Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-17_064857370d08cd9e9705921716f3ff0e_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_064857370d08cd9e9705921716f3ff0e_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-17_064857370d08cd9e9705921716f3ff0e_elex_mafia.exe
- Size 561KB
- Sample260517-hhtb5ahs2l
- SHA256 dbc02dce61ef431694dcf337d0d15b201150aba219e7d5a7220ee630647411af
- MD5 064857370d08cd9e9705921716f3ff0e
- SHA1 9b35cab8a8de368c30e801ca1dec8dc7b8ef4844
- SHA512 e739c678e3caf5b8fb1361a38fd352402aa3925952361e2cc2e05ece1c01f11f9f43678e5f1beb38f021e61a7db02dca28ecf17d81fbeb4bc4ded29ad5c2bec1
- SSDEEP 12288:VuelPWET0yhqMcCUSrirUirf+2C58kONaKxDZuL:8eEEvhRcHYiNf+fyNXDoL
- TLSH T127C4D011B2D8C435F5F31A744AF09B62097B7C629B75D8CB2788266E1FB02D1EA78713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3792 A1E8.tmp 2372 A294.tmp 1872 A350.tmp 5116 A3FB.tmp 4252 A498.tmp 1304 A524.tmp 628 A5EF.tmp 2060 A69B.tmp 1800 A718.tmp 2804 A7E3.tmp 900 A880.tmp 1200 A94B.tmp 4224 AA06.tmp 2788 AAB2.tmp 1832 AB4E.tmp 740 ABDB.tmp 4580 AC87.tmp 3816 AD14.tmp 4488 AD91.tmp 4420 ADFE.tmp 2236 AE9A.tmp 3720 AF36.tmp 1136 AFA4.tmp 1360 B050.tmp 3344 B0BD.tmp 4196 B159.tmp 5068 B1F6.tmp 1752 B2B1.tmp 116 B34D.tmp 988 B3F9.tmp 1908 B486.tmp 4828 B512.tmp 2068 B5CE.tmp 2784 B61C.tmp 5012 B699.tmp 5028 B6E7.tmp 3332 B735.tmp 2880 B783.tmp 2012 B7F1.tmp 3260 B83F.tmp 4020 B89D.tmp 3660 B8FA.tmp 3584 B949.tmp 3896 B9B6.tmp 2076 BA23.tmp 752 BA91.tmp 3568 BAEE.tmp 4384 BB3D.tmp 4780 BB8B.tmp 4852 BBD9.tmp 4540 BC27.tmp 1840 BC85.tmp 3632 BCF2.tmp 1156 BD5F.tmp 2240 BDAE.tmp 2100 BE1B.tmp 2816 BE69.tmp 1968 BEB7.tmp 3876 BF05.tmp 5096 BF73.tmp 5032 BFC1.tmp 3820 C02E.tmp 1196 C09C.tmp 2916 C109.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 304.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 235D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B949.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 261C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 3792 4872 2026-05-17_064857370d08cd9e9705921716f3ff0e_elex_mafia.exe 84 PID 3792 wrote to memory of 2372 3792 A1E8.tmp 85 PID 2372 wrote to memory of 1872 2372 A294.tmp 86 PID 1872 wrote to memory of 5116 1872 A350.tmp 87 PID 5116 wrote to memory of 4252 5116 A3FB.tmp 88 PID 4252 wrote to memory of 1304 4252 A498.tmp 89 PID 1304 wrote to memory of 628 1304 A524.tmp 90 PID 628 wrote to memory of 2060 628 A5EF.tmp 91 PID 2060 wrote to memory of 1800 2060 A69B.tmp 92 PID 1800 wrote to memory of 2804 1800 A718.tmp 93 PID 2804 wrote to memory of 900 2804 A7E3.tmp 94 PID 900 wrote to memory of 1200 900 A880.tmp 95 PID 1200 wrote to memory of 4224 1200 A94B.tmp 96 PID 4224 wrote to memory of 2788 4224 AA06.tmp 97 PID 2788 wrote to memory of 1832 2788 AAB2.tmp 98 PID 1832 wrote to memory of 740 1832 AB4E.tmp 99 PID 740 wrote to memory of 4580 740 ABDB.tmp 100 PID 4580 wrote to memory of 3816 4580 AC87.tmp 101 PID 3816 wrote to memory of 4488 3816 AD14.tmp 102 PID 4488 wrote to memory of 4420 4488 AD91.tmp 103 PID 4420 wrote to memory of 2236 4420 ADFE.tmp 104 PID 2236 wrote to memory of 3720 2236 AE9A.tmp 105 PID 3720 wrote to memory of 1136 3720 AF36.tmp 106 PID 1136 wrote to memory of 1360 1136 AFA4.tmp 107 PID 1360 wrote to memory of 3344 1360 B050.tmp 108 PID 3344 wrote to memory of 4196 3344 B0BD.tmp 109 PID 4196 wrote to memory of 5068 4196 B159.tmp 110 PID 5068 wrote to memory of 1752 5068 B1F6.tmp 111 PID 1752 wrote to memory of 116 1752 B2B1.tmp 112 PID 116 wrote to memory of 988 116 B34D.tmp 113 PID 988 wrote to memory of 1908 988 B3F9.tmp 114 PID 1908 wrote to memory of 4828 1908 B486.tmp 115 PID 4828 wrote to memory of 2068 4828 B512.tmp 116 PID 2068 wrote to memory of 2784 2068 B5CE.tmp 117 PID 2784 wrote to memory of 5012 2784 B61C.tmp 118 PID 5012 wrote to memory of 5028 5012 B699.tmp 119 PID 5028 wrote to memory of 3332 5028 B6E7.tmp 120 PID 3332 wrote to memory of 2880 3332 B735.tmp 121 PID 2880 wrote to memory of 2012 2880 B783.tmp 122 PID 2012 wrote to memory of 3260 2012 B7F1.tmp 123 PID 3260 wrote to memory of 4020 3260 B83F.tmp 124 PID 4020 wrote to memory of 3660 4020 B89D.tmp 125 PID 3660 wrote to memory of 3584 3660 B8FA.tmp 126 PID 3584 wrote to memory of 3896 3584 B949.tmp 127 PID 3896 wrote to memory of 2076 3896 B9B6.tmp 128 PID 2076 wrote to memory of 752 2076 BA23.tmp 129 PID 752 wrote to memory of 3568 752 BA91.tmp 130 PID 3568 wrote to memory of 4384 3568 BAEE.tmp 131 PID 4384 wrote to memory of 4780 4384 BB3D.tmp 132 PID 4780 wrote to memory of 4852 4780 BB8B.tmp 133 PID 4852 wrote to memory of 4540 4852 BBD9.tmp 134 PID 4540 wrote to memory of 1840 4540 BC27.tmp 135 PID 1840 wrote to memory of 3632 1840 BC85.tmp 136 PID 3632 wrote to memory of 1156 3632 BCF2.tmp 137 PID 1156 wrote to memory of 2240 1156 BD5F.tmp 138 PID 2240 wrote to memory of 2100 2240 BDAE.tmp 139 PID 2100 wrote to memory of 2816 2100 BE1B.tmp 140 PID 2816 wrote to memory of 1968 2816 BE69.tmp 141 PID 1968 wrote to memory of 3876 1968 BEB7.tmp 142 PID 3876 wrote to memory of 5096 3876 BF05.tmp 143 PID 5096 wrote to memory of 5032 5096 BF73.tmp 144 PID 5032 wrote to memory of 3820 5032 BFC1.tmp 145 PID 3820 wrote to memory of 1196 3820 C02E.tmp 146 PID 1196 wrote to memory of 2916 1196 C09C.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_064857370d08cd9e9705921716f3ff0e_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_064857370d08cd9e9705921716f3ff0e_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"C:\Users\Admin\AppData\Local\Temp\A1E8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A350.tmp"C:\Users\Admin\AppData\Local\Temp\A350.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\A524.tmp"C:\Users\Admin\AppData\Local\Temp\A524.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\A94B.tmp"C:\Users\Admin\AppData\Local\Temp\A94B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\AA06.tmp"C:\Users\Admin\AppData\Local\Temp\AA06.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\AB4E.tmp"C:\Users\Admin\AppData\Local\Temp\AB4E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\AD14.tmp"C:\Users\Admin\AppData\Local\Temp\AD14.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\AD91.tmp"C:\Users\Admin\AppData\Local\Temp\AD91.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\AF36.tmp"C:\Users\Admin\AppData\Local\Temp\AF36.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\B050.tmp"C:\Users\Admin\AppData\Local\Temp\B050.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\B159.tmp"C:\Users\Admin\AppData\Local\Temp\B159.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\B486.tmp"C:\Users\Admin\AppData\Local\Temp\B486.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\B512.tmp"C:\Users\Admin\AppData\Local\Temp\B512.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\B699.tmp"C:\Users\Admin\AppData\Local\Temp\B699.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\B735.tmp"C:\Users\Admin\AppData\Local\Temp\B735.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\B783.tmp"C:\Users\Admin\AppData\Local\Temp\B783.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\B83F.tmp"C:\Users\Admin\AppData\Local\Temp\B83F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\B949.tmp"C:\Users\Admin\AppData\Local\Temp\B949.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\BA23.tmp"C:\Users\Admin\AppData\Local\Temp\BA23.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\BA91.tmp"C:\Users\Admin\AppData\Local\Temp\BA91.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\BC27.tmp"C:\Users\Admin\AppData\Local\Temp\BC27.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\BC85.tmp"C:\Users\Admin\AppData\Local\Temp\BC85.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\BE69.tmp"C:\Users\Admin\AppData\Local\Temp\BE69.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\BF05.tmp"C:\Users\Admin\AppData\Local\Temp\BF05.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\C02E.tmp"C:\Users\Admin\AppData\Local\Temp\C02E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\C09C.tmp"C:\Users\Admin\AppData\Local\Temp\C09C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"65⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"66⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"67⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"68⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"69⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"70⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\C32C.tmp"C:\Users\Admin\AppData\Local\Temp\C32C.tmp"71⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"73⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\C426.tmp"C:\Users\Admin\AppData\Local\Temp\C426.tmp"74⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C474.tmp"C:\Users\Admin\AppData\Local\Temp\C474.tmp"75⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"C:\Users\Admin\AppData\Local\Temp\C4D2.tmp"76⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"77⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"78⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"C:\Users\Admin\AppData\Local\Temp\C5BC.tmp"79⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"80⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\C697.tmp"C:\Users\Admin\AppData\Local\Temp\C697.tmp"81⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"82⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"83⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"84⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"85⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"86⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"87⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"88⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"89⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"C:\Users\Admin\AppData\Local\Temp\C9E3.tmp"90⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"91⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"92⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"93⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"94⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"95⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"96⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\CC34.tmp"C:\Users\Admin\AppData\Local\Temp\CC34.tmp"97⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"98⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"99⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"100⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"101⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"102⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"103⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\CED4.tmp"C:\Users\Admin\AppData\Local\Temp\CED4.tmp"104⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"105⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"106⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"107⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"108⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\D07A.tmp"C:\Users\Admin\AppData\Local\Temp\D07A.tmp"109⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"C:\Users\Admin\AppData\Local\Temp\D0E7.tmp"110⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"111⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"112⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"C:\Users\Admin\AppData\Local\Temp\D1F1.tmp"113⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\D25E.tmp"C:\Users\Admin\AppData\Local\Temp\D25E.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"115⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"116⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"117⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"118⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\D414.tmp"C:\Users\Admin\AppData\Local\Temp\D414.tmp"119⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"120⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"121⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-