Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-05_ef20d693cefcb7eb599b593b060ccd7c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_ef20d693cefcb7eb599b593b060ccd7c_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-05_ef20d693cefcb7eb599b593b060ccd7c_elex_mafia.exe
- Size 560KB
- Sample260605-bdjtkah16w
- SHA256 ea8b7d443c1437d3be2903f5deab42443b645fdf8f40c0f980cb4ea17c020bb1
- MD5 ef20d693cefcb7eb599b593b060ccd7c
- SHA1 8cf9270b4d211efc17a92a24da76c6391d164b6c
- SHA512 2b0c21b6586d0fbf227b1e446713797a40e9ab7487992aaabb158bd98a06420f1fc5460fc33aa7b92709c88cf57096d155d99bb16191add8fff53c446ce4b305
- SSDEEP 12288:MlFXOQUDmrC8S9Hi2/mc0aO9VDTSejN2D6aW/UGIZxV:MlUQbC8S9Hi2/mLaO/WY2DXW8GIR
- TLSH T131C4F1123548C073E59206344A26DB922B3F7D764B29A5C73B84366EAFB53C0D77934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2608 4FC.tmp 4612 5C7.tmp 2348 6C1.tmp 4272 7AC.tmp 1852 858.tmp 2208 8A6.tmp 1644 961.tmp 2236 A1D.tmp 1304 AC9.tmp 2748 B84.tmp 4260 C30.tmp 1364 CCC.tmp 3152 D59.tmp 4868 DF5.tmp 1520 E72.tmp 3764 F1E.tmp 1320 FBA.tmp 3160 1057.tmp 808 10F3.tmp 4544 11AE.tmp 2064 122B.tmp 4840 12C8.tmp 2488 1373.tmp 4320 142F.tmp 2304 14AC.tmp 236 1529.tmp 1528 15C5.tmp 4616 1652.tmp 684 16FE.tmp 3292 177B.tmp 1884 1817.tmp 4788 1894.tmp 4124 1921.tmp 4288 196F.tmp 1208 19FB.tmp 2632 1A59.tmp 2376 1AD6.tmp 3936 1B53.tmp 4784 1BC0.tmp 4364 1C1E.tmp 4796 1C8C.tmp 2332 1D09.tmp 1028 1D66.tmp 1516 1DC4.tmp 3628 1E41.tmp 4688 1EAE.tmp 2860 1F0C.tmp 2388 1F6A.tmp 2072 1FD7.tmp 3372 2025.tmp 4512 2074.tmp 900 20C2.tmp 448 2110.tmp 2768 215E.tmp 1288 21AC.tmp 1872 21FA.tmp 2200 2248.tmp 1048 2296.tmp 4380 22E5.tmp 956 2342.tmp 4780 2381.tmp 584 23CF.tmp 2732 241D.tmp 2320 246B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 538A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 215E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 343A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E153.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E01A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 2608 4624 2026-06-05_ef20d693cefcb7eb599b593b060ccd7c_elex_mafia.exe 80 PID 2608 wrote to memory of 4612 2608 4FC.tmp 81 PID 4612 wrote to memory of 2348 4612 5C7.tmp 82 PID 2348 wrote to memory of 4272 2348 6C1.tmp 83 PID 4272 wrote to memory of 1852 4272 7AC.tmp 84 PID 1852 wrote to memory of 2208 1852 858.tmp 85 PID 2208 wrote to memory of 1644 2208 8A6.tmp 86 PID 1644 wrote to memory of 2236 1644 961.tmp 87 PID 2236 wrote to memory of 1304 2236 A1D.tmp 88 PID 1304 wrote to memory of 2748 1304 AC9.tmp 89 PID 2748 wrote to memory of 4260 2748 B84.tmp 90 PID 4260 wrote to memory of 1364 4260 C30.tmp 91 PID 1364 wrote to memory of 3152 1364 CCC.tmp 92 PID 3152 wrote to memory of 4868 3152 D59.tmp 93 PID 4868 wrote to memory of 1520 4868 DF5.tmp 94 PID 1520 wrote to memory of 3764 1520 E72.tmp 95 PID 3764 wrote to memory of 1320 3764 F1E.tmp 96 PID 1320 wrote to memory of 3160 1320 FBA.tmp 97 PID 3160 wrote to memory of 808 3160 1057.tmp 98 PID 808 wrote to memory of 4544 808 10F3.tmp 99 PID 4544 wrote to memory of 2064 4544 11AE.tmp 100 PID 2064 wrote to memory of 4840 2064 122B.tmp 101 PID 4840 wrote to memory of 2488 4840 12C8.tmp 102 PID 2488 wrote to memory of 4320 2488 1373.tmp 103 PID 4320 wrote to memory of 2304 4320 142F.tmp 104 PID 2304 wrote to memory of 236 2304 14AC.tmp 105 PID 236 wrote to memory of 1528 236 1529.tmp 106 PID 1528 wrote to memory of 4616 1528 15C5.tmp 107 PID 4616 wrote to memory of 684 4616 1652.tmp 108 PID 684 wrote to memory of 3292 684 16FE.tmp 109 PID 3292 wrote to memory of 1884 3292 177B.tmp 110 PID 1884 wrote to memory of 4788 1884 1817.tmp 111 PID 4788 wrote to memory of 4124 4788 1894.tmp 112 PID 4124 wrote to memory of 4288 4124 1921.tmp 113 PID 4288 wrote to memory of 1208 4288 196F.tmp 114 PID 1208 wrote to memory of 2632 1208 19FB.tmp 115 PID 2632 wrote to memory of 2376 2632 1A59.tmp 116 PID 2376 wrote to memory of 3936 2376 1AD6.tmp 117 PID 3936 wrote to memory of 4784 3936 1B53.tmp 118 PID 4784 wrote to memory of 4364 4784 1BC0.tmp 119 PID 4364 wrote to memory of 4796 4364 1C1E.tmp 120 PID 4796 wrote to memory of 2332 4796 1C8C.tmp 121 PID 2332 wrote to memory of 1028 2332 1D09.tmp 122 PID 1028 wrote to memory of 1516 1028 1D66.tmp 123 PID 1516 wrote to memory of 3628 1516 1DC4.tmp 124 PID 3628 wrote to memory of 4688 3628 1E41.tmp 125 PID 4688 wrote to memory of 2860 4688 1EAE.tmp 126 PID 2860 wrote to memory of 2388 2860 1F0C.tmp 127 PID 2388 wrote to memory of 2072 2388 1F6A.tmp 128 PID 2072 wrote to memory of 3372 2072 1FD7.tmp 129 PID 3372 wrote to memory of 4512 3372 2025.tmp 130 PID 4512 wrote to memory of 900 4512 2074.tmp 131 PID 900 wrote to memory of 448 900 20C2.tmp 132 PID 448 wrote to memory of 2768 448 2110.tmp 133 PID 2768 wrote to memory of 1288 2768 215E.tmp 134 PID 1288 wrote to memory of 1872 1288 21AC.tmp 135 PID 1872 wrote to memory of 2200 1872 21FA.tmp 136 PID 2200 wrote to memory of 1048 2200 2248.tmp 137 PID 1048 wrote to memory of 4380 1048 2296.tmp 138 PID 4380 wrote to memory of 956 4380 22E5.tmp 139 PID 956 wrote to memory of 4780 956 2342.tmp 140 PID 4780 wrote to memory of 584 4780 2381.tmp 141 PID 584 wrote to memory of 2732 584 23CF.tmp 142 PID 2732 wrote to memory of 2320 2732 241D.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_ef20d693cefcb7eb599b593b060ccd7c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_ef20d693cefcb7eb599b593b060ccd7c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\2074.tmp"C:\Users\Admin\AppData\Local\Temp\2074.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"65⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"66⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"67⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"68⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"69⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"70⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"71⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"72⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"73⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"74⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"75⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"76⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"77⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\2844.tmp"C:\Users\Admin\AppData\Local\Temp\2844.tmp"78⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\2892.tmp"C:\Users\Admin\AppData\Local\Temp\2892.tmp"79⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"80⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"81⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"82⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"83⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"84⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"85⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"86⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"87⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"88⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"89⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"90⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"91⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"93⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"94⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"95⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"96⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"97⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"98⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"99⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"C:\Users\Admin\AppData\Local\Temp\2EFA.tmp"100⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"101⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"102⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"103⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"104⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"105⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"106⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"107⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"108⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"109⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\31D9.tmp"C:\Users\Admin\AppData\Local\Temp\31D9.tmp"110⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"111⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"112⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"113⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"114⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"115⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"116⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"117⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"119⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"120⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"121⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"122⤵PID:1236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-