Analysis
- max time kernel
150s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_4ed170a886a29dbb338ade380b300b9f_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_4ed170a886a29dbb338ade380b300b9f_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_4ed170a886a29dbb338ade380b300b9f_elex_mafia.exe
- Size 524KB
- Sample260511-bl2dkscv9j
- SHA256 032e5446f4ca46b00a06889731b443c647578b8cc8bebb39874bc7341df4ea83
- MD5 4ed170a886a29dbb338ade380b300b9f
- SHA1 312260fc6715ddd81a724d0521e6813ee8057eff
- SHA512 75ba70aafc518015fdd4733b658842fdad600770872ed2b2de28f8cce796419b4fb2534859b21e219bf0b588a54819b07e1967b58fc1d5e4551b5ad24b99e4f5
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf7W/2F5PzDUUccvS61n0txCQYoRGrAmy2AmyLjva:TRyZzqyL66T88P3UNl6Ix0AeNZ
- TLSH T103B4F116B548C032E19215365E66EBA2583A7C72AB27A4CB3BD435AE2FF13D1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4232 28A1.tmp 6000 296C.tmp 6136 2A66.tmp 5920 2B03.tmp 4788 2B8F.tmp 5752 2C3B.tmp 2536 2CE7.tmp 5320 2D93.tmp 4988 2E3F.tmp 4072 2ECB.tmp 4424 2F97.tmp 4576 3062.tmp 3552 30FE.tmp 2176 319A.tmp 1220 3236.tmp 5292 32E2.tmp 5388 336F.tmp 5208 33FC.tmp 1196 3488.tmp 4752 3563.tmp 5724 35F0.tmp 3708 368C.tmp 3740 3709.tmp 2072 37A5.tmp 2952 3822.tmp 5132 38BE.tmp 4968 394B.tmp 1456 39C8.tmp 1160 3A55.tmp 2548 3AE1.tmp 1636 3B8D.tmp 400 3C29.tmp 5408 3CB6.tmp 5200 3D23.tmp 5768 3DA0.tmp 5972 3E1D.tmp 2028 3E7B.tmp 1792 3F08.tmp 1804 3F94.tmp 2068 4011.tmp 5352 406F.tmp 4524 40CD.tmp 3840 413A.tmp 5696 41B7.tmp 3272 4225.tmp 4572 4292.tmp 4536 42F0.tmp 3996 435D.tmp 1748 43CA.tmp 1768 4419.tmp 3436 4467.tmp 5544 44B5.tmp 5468 4503.tmp 3248 4551.tmp 3536 45AF.tmp 936 45FD.tmp 2252 464B.tmp 4848 468A.tmp 5700 46E7.tmp 4648 4735.tmp 1708 4784.tmp 4960 47D2.tmp 3140 4820.tmp 6120 486E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F047.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E02A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E971.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 192B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6911.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 850A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D107.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 490A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 995D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4232 4320 2026-05-11_4ed170a886a29dbb338ade380b300b9f_elex_mafia.exe 79 PID 4232 wrote to memory of 6000 4232 28A1.tmp 80 PID 6000 wrote to memory of 6136 6000 296C.tmp 81 PID 6136 wrote to memory of 5920 6136 2A66.tmp 82 PID 5920 wrote to memory of 4788 5920 2B03.tmp 83 PID 4788 wrote to memory of 5752 4788 2B8F.tmp 84 PID 5752 wrote to memory of 2536 5752 2C3B.tmp 85 PID 2536 wrote to memory of 5320 2536 2CE7.tmp 86 PID 5320 wrote to memory of 4988 5320 2D93.tmp 87 PID 4988 wrote to memory of 4072 4988 2E3F.tmp 88 PID 4072 wrote to memory of 4424 4072 2ECB.tmp 89 PID 4424 wrote to memory of 4576 4424 2F97.tmp 90 PID 4576 wrote to memory of 3552 4576 3062.tmp 91 PID 3552 wrote to memory of 2176 3552 30FE.tmp 92 PID 2176 wrote to memory of 1220 2176 319A.tmp 93 PID 1220 wrote to memory of 5292 1220 3236.tmp 94 PID 5292 wrote to memory of 5388 5292 32E2.tmp 95 PID 5388 wrote to memory of 5208 5388 336F.tmp 96 PID 5208 wrote to memory of 1196 5208 33FC.tmp 97 PID 1196 wrote to memory of 4752 1196 3488.tmp 98 PID 4752 wrote to memory of 5724 4752 3563.tmp 99 PID 5724 wrote to memory of 3708 5724 35F0.tmp 100 PID 3708 wrote to memory of 3740 3708 368C.tmp 101 PID 3740 wrote to memory of 2072 3740 3709.tmp 102 PID 2072 wrote to memory of 2952 2072 37A5.tmp 103 PID 2952 wrote to memory of 5132 2952 3822.tmp 104 PID 5132 wrote to memory of 4968 5132 38BE.tmp 105 PID 4968 wrote to memory of 1456 4968 394B.tmp 106 PID 1456 wrote to memory of 1160 1456 39C8.tmp 107 PID 1160 wrote to memory of 2548 1160 3A55.tmp 108 PID 2548 wrote to memory of 1636 2548 3AE1.tmp 109 PID 1636 wrote to memory of 400 1636 3B8D.tmp 110 PID 400 wrote to memory of 5408 400 3C29.tmp 111 PID 5408 wrote to memory of 5200 5408 3CB6.tmp 112 PID 5200 wrote to memory of 5768 5200 3D23.tmp 113 PID 5768 wrote to memory of 5972 5768 3DA0.tmp 114 PID 5972 wrote to memory of 2028 5972 3E1D.tmp 115 PID 2028 wrote to memory of 1792 2028 3E7B.tmp 116 PID 1792 wrote to memory of 1804 1792 3F08.tmp 117 PID 1804 wrote to memory of 2068 1804 3F94.tmp 118 PID 2068 wrote to memory of 5352 2068 4011.tmp 119 PID 5352 wrote to memory of 4524 5352 406F.tmp 120 PID 4524 wrote to memory of 3840 4524 40CD.tmp 121 PID 3840 wrote to memory of 5696 3840 413A.tmp 122 PID 5696 wrote to memory of 3272 5696 41B7.tmp 123 PID 3272 wrote to memory of 4572 3272 4225.tmp 124 PID 4572 wrote to memory of 4536 4572 4292.tmp 125 PID 4536 wrote to memory of 3996 4536 42F0.tmp 126 PID 3996 wrote to memory of 1748 3996 435D.tmp 127 PID 1748 wrote to memory of 1768 1748 43CA.tmp 128 PID 1768 wrote to memory of 3436 1768 4419.tmp 129 PID 3436 wrote to memory of 5544 3436 4467.tmp 130 PID 5544 wrote to memory of 5468 5544 44B5.tmp 131 PID 5468 wrote to memory of 3248 5468 4503.tmp 132 PID 3248 wrote to memory of 3536 3248 4551.tmp 133 PID 3536 wrote to memory of 936 3536 45AF.tmp 134 PID 936 wrote to memory of 2252 936 45FD.tmp 135 PID 2252 wrote to memory of 4848 2252 464B.tmp 136 PID 4848 wrote to memory of 5700 4848 468A.tmp 137 PID 5700 wrote to memory of 4648 5700 46E7.tmp 138 PID 4648 wrote to memory of 1708 4648 4735.tmp 139 PID 1708 wrote to memory of 4960 1708 4784.tmp 140 PID 4960 wrote to memory of 3140 4960 47D2.tmp 141 PID 3140 wrote to memory of 6120 3140 4820.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_4ed170a886a29dbb338ade380b300b9f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4ed170a886a29dbb338ade380b300b9f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\37A5.tmp"C:\Users\Admin\AppData\Local\Temp\37A5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"C:\Users\Admin\AppData\Local\Temp\3B8D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"65⤵
- Executes dropped EXE
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"66⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"68⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"69⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"71⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"72⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"73⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"74⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"75⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"76⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"78⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"79⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"80⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"81⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"82⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"83⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"84⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\4E69.tmp"C:\Users\Admin\AppData\Local\Temp\4E69.tmp"85⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"86⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"87⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"89⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"90⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"91⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"92⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"93⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"94⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"95⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"96⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"97⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"98⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"99⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"100⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"101⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"102⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"103⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"104⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"105⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"106⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"107⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"108⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"109⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"110⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"111⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"112⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"113⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"114⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"115⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\5762.tmp"C:\Users\Admin\AppData\Local\Temp\5762.tmp"116⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"117⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"118⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"119⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"120⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"121⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"122⤵PID:3368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-