Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/05/2026, 02:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_d867d2e24c7add0a2fefab08c97b54f3_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_d867d2e24c7add0a2fefab08c97b54f3_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-16_d867d2e24c7add0a2fefab08c97b54f3_elex_mafia.exe
- Size 561KB
- Sample260516-c52dcsat3y
- SHA256 538d00c57193173d5788069b587b7e7910b26031a6c1068209d986a6463b5458
- MD5 d867d2e24c7add0a2fefab08c97b54f3
- SHA1 1bf6ed6b9c3cd6b1d5fe60b6d356f27b8e11cf9b
- SHA512 ba02e1d881425d1677782014615fcce5fd92934ad6fc6082d40417105f8415c9013630bf4a2f9afa662c9bc1a2f3df587797d12b88396e8e38c2218ea565f2aa
- SSDEEP 6144:kPTkurf/m9KOzlMsPhYET0yhlwRWmt19yE1iVpczyDGyKEDXQ8wC4sH3zZ3+L:VuelPWET0yhZmt1R1WptHDpwChDZuL
- TLSH T1BFC4D011B6C4C436F1B31A344AF19B62497BBC229B71E8CF2B88526D1EB13D1E678717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3652 E927.tmp 5532 E9A4.tmp 3732 EA21.tmp 4860 EA9E.tmp 6128 EB2B.tmp 4928 EBA8.tmp 3408 EC06.tmp 2104 EC73.tmp 4416 ECE0.tmp 2640 ED8C.tmp 5320 EE29.tmp 716 EEA6.tmp 4792 EF51.tmp 4432 EFCE.tmp 5252 F07A.tmp 1868 F107.tmp 4264 F184.tmp 5004 F220.tmp 4156 F29D.tmp 3176 F32A.tmp 5104 F3F5.tmp 4292 F4A1.tmp 5992 F54D.tmp 3980 F5D9.tmp 2684 F637.tmp 3940 F6A4.tmp 3472 F712.tmp 4452 F77F.tmp 1820 F80C.tmp 3200 F8A8.tmp 4968 F925.tmp 5676 F983.tmp 5136 FA3E.tmp 5464 FAAC.tmp 5932 FB19.tmp 5964 FB77.tmp 2268 FBF4.tmp 5948 FC52.tmp 4440 FCA0.tmp 1160 FD0D.tmp 2148 FD7A.tmp 5832 FDC9.tmp 1856 FE36.tmp 1164 FEA3.tmp 5480 FEF1.tmp 5048 FF5F.tmp 1428 FFAD.tmp 1380 B.tmp 5652 68.tmp 3924 C6.tmp 3688 134.tmp 3816 191.tmp 6108 1DF.tmp 4820 23D.tmp 1796 29B.tmp 5616 2F9.tmp 4180 347.tmp 1388 3B4.tmp 2888 412.tmp 4764 460.tmp 4044 4AE.tmp 3276 51C.tmp 1268 589.tmp 5852 5F6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 554A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F846.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 455C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 269E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 209E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5232.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 150A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 740 wrote to memory of 3652 740 2026-05-16_d867d2e24c7add0a2fefab08c97b54f3_elex_mafia.exe 80 PID 3652 wrote to memory of 5532 3652 E927.tmp 81 PID 5532 wrote to memory of 3732 5532 E9A4.tmp 82 PID 3732 wrote to memory of 4860 3732 EA21.tmp 83 PID 4860 wrote to memory of 6128 4860 EA9E.tmp 84 PID 6128 wrote to memory of 4928 6128 EB2B.tmp 85 PID 4928 wrote to memory of 3408 4928 EBA8.tmp 86 PID 3408 wrote to memory of 2104 3408 EC06.tmp 87 PID 2104 wrote to memory of 4416 2104 EC73.tmp 88 PID 4416 wrote to memory of 2640 4416 ECE0.tmp 89 PID 2640 wrote to memory of 5320 2640 ED8C.tmp 90 PID 5320 wrote to memory of 716 5320 EE29.tmp 91 PID 716 wrote to memory of 4792 716 EEA6.tmp 92 PID 4792 wrote to memory of 4432 4792 EF51.tmp 93 PID 4432 wrote to memory of 5252 4432 EFCE.tmp 94 PID 5252 wrote to memory of 1868 5252 F07A.tmp 95 PID 1868 wrote to memory of 4264 1868 F107.tmp 96 PID 4264 wrote to memory of 5004 4264 F184.tmp 97 PID 5004 wrote to memory of 4156 5004 F220.tmp 98 PID 4156 wrote to memory of 3176 4156 F29D.tmp 99 PID 3176 wrote to memory of 5104 3176 F32A.tmp 100 PID 5104 wrote to memory of 4292 5104 F3F5.tmp 101 PID 4292 wrote to memory of 5992 4292 F4A1.tmp 102 PID 5992 wrote to memory of 3980 5992 F54D.tmp 103 PID 3980 wrote to memory of 2684 3980 F5D9.tmp 104 PID 2684 wrote to memory of 3940 2684 F637.tmp 105 PID 3940 wrote to memory of 3472 3940 F6A4.tmp 106 PID 3472 wrote to memory of 4452 3472 F712.tmp 107 PID 4452 wrote to memory of 1820 4452 F77F.tmp 108 PID 1820 wrote to memory of 3200 1820 F80C.tmp 109 PID 3200 wrote to memory of 4968 3200 F8A8.tmp 110 PID 4968 wrote to memory of 5676 4968 F925.tmp 111 PID 5676 wrote to memory of 5136 5676 F983.tmp 112 PID 5136 wrote to memory of 5464 5136 FA3E.tmp 113 PID 5464 wrote to memory of 5932 5464 FAAC.tmp 114 PID 5932 wrote to memory of 5964 5932 FB19.tmp 115 PID 5964 wrote to memory of 2268 5964 FB77.tmp 116 PID 2268 wrote to memory of 5948 2268 FBF4.tmp 117 PID 5948 wrote to memory of 4440 5948 FC52.tmp 118 PID 4440 wrote to memory of 1160 4440 FCA0.tmp 119 PID 1160 wrote to memory of 2148 1160 FD0D.tmp 120 PID 2148 wrote to memory of 5832 2148 FD7A.tmp 121 PID 5832 wrote to memory of 1856 5832 FDC9.tmp 122 PID 1856 wrote to memory of 1164 1856 FE36.tmp 123 PID 1164 wrote to memory of 5480 1164 FEA3.tmp 124 PID 5480 wrote to memory of 5048 5480 FEF1.tmp 125 PID 5048 wrote to memory of 1428 5048 FF5F.tmp 126 PID 1428 wrote to memory of 1380 1428 FFAD.tmp 127 PID 1380 wrote to memory of 5652 1380 B.tmp 128 PID 5652 wrote to memory of 3924 5652 68.tmp 129 PID 3924 wrote to memory of 3688 3924 C6.tmp 130 PID 3688 wrote to memory of 3816 3688 134.tmp 131 PID 3816 wrote to memory of 6108 3816 191.tmp 132 PID 6108 wrote to memory of 4820 6108 1DF.tmp 133 PID 4820 wrote to memory of 1796 4820 23D.tmp 134 PID 1796 wrote to memory of 5616 1796 29B.tmp 135 PID 5616 wrote to memory of 4180 5616 2F9.tmp 136 PID 4180 wrote to memory of 1388 4180 347.tmp 137 PID 1388 wrote to memory of 2888 1388 3B4.tmp 138 PID 2888 wrote to memory of 4764 2888 412.tmp 139 PID 4764 wrote to memory of 4044 4764 460.tmp 140 PID 4044 wrote to memory of 3276 4044 4AE.tmp 141 PID 3276 wrote to memory of 1268 3276 51C.tmp 142 PID 1268 wrote to memory of 5852 1268 589.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_d867d2e24c7add0a2fefab08c97b54f3_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_d867d2e24c7add0a2fefab08c97b54f3_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"65⤵
- Executes dropped EXE
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"66⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"67⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"68⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"69⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"70⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"71⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"72⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"73⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"75⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"76⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"77⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"78⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"79⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"80⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"81⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"82⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"83⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"85⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"86⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"87⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"88⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"89⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"90⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"91⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"92⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"93⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"94⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"95⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"96⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"97⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"98⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"99⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"100⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"101⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"102⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"103⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"105⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"106⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"107⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"108⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"109⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"110⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"111⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"112⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"113⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"114⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"115⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"116⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"117⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"118⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"119⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"120⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"121⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"122⤵PID:4188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-