Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe
- Size 520KB
- Sample260506-ppcfhsay6z
- SHA256 4210af5d559d5608113824437326c730595ca5dae92a4f578addc468487c46eb
- MD5 f94b230aa5ef7e436c6e063daf15e54d
- SHA1 528aa5506f4c337b45539af36c8c940d07341677
- SHA512 99d82e0d57e7cc7db5d654daa57c9f4ab7dd68ada70d1129a23b056d21795fc1a9a2555b0f4b2e42b690495988c61cde3a289a845b136981f1847737533a0102
- SSDEEP 12288:gj8fuxR21t5i8fkMVzGSnpRZ5TRQwyAHjKyCDg18NZ6:gj8fuK1GYkynp5TGbc8NI
- TLSH T1CDB4F1167449C032E8D614304B66DBA607BE7E748B3691C73BD436AE6FB52D2D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5560 D7A3.tmp 1500 D820.tmp 3552 D8DB.tmp 4112 D997.tmp 4676 DA24.tmp 4604 DAC0.tmp 4760 DB5C.tmp 4228 DBD9.tmp 4832 DC46.tmp 6036 DCA4.tmp 3532 DD31.tmp 3380 DDBD.tmp 5884 DE5A.tmp 2160 DEB7.tmp 2120 DF25.tmp 1364 DFD1.tmp 3760 E06D.tmp 5116 E0EA.tmp 1424 E167.tmp 1344 E1D4.tmp 984 E271.tmp 5080 E2FD.tmp 3860 E37A.tmp 2476 E407.tmp 4972 E484.tmp 2896 E4F1.tmp 1616 E57E.tmp 3220 E5FB.tmp 3460 E6A7.tmp 740 E743.tmp 5892 E7D0.tmp 5284 E84D.tmp 3764 E8BA.tmp 3604 E908.tmp 2416 E966.tmp 5244 E9B4.tmp 5000 EA02.tmp 4612 EA60.tmp 1984 EAAE.tmp 972 EB0C.tmp 5944 EB79.tmp 1464 EBE6.tmp 2784 EC54.tmp 5212 ECA2.tmp 6140 ECF0.tmp 4452 ED3E.tmp 4812 EDAC.tmp 3228 EE19.tmp 908 EE77.tmp 5148 EED4.tmp 5556 EF32.tmp 6064 EF80.tmp 2564 EFCE.tmp 4192 F02C.tmp 5152 F07A.tmp 2556 F0D8.tmp 5440 F136.tmp 3720 F184.tmp 4868 F1E2.tmp 2432 F230.tmp 3088 F29D.tmp 5668 F2FB.tmp 5672 F368.tmp 5644 F3C6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 652D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 729B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 941D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9045.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4198.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 5560 1368 2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe 84 PID 5560 wrote to memory of 1500 5560 D7A3.tmp 85 PID 1500 wrote to memory of 3552 1500 D820.tmp 86 PID 3552 wrote to memory of 4112 3552 D8DB.tmp 87 PID 4112 wrote to memory of 4676 4112 D997.tmp 88 PID 4676 wrote to memory of 4604 4676 DA24.tmp 89 PID 4604 wrote to memory of 4760 4604 DAC0.tmp 90 PID 4760 wrote to memory of 4228 4760 DB5C.tmp 91 PID 4228 wrote to memory of 4832 4228 DBD9.tmp 92 PID 4832 wrote to memory of 6036 4832 DC46.tmp 93 PID 6036 wrote to memory of 3532 6036 DCA4.tmp 94 PID 3532 wrote to memory of 3380 3532 DD31.tmp 95 PID 3380 wrote to memory of 5884 3380 DDBD.tmp 96 PID 5884 wrote to memory of 2160 5884 DE5A.tmp 97 PID 2160 wrote to memory of 2120 2160 DEB7.tmp 98 PID 2120 wrote to memory of 1364 2120 DF25.tmp 99 PID 1364 wrote to memory of 3760 1364 DFD1.tmp 100 PID 3760 wrote to memory of 5116 3760 E06D.tmp 101 PID 5116 wrote to memory of 1424 5116 E0EA.tmp 102 PID 1424 wrote to memory of 1344 1424 E167.tmp 103 PID 1344 wrote to memory of 984 1344 E1D4.tmp 104 PID 984 wrote to memory of 5080 984 E271.tmp 105 PID 5080 wrote to memory of 3860 5080 E2FD.tmp 106 PID 3860 wrote to memory of 2476 3860 E37A.tmp 107 PID 2476 wrote to memory of 4972 2476 E407.tmp 108 PID 4972 wrote to memory of 2896 4972 E484.tmp 109 PID 2896 wrote to memory of 1616 2896 E4F1.tmp 110 PID 1616 wrote to memory of 3220 1616 E57E.tmp 111 PID 3220 wrote to memory of 3460 3220 E5FB.tmp 112 PID 3460 wrote to memory of 740 3460 E6A7.tmp 113 PID 740 wrote to memory of 5892 740 E743.tmp 114 PID 5892 wrote to memory of 5284 5892 E7D0.tmp 115 PID 5284 wrote to memory of 3764 5284 E84D.tmp 116 PID 3764 wrote to memory of 3604 3764 E8BA.tmp 117 PID 3604 wrote to memory of 2416 3604 E908.tmp 118 PID 2416 wrote to memory of 5244 2416 E966.tmp 119 PID 5244 wrote to memory of 5000 5244 E9B4.tmp 120 PID 5000 wrote to memory of 4612 5000 EA02.tmp 121 PID 4612 wrote to memory of 1984 4612 EA60.tmp 122 PID 1984 wrote to memory of 972 1984 EAAE.tmp 123 PID 972 wrote to memory of 5944 972 EB0C.tmp 124 PID 5944 wrote to memory of 1464 5944 EB79.tmp 125 PID 1464 wrote to memory of 2784 1464 EBE6.tmp 126 PID 2784 wrote to memory of 5212 2784 EC54.tmp 127 PID 5212 wrote to memory of 6140 5212 ECA2.tmp 128 PID 6140 wrote to memory of 4452 6140 ECF0.tmp 129 PID 4452 wrote to memory of 4812 4452 ED3E.tmp 130 PID 4812 wrote to memory of 3228 4812 EDAC.tmp 131 PID 3228 wrote to memory of 908 3228 EE19.tmp 132 PID 908 wrote to memory of 5148 908 EE77.tmp 133 PID 5148 wrote to memory of 5556 5148 EED4.tmp 134 PID 5556 wrote to memory of 6064 5556 EF32.tmp 135 PID 6064 wrote to memory of 2564 6064 EF80.tmp 136 PID 2564 wrote to memory of 4192 2564 EFCE.tmp 137 PID 4192 wrote to memory of 5152 4192 F02C.tmp 138 PID 5152 wrote to memory of 2556 5152 F07A.tmp 139 PID 2556 wrote to memory of 5440 2556 F0D8.tmp 140 PID 5440 wrote to memory of 3720 5440 F136.tmp 141 PID 3720 wrote to memory of 4868 3720 F184.tmp 142 PID 4868 wrote to memory of 2432 4868 F1E2.tmp 143 PID 2432 wrote to memory of 3088 2432 F230.tmp 144 PID 3088 wrote to memory of 5668 3088 F29D.tmp 145 PID 5668 wrote to memory of 5672 5668 F2FB.tmp 146 PID 5672 wrote to memory of 5644 5672 F368.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\D820.tmp"C:\Users\Admin\AppData\Local\Temp\D820.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\EB79.tmp"C:\Users\Admin\AppData\Local\Temp\EB79.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"65⤵
- Executes dropped EXE
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"66⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"67⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"68⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"69⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"70⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"71⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"72⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"73⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"74⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\F79E.tmp"C:\Users\Admin\AppData\Local\Temp\F79E.tmp"75⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"76⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"77⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"78⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"79⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"80⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"81⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"82⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"83⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"84⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"85⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"86⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"87⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"88⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"89⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"90⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"91⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"92⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"93⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"94⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"95⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"96⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"97⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"98⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"99⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"100⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"102⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"103⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"104⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"105⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"106⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"107⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"108⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"109⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"110⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"111⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"112⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"113⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"114⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"115⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"116⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"117⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"118⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"119⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"120⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"121⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"122⤵PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-