Analysis
- max time kernel
150s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_0fbdd72d071d0f4d29e595c1fae19f11_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_0fbdd72d071d0f4d29e595c1fae19f11_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-31_0fbdd72d071d0f4d29e595c1fae19f11_elex_mafia.exe
- Size 561KB
- Sample260531-hlan7ads2j
- SHA256 dc6421e1e7a83fc9d558b9ece6e3bb3616fa67bf48465ac2919a0e70e5ea6c35
- MD5 0fbdd72d071d0f4d29e595c1fae19f11
- SHA1 23c146d0a8cad30f0d97d212f1248c98b09e4ce2
- SHA512 cec1ddb1a3889128410b47d098a372b2edbef9a2e569f421837ec16b4dc4081f2c1d484d007eee1a0082bb086ce41020a757f00ce3c6c87ce669ab6ff33f9f26
- SSDEEP 12288:mtZCN/mQz3o6phSKpCC/cjQEj0AyLeDZuL:mtZCcQDp/pCC/WQCKeDoL
- TLSH T170C4DF12F2D88036F5F31A345AF19BA2583B7CA15B75D9CF2784122E2EB42D1CA75323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3824 18A4.tmp 4644 1911.tmp 3056 199E.tmp 1804 19FB.tmp 2984 1A59.tmp 4532 1AA7.tmp 3464 1B24.tmp 3760 1BA1.tmp 1340 1BEF.tmp 2700 1C5D.tmp 1932 1CCA.tmp 888 1D28.tmp 2236 1DB4.tmp 3756 1E12.tmp 428 1E70.tmp 2304 1EFD.tmp 3256 1F89.tmp 3140 1FE7.tmp 4464 2074.tmp 2636 20D1.tmp 3980 217D.tmp 3956 2239.tmp 1524 22C5.tmp 2212 2313.tmp 3212 23A0.tmp 4764 23EE.tmp 3428 247B.tmp 1328 24F8.tmp 2668 2556.tmp 720 25C3.tmp 240 2621.tmp 976 269E.tmp 2284 26FB.tmp 4372 274A.tmp 1920 2798.tmp 3668 27F5.tmp 5088 2834.tmp 4720 2882.tmp 4928 28D0.tmp 1480 291E.tmp 780 297C.tmp 876 29CA.tmp 3800 2A18.tmp 3344 2A76.tmp 1808 2AC4.tmp 4664 2B12.tmp 1076 2B70.tmp 1280 2BBE.tmp 1928 2C0C.tmp 3316 2C5A.tmp 3336 2CC8.tmp 1728 2D16.tmp 4276 2D74.tmp 3116 2DC2.tmp 5048 2E2F.tmp 5004 2E7D.tmp 3436 2ECB.tmp 3764 2F29.tmp 912 2F87.tmp 2608 2FD5.tmp 1996 3023.tmp 1740 3071.tmp 2344 30CF.tmp 572 311D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2798.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4467.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 749A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B86E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 679E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 842F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 3824 1448 2026-05-31_0fbdd72d071d0f4d29e595c1fae19f11_elex_mafia.exe 81 PID 3824 wrote to memory of 4644 3824 18A4.tmp 82 PID 4644 wrote to memory of 3056 4644 1911.tmp 83 PID 3056 wrote to memory of 1804 3056 199E.tmp 84 PID 1804 wrote to memory of 2984 1804 19FB.tmp 85 PID 2984 wrote to memory of 4532 2984 1A59.tmp 86 PID 4532 wrote to memory of 3464 4532 1AA7.tmp 87 PID 3464 wrote to memory of 3760 3464 1B24.tmp 88 PID 3760 wrote to memory of 1340 3760 1BA1.tmp 89 PID 1340 wrote to memory of 2700 1340 1BEF.tmp 90 PID 2700 wrote to memory of 1932 2700 1C5D.tmp 91 PID 1932 wrote to memory of 888 1932 1CCA.tmp 92 PID 888 wrote to memory of 2236 888 1D28.tmp 93 PID 2236 wrote to memory of 3756 2236 1DB4.tmp 94 PID 3756 wrote to memory of 428 3756 1E12.tmp 95 PID 428 wrote to memory of 2304 428 1E70.tmp 96 PID 2304 wrote to memory of 3256 2304 1EFD.tmp 97 PID 3256 wrote to memory of 3140 3256 1F89.tmp 98 PID 3140 wrote to memory of 4464 3140 1FE7.tmp 99 PID 4464 wrote to memory of 2636 4464 2074.tmp 100 PID 2636 wrote to memory of 3980 2636 20D1.tmp 101 PID 3980 wrote to memory of 3956 3980 217D.tmp 102 PID 3956 wrote to memory of 1524 3956 2239.tmp 103 PID 1524 wrote to memory of 2212 1524 22C5.tmp 104 PID 2212 wrote to memory of 3212 2212 2313.tmp 105 PID 3212 wrote to memory of 4764 3212 23A0.tmp 106 PID 4764 wrote to memory of 3428 4764 23EE.tmp 107 PID 3428 wrote to memory of 1328 3428 247B.tmp 108 PID 1328 wrote to memory of 2668 1328 24F8.tmp 109 PID 2668 wrote to memory of 720 2668 2556.tmp 110 PID 720 wrote to memory of 240 720 25C3.tmp 111 PID 240 wrote to memory of 976 240 2621.tmp 112 PID 976 wrote to memory of 2284 976 269E.tmp 113 PID 2284 wrote to memory of 4372 2284 26FB.tmp 114 PID 4372 wrote to memory of 1920 4372 274A.tmp 115 PID 1920 wrote to memory of 3668 1920 2798.tmp 116 PID 3668 wrote to memory of 5088 3668 27F5.tmp 117 PID 5088 wrote to memory of 4720 5088 2834.tmp 118 PID 4720 wrote to memory of 4928 4720 2882.tmp 119 PID 4928 wrote to memory of 1480 4928 28D0.tmp 120 PID 1480 wrote to memory of 780 1480 291E.tmp 121 PID 780 wrote to memory of 876 780 297C.tmp 122 PID 876 wrote to memory of 3800 876 29CA.tmp 123 PID 3800 wrote to memory of 3344 3800 2A18.tmp 124 PID 3344 wrote to memory of 1808 3344 2A76.tmp 125 PID 1808 wrote to memory of 4664 1808 2AC4.tmp 126 PID 4664 wrote to memory of 1076 4664 2B12.tmp 127 PID 1076 wrote to memory of 1280 1076 2B70.tmp 128 PID 1280 wrote to memory of 1928 1280 2BBE.tmp 129 PID 1928 wrote to memory of 3316 1928 2C0C.tmp 130 PID 3316 wrote to memory of 3336 3316 2C5A.tmp 131 PID 3336 wrote to memory of 1728 3336 2CC8.tmp 132 PID 1728 wrote to memory of 4276 1728 2D16.tmp 133 PID 4276 wrote to memory of 3116 4276 2D74.tmp 134 PID 3116 wrote to memory of 5048 3116 2DC2.tmp 135 PID 5048 wrote to memory of 5004 5048 2E2F.tmp 136 PID 5004 wrote to memory of 3436 5004 2E7D.tmp 137 PID 3436 wrote to memory of 3764 3436 2ECB.tmp 138 PID 3764 wrote to memory of 912 3764 2F29.tmp 139 PID 912 wrote to memory of 2608 912 2F87.tmp 140 PID 2608 wrote to memory of 1996 2608 2FD5.tmp 141 PID 1996 wrote to memory of 1740 1996 3023.tmp 142 PID 1740 wrote to memory of 2344 1740 3071.tmp 143 PID 2344 wrote to memory of 572 2344 30CF.tmp 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_0fbdd72d071d0f4d29e595c1fae19f11_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_0fbdd72d071d0f4d29e595c1fae19f11_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"65⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"66⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"67⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"68⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3275.tmp"C:\Users\Admin\AppData\Local\Temp\3275.tmp"69⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"70⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"71⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"72⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"73⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"74⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"75⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"76⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"77⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"78⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"79⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"80⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"81⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"82⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"83⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\3795.tmp"C:\Users\Admin\AppData\Local\Temp\3795.tmp"84⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"85⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"87⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"89⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"90⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"91⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"92⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"93⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"94⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"95⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"96⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"97⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"98⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"99⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"100⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"101⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"102⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"103⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"104⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"105⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"106⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"107⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"108⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"109⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"110⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"111⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"112⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"113⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"114⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"115⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"116⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"117⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"118⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"119⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"120⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"121⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:3204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-