Analysis
- max time kernel
150s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/04/2026, 05:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-27_f7e98e1c291aeede76b3e5448ee67a52_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-27_f7e98e1c291aeede76b3e5448ee67a52_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-27_f7e98e1c291aeede76b3e5448ee67a52_elex_mafia.exe
- Size 816KB
- Sample260427-gnkrhae19m
- SHA256 60403274855af1a06cd9513c97a8ad6c6aeb5e7178e06e8b949cdbe057a7e4e9
- MD5 f7e98e1c291aeede76b3e5448ee67a52
- SHA1 a464e485abfa12e894dfd65560e848d0942ca59e
- SHA512 5bcafe092fbd51f5724e2909e22cfa88d7050ecaabbdae0a96f9b0e883c4062c70aef4c5057b34d0a16ea2b8ecb55594c7382ef9d9c6a7b2ad906f32df2e893c
- SSDEEP 6144:2fzZD/P+lZs2rdEkyc54b8DsanxRl9D0i9xroH90XwYFn9xW0ZNqfp1rbx9L8qfx:+mF/W8Dsy3Bu90pFXZwfvrbx9L8cv3Z
- TLSH T19805F122B644C133E69211344E1AEB92493BBD614727A5CBBB90366E3FB43D1EB75307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2896 4541.tmp 2244 459F.tmp 3280 463B.tmp 3820 46C8.tmp 1168 4716.tmp 3492 4784.tmp 6064 4810.tmp 5564 488D.tmp 3264 490A.tmp 4920 49A6.tmp 3024 4A33.tmp 2892 4AB0.tmp 3092 4B2D.tmp 5436 4B9A.tmp 5776 4C27.tmp 3768 4CB4.tmp 2476 4D11.tmp 3400 4DAE.tmp 3352 4E2B.tmp 3864 4EA8.tmp 4632 4EF6.tmp 5472 4F73.tmp 2784 4FF0.tmp 2144 504E.tmp 2140 50CB.tmp 5276 5128.tmp 2148 51A5.tmp 988 5232.tmp 3824 5280.tmp 2044 52FD.tmp 5768 538A.tmp 5612 5407.tmp 5312 54A3.tmp 5696 5501.tmp 4036 554F.tmp 556 559D.tmp 4912 55EB.tmp 5336 5639.tmp 2956 5687.tmp 4808 56E5.tmp 1504 5743.tmp 3112 5791.tmp 2436 57FE.tmp 2368 586C.tmp 2544 58BA.tmp 1924 5918.tmp 3852 5975.tmp 3188 59D3.tmp 976 5A31.tmp 5508 5A8F.tmp 5516 5AEC.tmp 4624 5B3A.tmp 2264 5B98.tmp 4092 5BF6.tmp 5572 5C44.tmp 1668 5C92.tmp 2192 5CE0.tmp 2588 5D1F.tmp 2856 5D7D.tmp 2360 5DCB.tmp 664 5E19.tmp 4396 5E67.tmp 1752 5EB5.tmp 1292 5F13.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C510.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8122.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F25A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F44E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 970B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6935.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 748A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4360 wrote to memory of 2896 4360 2026-04-27_f7e98e1c291aeede76b3e5448ee67a52_elex_mafia.exe 79 PID 2896 wrote to memory of 2244 2896 4541.tmp 80 PID 2244 wrote to memory of 3280 2244 459F.tmp 81 PID 3280 wrote to memory of 3820 3280 463B.tmp 82 PID 3820 wrote to memory of 1168 3820 46C8.tmp 83 PID 1168 wrote to memory of 3492 1168 4716.tmp 84 PID 3492 wrote to memory of 6064 3492 4784.tmp 85 PID 6064 wrote to memory of 5564 6064 4810.tmp 86 PID 5564 wrote to memory of 3264 5564 488D.tmp 87 PID 3264 wrote to memory of 4920 3264 490A.tmp 88 PID 4920 wrote to memory of 3024 4920 49A6.tmp 89 PID 3024 wrote to memory of 2892 3024 4A33.tmp 90 PID 2892 wrote to memory of 3092 2892 4AB0.tmp 91 PID 3092 wrote to memory of 5436 3092 4B2D.tmp 92 PID 5436 wrote to memory of 5776 5436 4B9A.tmp 93 PID 5776 wrote to memory of 3768 5776 4C27.tmp 94 PID 3768 wrote to memory of 2476 3768 4CB4.tmp 95 PID 2476 wrote to memory of 3400 2476 4D11.tmp 96 PID 3400 wrote to memory of 3352 3400 4DAE.tmp 97 PID 3352 wrote to memory of 3864 3352 4E2B.tmp 98 PID 3864 wrote to memory of 4632 3864 4EA8.tmp 99 PID 4632 wrote to memory of 5472 4632 4EF6.tmp 100 PID 5472 wrote to memory of 2784 5472 4F73.tmp 101 PID 2784 wrote to memory of 2144 2784 4FF0.tmp 102 PID 2144 wrote to memory of 2140 2144 504E.tmp 103 PID 2140 wrote to memory of 5276 2140 50CB.tmp 104 PID 5276 wrote to memory of 2148 5276 5128.tmp 105 PID 2148 wrote to memory of 988 2148 51A5.tmp 106 PID 988 wrote to memory of 3824 988 5232.tmp 107 PID 3824 wrote to memory of 2044 3824 5280.tmp 108 PID 2044 wrote to memory of 5768 2044 52FD.tmp 109 PID 5768 wrote to memory of 5612 5768 538A.tmp 110 PID 5612 wrote to memory of 5312 5612 5407.tmp 111 PID 5312 wrote to memory of 5696 5312 54A3.tmp 112 PID 5696 wrote to memory of 4036 5696 5501.tmp 113 PID 4036 wrote to memory of 556 4036 554F.tmp 114 PID 556 wrote to memory of 4912 556 559D.tmp 115 PID 4912 wrote to memory of 5336 4912 55EB.tmp 116 PID 5336 wrote to memory of 2956 5336 5639.tmp 117 PID 2956 wrote to memory of 4808 2956 5687.tmp 118 PID 4808 wrote to memory of 1504 4808 56E5.tmp 119 PID 1504 wrote to memory of 3112 1504 5743.tmp 120 PID 3112 wrote to memory of 2436 3112 5791.tmp 121 PID 2436 wrote to memory of 2368 2436 57FE.tmp 122 PID 2368 wrote to memory of 2544 2368 586C.tmp 123 PID 2544 wrote to memory of 1924 2544 58BA.tmp 124 PID 1924 wrote to memory of 3852 1924 5918.tmp 125 PID 3852 wrote to memory of 3188 3852 5975.tmp 126 PID 3188 wrote to memory of 976 3188 59D3.tmp 127 PID 976 wrote to memory of 5508 976 5A31.tmp 128 PID 5508 wrote to memory of 5516 5508 5A8F.tmp 129 PID 5516 wrote to memory of 4624 5516 5AEC.tmp 130 PID 4624 wrote to memory of 2264 4624 5B3A.tmp 131 PID 2264 wrote to memory of 4092 2264 5B98.tmp 132 PID 4092 wrote to memory of 5572 4092 5BF6.tmp 133 PID 5572 wrote to memory of 1668 5572 5C44.tmp 134 PID 1668 wrote to memory of 2192 1668 5C92.tmp 135 PID 2192 wrote to memory of 2588 2192 5CE0.tmp 136 PID 2588 wrote to memory of 2856 2588 5D1F.tmp 137 PID 2856 wrote to memory of 2360 2856 5D7D.tmp 138 PID 2360 wrote to memory of 664 2360 5DCB.tmp 139 PID 664 wrote to memory of 4396 664 5E19.tmp 140 PID 4396 wrote to memory of 1752 4396 5E67.tmp 141 PID 1752 wrote to memory of 1292 1752 5EB5.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-27_f7e98e1c291aeede76b3e5448ee67a52_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-27_f7e98e1c291aeede76b3e5448ee67a52_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\5743.tmp"C:\Users\Admin\AppData\Local\Temp\5743.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"65⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"66⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"67⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"68⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"69⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"70⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"71⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\6165.tmp"C:\Users\Admin\AppData\Local\Temp\6165.tmp"72⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"73⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"74⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"75⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"76⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"77⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"78⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"79⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\63F5.tmp"C:\Users\Admin\AppData\Local\Temp\63F5.tmp"80⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"81⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"82⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"83⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"84⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"85⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"86⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"87⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"88⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"89⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"90⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"91⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"92⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"93⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"94⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"95⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"97⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"98⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"99⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"100⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"101⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"102⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"103⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"104⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"106⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"107⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"108⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"109⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"110⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"111⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"112⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\6F01.tmp"C:\Users\Admin\AppData\Local\Temp\6F01.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"114⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"115⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"116⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"117⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\70B6.tmp"C:\Users\Admin\AppData\Local\Temp\70B6.tmp"118⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"119⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"120⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"121⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-