Analysis
- max time kernel
150s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_bb16ffab217fdc3f4a695b8a6cad0502_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_bb16ffab217fdc3f4a695b8a6cad0502_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-02_bb16ffab217fdc3f4a695b8a6cad0502_elex_mafia.exe
- Size 520KB
- Sample260602-qabfcaez8k
- SHA256 3c1b81dd4a064a8081220ccb46a8fb95b31b6c2b10f972b8e547ab16c5d391c8
- MD5 bb16ffab217fdc3f4a695b8a6cad0502
- SHA1 b08890fd56ed30d1a9ce41029ba725e1cd9775ee
- SHA512 658017e660785234ff7d1df058079c1340b788bef3fc5f0d47fa90830c8e507c24fb6cd3adc6215e313f58309dacc4268ceb00cc3c24fc555622110241777c6e
- SSDEEP 12288:gj8fuxR21t5i8fDlRDoQeGF4vvzF5AckGoW9NZ6:gj8fuK1GYDlSQexrFScIW9NI
- TLSH T175B4F1127989C032E9D616304B16DBA10BBE7DB59B3694CB3B803A7D6EB52D1D73430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4960 DB3D.tmp 4828 DB9B.tmp 4788 DC08.tmp 5604 DC95.tmp 5568 DD21.tmp 652 DD7F.tmp 5564 DDEC.tmp 4916 DE69.tmp 2456 DEE6.tmp 3476 DF44.tmp 5456 DF83.tmp 5616 E00F.tmp 5032 E07D.tmp 1636 E0EA.tmp 3056 E177.tmp 5172 E1C5.tmp 6108 E251.tmp 3432 E2DE.tmp 1208 E36B.tmp 2060 E3C8.tmp 1992 E436.tmp 5864 E4A3.tmp 4236 E520.tmp 6012 E58D.tmp 2568 E5FB.tmp 5304 E678.tmp 6084 E6E5.tmp 5164 E733.tmp 3404 E781.tmp 1712 E7EF.tmp 5924 E85C.tmp 1352 E8AA.tmp 832 E908.tmp 2476 E947.tmp 796 E9A4.tmp 6128 EA02.tmp 5508 EA50.tmp 5252 EA8F.tmp 2384 EAEC.tmp 5452 EB4A.tmp 4020 EBA8.tmp 4220 EBF6.tmp 5412 EC44.tmp 3904 EC92.tmp 5192 ECE0.tmp 5448 ED2F.tmp 2480 ED7D.tmp 4368 EDDA.tmp 2148 EE29.tmp 4988 EE77.tmp 3940 EEB5.tmp 3648 EF13.tmp 1064 EF71.tmp 3668 EFCE.tmp 2472 F02C.tmp 1212 F07A.tmp 840 F0D8.tmp 988 F136.tmp 5256 F194.tmp 2984 F1F1.tmp 5428 F23F.tmp 2132 F28E.tmp 5280 F2DC.tmp 6140 F339.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A90C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 870D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B24.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4960 4616 2026-06-02_bb16ffab217fdc3f4a695b8a6cad0502_elex_mafia.exe 79 PID 4960 wrote to memory of 4828 4960 DB3D.tmp 80 PID 4828 wrote to memory of 4788 4828 DB9B.tmp 81 PID 4788 wrote to memory of 5604 4788 DC08.tmp 82 PID 5604 wrote to memory of 5568 5604 DC95.tmp 83 PID 5568 wrote to memory of 652 5568 DD21.tmp 84 PID 652 wrote to memory of 5564 652 DD7F.tmp 85 PID 5564 wrote to memory of 4916 5564 DDEC.tmp 86 PID 4916 wrote to memory of 2456 4916 DE69.tmp 87 PID 2456 wrote to memory of 3476 2456 DEE6.tmp 88 PID 3476 wrote to memory of 5456 3476 DF44.tmp 89 PID 5456 wrote to memory of 5616 5456 DF83.tmp 90 PID 5616 wrote to memory of 5032 5616 E00F.tmp 91 PID 5032 wrote to memory of 1636 5032 E07D.tmp 92 PID 1636 wrote to memory of 3056 1636 E0EA.tmp 93 PID 3056 wrote to memory of 5172 3056 E177.tmp 94 PID 5172 wrote to memory of 6108 5172 E1C5.tmp 95 PID 6108 wrote to memory of 3432 6108 E251.tmp 96 PID 3432 wrote to memory of 1208 3432 E2DE.tmp 97 PID 1208 wrote to memory of 2060 1208 E36B.tmp 98 PID 2060 wrote to memory of 1992 2060 E3C8.tmp 99 PID 1992 wrote to memory of 5864 1992 E436.tmp 100 PID 5864 wrote to memory of 4236 5864 E4A3.tmp 101 PID 4236 wrote to memory of 6012 4236 E520.tmp 102 PID 6012 wrote to memory of 2568 6012 E58D.tmp 103 PID 2568 wrote to memory of 5304 2568 E5FB.tmp 104 PID 5304 wrote to memory of 6084 5304 E678.tmp 105 PID 6084 wrote to memory of 5164 6084 E6E5.tmp 106 PID 5164 wrote to memory of 3404 5164 E733.tmp 107 PID 3404 wrote to memory of 1712 3404 E781.tmp 108 PID 1712 wrote to memory of 5924 1712 E7EF.tmp 109 PID 5924 wrote to memory of 1352 5924 E85C.tmp 110 PID 1352 wrote to memory of 832 1352 E8AA.tmp 111 PID 832 wrote to memory of 2476 832 E908.tmp 112 PID 2476 wrote to memory of 796 2476 E947.tmp 113 PID 796 wrote to memory of 6128 796 E9A4.tmp 114 PID 6128 wrote to memory of 5508 6128 EA02.tmp 115 PID 5508 wrote to memory of 5252 5508 EA50.tmp 116 PID 5252 wrote to memory of 2384 5252 EA8F.tmp 117 PID 2384 wrote to memory of 5452 2384 EAEC.tmp 118 PID 5452 wrote to memory of 4020 5452 EB4A.tmp 119 PID 4020 wrote to memory of 4220 4020 EBA8.tmp 120 PID 4220 wrote to memory of 5412 4220 EBF6.tmp 121 PID 5412 wrote to memory of 3904 5412 EC44.tmp 122 PID 3904 wrote to memory of 5192 3904 EC92.tmp 123 PID 5192 wrote to memory of 5448 5192 ECE0.tmp 124 PID 5448 wrote to memory of 2480 5448 ED2F.tmp 125 PID 2480 wrote to memory of 4368 2480 ED7D.tmp 126 PID 4368 wrote to memory of 2148 4368 EDDA.tmp 127 PID 2148 wrote to memory of 4988 2148 EE29.tmp 128 PID 4988 wrote to memory of 3940 4988 EE77.tmp 129 PID 3940 wrote to memory of 3648 3940 EEB5.tmp 130 PID 3648 wrote to memory of 1064 3648 EF13.tmp 131 PID 1064 wrote to memory of 3668 1064 EF71.tmp 132 PID 3668 wrote to memory of 2472 3668 EFCE.tmp 133 PID 2472 wrote to memory of 1212 2472 F02C.tmp 134 PID 1212 wrote to memory of 840 1212 F07A.tmp 135 PID 840 wrote to memory of 988 840 F0D8.tmp 136 PID 988 wrote to memory of 5256 988 F136.tmp 137 PID 5256 wrote to memory of 2984 5256 F194.tmp 138 PID 2984 wrote to memory of 5428 2984 F1F1.tmp 139 PID 5428 wrote to memory of 2132 5428 F23F.tmp 140 PID 2132 wrote to memory of 5280 2132 F28E.tmp 141 PID 5280 wrote to memory of 6140 5280 F2DC.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_bb16ffab217fdc3f4a695b8a6cad0502_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_bb16ffab217fdc3f4a695b8a6cad0502_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"65⤵
- Executes dropped EXE
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\F388.tmp"C:\Users\Admin\AppData\Local\Temp\F388.tmp"66⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"67⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"68⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"69⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"70⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"71⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"72⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"73⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"74⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"75⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"76⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"77⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"78⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"79⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"80⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"81⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"82⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"83⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\F964.tmp"C:\Users\Admin\AppData\Local\Temp\F964.tmp"84⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"85⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"86⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"88⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"89⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"90⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"91⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"92⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"93⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"94⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"95⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"96⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"97⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"98⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"99⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"100⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"101⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"102⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"103⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"104⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"105⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"106⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"107⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"108⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"109⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"111⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"112⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"113⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"114⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"115⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"116⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"117⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"118⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"119⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"120⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"121⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"122⤵PID:1056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-