Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_b50ae901e51c59382ce4278d2186c9b5_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_b50ae901e51c59382ce4278d2186c9b5_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_b50ae901e51c59382ce4278d2186c9b5_elex_mafia.exe
- Size 560KB
- Sample260511-mt26maaz8p
- SHA256 148b698036e4cc4e3e9aefc10f9d04cbc63a1089ae8a3ad17f004a6bc837e9c6
- MD5 b50ae901e51c59382ce4278d2186c9b5
- SHA1 a7ffea00930691b5171b26c941275c4a81471dd2
- SHA512 8a341e28772a0fe0876c77b648123edfea8a71fa6f9f5ee4632acc3e27aeae6774b7ebce70d7655ddc96268d1ddf615c2b225244f709ef821df4302b974f1557
- SSDEEP 12288:MlFXOQUDmrC8ScKwZBIhcjuxjsL/mBBFIZxV:MlUQbC8SIZBM6uxjWgBFIR
- TLSH T18DC4F1123584C073E6D216304A56CBA22B3F7C355B29A5CB3BD4272EAFB52C1DA7534B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1952 7692.tmp 2684 770F.tmp 5964 775E.tmp 5268 7942.tmp 5356 7A5B.tmp 5424 7B65.tmp 5384 7C7E.tmp 5572 7D59.tmp 2076 7DC6.tmp 3300 7E34.tmp 5548 7E82.tmp 5608 7EDF.tmp 5588 81FC.tmp 4872 82F6.tmp 5140 83C1.tmp 5940 8529.tmp 5756 8613.tmp 5796 86EE.tmp 6084 87E8.tmp 5700 8920.tmp 5724 8A49.tmp 6016 8B24.tmp 4840 8BFF.tmp 3652 8CCA.tmp 3292 8DC4.tmp 4312 8E9F.tmp 5280 8FB8.tmp 4268 90C2.tmp 5024 91EA.tmp 4488 9304.tmp 4900 941D.tmp 4800 94F8.tmp 3808 9621.tmp 2600 96AD.tmp 1448 973A.tmp 4692 97B7.tmp 5000 9853.tmp 6088 990F.tmp 3896 99DA.tmp 3436 9AA5.tmp 3356 9B51.tmp 2968 9BED.tmp 4668 9C89.tmp 4592 9D45.tmp 4968 9E00.tmp 5008 9EAC.tmp 244 9F48.tmp 832 9FF4.tmp 3236 A081.tmp 1068 A0DF.tmp 4080 A12D.tmp 2996 A18A.tmp 1784 A1F8.tmp 5564 A265.tmp 2196 A2D3.tmp 3368 A321.tmp 4564 A36F.tmp 3000 A3BD.tmp 3156 A42A.tmp 3172 A498.tmp 2800 A505.tmp 4160 A572.tmp 2540 A5E0.tmp 3760 A64D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F42A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6018.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D42E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B179.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D50E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1952 3640 2026-05-11_b50ae901e51c59382ce4278d2186c9b5_elex_mafia.exe 80 PID 1952 wrote to memory of 2684 1952 7692.tmp 81 PID 2684 wrote to memory of 5964 2684 770F.tmp 82 PID 5964 wrote to memory of 5268 5964 775E.tmp 83 PID 5268 wrote to memory of 5356 5268 7942.tmp 84 PID 5356 wrote to memory of 5424 5356 7A5B.tmp 85 PID 5424 wrote to memory of 5384 5424 7B65.tmp 86 PID 5384 wrote to memory of 5572 5384 7C7E.tmp 87 PID 5572 wrote to memory of 2076 5572 7D59.tmp 88 PID 2076 wrote to memory of 3300 2076 7DC6.tmp 89 PID 3300 wrote to memory of 5548 3300 7E34.tmp 90 PID 5548 wrote to memory of 5608 5548 7E82.tmp 91 PID 5608 wrote to memory of 5588 5608 7EDF.tmp 92 PID 5588 wrote to memory of 4872 5588 81FC.tmp 93 PID 4872 wrote to memory of 5140 4872 82F6.tmp 94 PID 5140 wrote to memory of 5940 5140 83C1.tmp 95 PID 5940 wrote to memory of 5756 5940 8529.tmp 96 PID 5756 wrote to memory of 5796 5756 8613.tmp 97 PID 5796 wrote to memory of 6084 5796 86EE.tmp 98 PID 6084 wrote to memory of 5700 6084 87E8.tmp 99 PID 5700 wrote to memory of 5724 5700 8920.tmp 100 PID 5724 wrote to memory of 6016 5724 8A49.tmp 101 PID 6016 wrote to memory of 4840 6016 8B24.tmp 102 PID 4840 wrote to memory of 3652 4840 8BFF.tmp 103 PID 3652 wrote to memory of 3292 3652 8CCA.tmp 104 PID 3292 wrote to memory of 4312 3292 8DC4.tmp 105 PID 4312 wrote to memory of 5280 4312 8E9F.tmp 106 PID 5280 wrote to memory of 4268 5280 8FB8.tmp 107 PID 4268 wrote to memory of 5024 4268 90C2.tmp 108 PID 5024 wrote to memory of 4488 5024 91EA.tmp 109 PID 4488 wrote to memory of 4900 4488 9304.tmp 110 PID 4900 wrote to memory of 4800 4900 941D.tmp 111 PID 4800 wrote to memory of 3808 4800 94F8.tmp 112 PID 3808 wrote to memory of 2600 3808 9621.tmp 113 PID 2600 wrote to memory of 1448 2600 96AD.tmp 114 PID 1448 wrote to memory of 4692 1448 973A.tmp 115 PID 4692 wrote to memory of 5000 4692 97B7.tmp 116 PID 5000 wrote to memory of 6088 5000 9853.tmp 117 PID 6088 wrote to memory of 3896 6088 990F.tmp 118 PID 3896 wrote to memory of 3436 3896 99DA.tmp 119 PID 3436 wrote to memory of 3356 3436 9AA5.tmp 120 PID 3356 wrote to memory of 2968 3356 9B51.tmp 121 PID 2968 wrote to memory of 4668 2968 9BED.tmp 122 PID 4668 wrote to memory of 4592 4668 9C89.tmp 123 PID 4592 wrote to memory of 4968 4592 9D45.tmp 124 PID 4968 wrote to memory of 5008 4968 9E00.tmp 125 PID 5008 wrote to memory of 244 5008 9EAC.tmp 126 PID 244 wrote to memory of 832 244 9F48.tmp 127 PID 832 wrote to memory of 3236 832 9FF4.tmp 128 PID 3236 wrote to memory of 1068 3236 A081.tmp 129 PID 1068 wrote to memory of 4080 1068 A0DF.tmp 130 PID 4080 wrote to memory of 2996 4080 A12D.tmp 131 PID 2996 wrote to memory of 1784 2996 A18A.tmp 132 PID 1784 wrote to memory of 5564 1784 A1F8.tmp 133 PID 5564 wrote to memory of 2196 5564 A265.tmp 134 PID 2196 wrote to memory of 3368 2196 A2D3.tmp 135 PID 3368 wrote to memory of 4564 3368 A321.tmp 136 PID 4564 wrote to memory of 3000 4564 A36F.tmp 137 PID 3000 wrote to memory of 3156 3000 A3BD.tmp 138 PID 3156 wrote to memory of 3172 3156 A42A.tmp 139 PID 3172 wrote to memory of 2800 3172 A498.tmp 140 PID 2800 wrote to memory of 4160 2800 A505.tmp 141 PID 4160 wrote to memory of 2540 4160 A572.tmp 142 PID 2540 wrote to memory of 3760 2540 A5E0.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_b50ae901e51c59382ce4278d2186c9b5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_b50ae901e51c59382ce4278d2186c9b5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"C:\Users\Admin\AppData\Local\Temp\7C7E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\8529.tmp"C:\Users\Admin\AppData\Local\Temp\8529.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\8920.tmp"C:\Users\Admin\AppData\Local\Temp\8920.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\90C2.tmp"C:\Users\Admin\AppData\Local\Temp\90C2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\91EA.tmp"C:\Users\Admin\AppData\Local\Temp\91EA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\941D.tmp"C:\Users\Admin\AppData\Local\Temp\941D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\973A.tmp"C:\Users\Admin\AppData\Local\Temp\973A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\99DA.tmp"C:\Users\Admin\AppData\Local\Temp\99DA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\9D45.tmp"C:\Users\Admin\AppData\Local\Temp\9D45.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\A081.tmp"C:\Users\Admin\AppData\Local\Temp\A081.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\A0DF.tmp"C:\Users\Admin\AppData\Local\Temp\A0DF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\A18A.tmp"C:\Users\Admin\AppData\Local\Temp\A18A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A265.tmp"C:\Users\Admin\AppData\Local\Temp\A265.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\A321.tmp"C:\Users\Admin\AppData\Local\Temp\A321.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\A36F.tmp"C:\Users\Admin\AppData\Local\Temp\A36F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A42A.tmp"C:\Users\Admin\AppData\Local\Temp\A42A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\A572.tmp"C:\Users\Admin\AppData\Local\Temp\A572.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"65⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"66⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"68⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"70⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"71⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"72⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"73⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"74⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"75⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"76⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"77⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"78⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"79⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\ABEB.tmp"C:\Users\Admin\AppData\Local\Temp\ABEB.tmp"80⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\AC39.tmp"C:\Users\Admin\AppData\Local\Temp\AC39.tmp"81⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"82⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"C:\Users\Admin\AppData\Local\Temp\ACF4.tmp"83⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"84⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"85⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"86⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"87⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\AF17.tmp"C:\Users\Admin\AppData\Local\Temp\AF17.tmp"89⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"90⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"91⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"92⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"93⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"94⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\B11B.tmp"C:\Users\Admin\AppData\Local\Temp\B11B.tmp"95⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\B179.tmp"C:\Users\Admin\AppData\Local\Temp\B179.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"97⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"98⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"99⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"100⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\B35D.tmp"C:\Users\Admin\AppData\Local\Temp\B35D.tmp"101⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"102⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"103⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"104⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"C:\Users\Admin\AppData\Local\Temp\B4C4.tmp"105⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\B512.tmp"C:\Users\Admin\AppData\Local\Temp\B512.tmp"106⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\B561.tmp"C:\Users\Admin\AppData\Local\Temp\B561.tmp"107⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"108⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"109⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\B66A.tmp"C:\Users\Admin\AppData\Local\Temp\B66A.tmp"110⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"111⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"112⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\B793.tmp"C:\Users\Admin\AppData\Local\Temp\B793.tmp"113⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"114⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"115⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B87D.tmp"C:\Users\Admin\AppData\Local\Temp\B87D.tmp"116⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B8DB.tmp"C:\Users\Admin\AppData\Local\Temp\B8DB.tmp"117⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\B958.tmp"C:\Users\Admin\AppData\Local\Temp\B958.tmp"118⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"C:\Users\Admin\AppData\Local\Temp\B9A6.tmp"119⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"120⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"121⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"122⤵PID:2052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-