PID 5648 wrote to memory of 5492 5648 DBAA.tmp 107 PID 5492 wrote to memory of 3396 5492 DC66.tmp 108 PID 3396 wrote to memory of 5332 3396 DD02.tmp 109 PID 5332 wrote to memory of 2548 5332 DD9E.tmp 110 PID 2548 wrote to memory of 1680 2548 DDFC.tmp 111 PID 1680 wrote to memory of 2240 1680 DE98.tmp 112 PID 2240 wrote to memory of 2052 2240 DF06.tmp 113 PID 2052 wrote to memory of 2188 2052 DF54.tmp 114 PID 2188 wrote to memory of 5660 2188 DFA2.tmp 115 PID 5660 wrote to memory of 3044 5660 DFF0.tmp 116 PID 3044 wrote to memory of 5512 3044 E04E.tmp 117 PID 5512 wrote to memory of 5996 5512 E0AB.tmp 118 PID 5996 wrote to memory of 6092 5996 E0FA.tmp 119 PID 6092 wrote to memory of 1560 6092 E167.tmp 120 PID 1560 wrote to memory of 5140 1560 E1B5.tmp 121 PID 5140 wrote to memory of 3204 5140 E203.tmp 122 PID 3204 wrote to memory of 1584 3204 E242.tmp 123 PID 1584 wrote to memory of 6052 1584 E290.tmp 124 PID 6052 wrote to memory of 1656 6052 E2DE.tmp 125 PID 1656 wrote to memory of 1848 1656 E32C.tmp 126 PID 1848 wrote to memory of 2852 1848 E38A.tmp 127 PID 2852 wrote to memory of 3444 2852 E3D8.tmp 128 PID 3444 wrote to memory of 3572 3444 E426.tmp 129 PID 3572 wrote to memory of 5436 3572 E474.tmp 130 PID 5436 wrote to memory of 3960 5436 E4E2.tmp 131 PID 3960 wrote to memory of 2228 3960 E53F.tmp 132 PID 2228 wrote to memory of 4764 2228 E58D.tmp 133 PID 4764 wrote to memory of 5752 4764 E5FB.tmp 134 PID 5752 wrote to memory of 4616 5752 E668.tmp 135 PID 4616 wrote to memory of 1080 4616 E6B6.tmp 136 PID 1080 wrote to memory of 5296 1080 E704.tmp 137 PID 5296 wrote to memory of 2064 5296 E762.tmp 138 PID 2064 wrote to memory of 2284 2064 E7B0.tmp 139 PID 2284 wrote to memory of 5168 2284 E7FE.tmp 140 PID 5168 wrote to memory of 1728 5168 E84D.tmp 141 PID 1728 wrote to memory of 2760 1728 E89B.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_065fc5412da26e602706a2082d6514d0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\CF66.tmp"C:\Users\Admin\AppData\Local\Temp\CF66.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\D67A.tmp"C:\Users\Admin\AppData\Local\Temp\D67A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"C:\Users\Admin\AppData\Local\Temp\E0AB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"65⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"66⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"67⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"68⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:824 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"70⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"71⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"72⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"73⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"74⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"75⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"76⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"77⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"78⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"79⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"80⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"81⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"82⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"83⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"84⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"85⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"86⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"87⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"88⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"89⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"90⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"91⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"92⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"93⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"94⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"95⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"96⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"97⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"98⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"99⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"100⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"101⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"102⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"103⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"104⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"105⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"106⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"107⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"108⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"109⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"110⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"111⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"112⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"113⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"114⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"115⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"116⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"117⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"118⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"119⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"120⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"121⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"122⤵PID:5604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-