Analysis
- max time kernel
150s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe
- Size 520KB
- Sample260506-ppcfhsay6z
- SHA256 4210af5d559d5608113824437326c730595ca5dae92a4f578addc468487c46eb
- MD5 f94b230aa5ef7e436c6e063daf15e54d
- SHA1 528aa5506f4c337b45539af36c8c940d07341677
- SHA512 99d82e0d57e7cc7db5d654daa57c9f4ab7dd68ada70d1129a23b056d21795fc1a9a2555b0f4b2e42b690495988c61cde3a289a845b136981f1847737533a0102
- SSDEEP 12288:gj8fuxR21t5i8fkMVzGSnpRZ5TRQwyAHjKyCDg18NZ6:gj8fuK1GYkynp5TGbc8NI
- TLSH T1CDB4F1167449C032E8D614304B66DBA607BE7E748B3691C73BD436AE6FB52D2D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3600 1076.tmp 5456 10D4.tmp 3448 11AE.tmp 5060 123B.tmp 2024 12E7.tmp 4984 1335.tmp 2328 13A2.tmp 1176 143F.tmp 4392 14EA.tmp 2652 1577.tmp 1932 1623.tmp 5904 1681.tmp 3840 16EE.tmp 4424 173C.tmp 5624 1807.tmp 4608 1875.tmp 1952 18E2.tmp 2432 198E.tmp 5640 19FB.tmp 3104 1A88.tmp 4280 1AF5.tmp 3948 1C2E.tmp 5924 1CBA.tmp 6044 1D47.tmp 5260 1DB4.tmp 5632 1E22.tmp 1828 1E8F.tmp 3252 1F2B.tmp 6116 1FC8.tmp 4784 2045.tmp 2384 20B2.tmp 5008 214E.tmp 5324 21BC.tmp 4240 220A.tmp 2088 2277.tmp 2196 22C5.tmp 1868 2313.tmp 4324 2371.tmp 772 23DF.tmp 4288 245C.tmp 688 24C9.tmp 5436 2507.tmp 4380 2556.tmp 1748 25D3.tmp 5548 2621.tmp 5716 267E.tmp 3332 26FB.tmp 4480 274A.tmp 2144 27A7.tmp 3564 27F5.tmp 3364 2853.tmp 3400 28C1.tmp 4644 290F.tmp 2308 296C.tmp 5876 29CA.tmp 5292 2A28.tmp 3640 2A86.tmp 1228 2AD4.tmp 1796 2B22.tmp 5172 2B70.tmp 4400 2BCE.tmp 5604 2C1C.tmp 5088 2C6A.tmp 4744 2CB8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 214E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 611.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 482B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7923.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D983.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 411B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 435D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45FD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5872 wrote to memory of 3600 5872 2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe 79 PID 3600 wrote to memory of 5456 3600 1076.tmp 80 PID 5456 wrote to memory of 3448 5456 10D4.tmp 81 PID 3448 wrote to memory of 5060 3448 11AE.tmp 82 PID 5060 wrote to memory of 2024 5060 123B.tmp 83 PID 2024 wrote to memory of 4984 2024 12E7.tmp 84 PID 4984 wrote to memory of 2328 4984 1335.tmp 85 PID 2328 wrote to memory of 1176 2328 13A2.tmp 86 PID 1176 wrote to memory of 4392 1176 143F.tmp 87 PID 4392 wrote to memory of 2652 4392 14EA.tmp 88 PID 2652 wrote to memory of 1932 2652 1577.tmp 89 PID 1932 wrote to memory of 5904 1932 1623.tmp 90 PID 5904 wrote to memory of 3840 5904 1681.tmp 91 PID 3840 wrote to memory of 4424 3840 16EE.tmp 92 PID 4424 wrote to memory of 5624 4424 173C.tmp 93 PID 5624 wrote to memory of 4608 5624 1807.tmp 94 PID 4608 wrote to memory of 1952 4608 1875.tmp 95 PID 1952 wrote to memory of 2432 1952 18E2.tmp 96 PID 2432 wrote to memory of 5640 2432 198E.tmp 97 PID 5640 wrote to memory of 3104 5640 19FB.tmp 98 PID 3104 wrote to memory of 4280 3104 1A88.tmp 99 PID 4280 wrote to memory of 3948 4280 1AF5.tmp 100 PID 3948 wrote to memory of 5924 3948 1C2E.tmp 101 PID 5924 wrote to memory of 6044 5924 1CBA.tmp 102 PID 6044 wrote to memory of 5260 6044 1D47.tmp 103 PID 5260 wrote to memory of 5632 5260 1DB4.tmp 104 PID 5632 wrote to memory of 1828 5632 1E22.tmp 105 PID 1828 wrote to memory of 3252 1828 1E8F.tmp 106 PID 3252 wrote to memory of 6116 3252 1F2B.tmp 107 PID 6116 wrote to memory of 4784 6116 1FC8.tmp 108 PID 4784 wrote to memory of 2384 4784 2045.tmp 109 PID 2384 wrote to memory of 5008 2384 20B2.tmp 110 PID 5008 wrote to memory of 5324 5008 214E.tmp 111 PID 5324 wrote to memory of 4240 5324 21BC.tmp 112 PID 4240 wrote to memory of 2088 4240 220A.tmp 113 PID 2088 wrote to memory of 2196 2088 2277.tmp 114 PID 2196 wrote to memory of 1868 2196 22C5.tmp 115 PID 1868 wrote to memory of 4324 1868 2313.tmp 116 PID 4324 wrote to memory of 772 4324 2371.tmp 117 PID 772 wrote to memory of 4288 772 23DF.tmp 118 PID 4288 wrote to memory of 688 4288 245C.tmp 119 PID 688 wrote to memory of 5436 688 24C9.tmp 120 PID 5436 wrote to memory of 4380 5436 2507.tmp 121 PID 4380 wrote to memory of 1748 4380 2556.tmp 122 PID 1748 wrote to memory of 5548 1748 25D3.tmp 123 PID 5548 wrote to memory of 5716 5548 2621.tmp 124 PID 5716 wrote to memory of 3332 5716 267E.tmp 125 PID 3332 wrote to memory of 4480 3332 26FB.tmp 126 PID 4480 wrote to memory of 2144 4480 274A.tmp 127 PID 2144 wrote to memory of 3564 2144 27A7.tmp 128 PID 3564 wrote to memory of 3364 3564 27F5.tmp 129 PID 3364 wrote to memory of 3400 3364 2853.tmp 130 PID 3400 wrote to memory of 4644 3400 28C1.tmp 131 PID 4644 wrote to memory of 2308 4644 290F.tmp 132 PID 2308 wrote to memory of 5876 2308 296C.tmp 133 PID 5876 wrote to memory of 5292 5876 29CA.tmp 134 PID 5292 wrote to memory of 3640 5292 2A28.tmp 135 PID 3640 wrote to memory of 1228 3640 2A86.tmp 136 PID 1228 wrote to memory of 1796 1228 2AD4.tmp 137 PID 1796 wrote to memory of 5172 1796 2B22.tmp 138 PID 5172 wrote to memory of 4400 5172 2B70.tmp 139 PID 4400 wrote to memory of 5604 4400 2BCE.tmp 140 PID 5604 wrote to memory of 5088 5604 2C1C.tmp 141 PID 5088 wrote to memory of 4744 5088 2C6A.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_f94b230aa5ef7e436c6e063daf15e54d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\245C.tmp"C:\Users\Admin\AppData\Local\Temp\245C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"65⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"66⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"67⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"68⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"69⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"70⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"71⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"72⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"73⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"74⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"76⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"77⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"78⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"79⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"80⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"81⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"82⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"83⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"84⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"85⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"86⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"87⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"88⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"89⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"90⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"91⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"92⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"93⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"94⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"95⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"96⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"97⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"98⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"99⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"100⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"101⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"102⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\38FD.tmp"C:\Users\Admin\AppData\Local\Temp\38FD.tmp"103⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"104⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"105⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"106⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"108⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"109⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"110⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"111⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"112⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"113⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"114⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"115⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"116⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"117⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"118⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"119⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"120⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"121⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"122⤵PID:3940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-