Analysis
- max time kernel
150s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-16_86b156ef61ca542383917f402c04d2be_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_86b156ef61ca542383917f402c04d2be_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-16_86b156ef61ca542383917f402c04d2be_elex_mafia.exe
- Size 560KB
- Sample260416-dtsshsh17v
- SHA256 a950f0c71875ba849054678c61e11c35af4405a953960b2d4af547ae5b9a750b
- MD5 86b156ef61ca542383917f402c04d2be
- SHA1 cbbd0a3fbf24fb16b9cf75e22efda780adb53f18
- SHA512 cad43afdb444e669f89940b9e1e3792b1a19cc7d96777f28a948d5efecb1607d11c54810578f1b455ba3406f79750b4edf66b077e3e658cd37f84afe7e908511
- SSDEEP 12288:MlFXOQUDmrC8SWJKU1DgQqKCzxWTvIZxV:MlUQbC8SWsEDtqKFIR
- TLSH T19EC4E0167588C073E29212314A12DBA22B7F7D35572AA4C737D4366E6FB42D0EB3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2428 FDE8.tmp 1160 FF11.tmp 3192 B.tmp 4224 105.tmp 3196 1B1.tmp 1812 1FF.tmp 940 23D.tmp 1040 28B.tmp 4356 49F.tmp 1540 579.tmp 3348 664.tmp 2188 75E.tmp 3876 858.tmp 4440 923.tmp 1672 9FE.tmp 4684 AE8.tmp 4584 BB3.tmp 5080 C9D.tmp 4384 D78.tmp 2908 E53.tmp 4232 F2E.tmp 3736 1008.tmp 2200 1141.tmp 916 122B.tmp 648 1325.tmp 4756 141F.tmp 4864 1529.tmp 1092 1633.tmp 5276 171D.tmp 5420 1817.tmp 5288 1901.tmp 5436 1A0B.tmp 5264 1B15.tmp 5524 1BC0.tmp 5516 1C6C.tmp 5616 1D09.tmp 5856 1DA5.tmp 5552 1E80.tmp 3972 1F5A.tmp 3000 2016.tmp 2852 20D1.tmp 980 216E.tmp 2252 220A.tmp 5212 22C5.tmp 1608 2390.tmp 4808 243C.tmp 5016 24E8.tmp 3188 25A4.tmp 5968 2630.tmp 4464 268E.tmp 2112 26EC.tmp 240 273A.tmp 2008 2788.tmp 5736 2805.tmp 404 2882.tmp 4460 28D0.tmp 1596 295D.tmp 3828 29CA.tmp 2592 2A28.tmp 1320 2AB5.tmp 4252 2B22.tmp 5680 2B8F.tmp 3548 2BED.tmp 5668 2C5A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A062.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 505D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 532C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C80E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3917.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B002.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E153.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 774E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B33E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA23.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 2428 3352 2026-04-16_86b156ef61ca542383917f402c04d2be_elex_mafia.exe 80 PID 2428 wrote to memory of 1160 2428 FDE8.tmp 81 PID 1160 wrote to memory of 3192 1160 FF11.tmp 82 PID 3192 wrote to memory of 4224 3192 B.tmp 83 PID 4224 wrote to memory of 3196 4224 105.tmp 84 PID 3196 wrote to memory of 1812 3196 1B1.tmp 85 PID 1812 wrote to memory of 940 1812 1FF.tmp 86 PID 940 wrote to memory of 1040 940 23D.tmp 87 PID 1040 wrote to memory of 4356 1040 28B.tmp 88 PID 4356 wrote to memory of 1540 4356 49F.tmp 89 PID 1540 wrote to memory of 3348 1540 579.tmp 90 PID 3348 wrote to memory of 2188 3348 664.tmp 91 PID 2188 wrote to memory of 3876 2188 75E.tmp 92 PID 3876 wrote to memory of 4440 3876 858.tmp 93 PID 4440 wrote to memory of 1672 4440 923.tmp 94 PID 1672 wrote to memory of 4684 1672 9FE.tmp 95 PID 4684 wrote to memory of 4584 4684 AE8.tmp 96 PID 4584 wrote to memory of 5080 4584 BB3.tmp 97 PID 5080 wrote to memory of 4384 5080 C9D.tmp 98 PID 4384 wrote to memory of 2908 4384 D78.tmp 99 PID 2908 wrote to memory of 4232 2908 E53.tmp 100 PID 4232 wrote to memory of 3736 4232 F2E.tmp 101 PID 3736 wrote to memory of 2200 3736 1008.tmp 102 PID 2200 wrote to memory of 916 2200 1141.tmp 103 PID 916 wrote to memory of 648 916 122B.tmp 104 PID 648 wrote to memory of 4756 648 1325.tmp 105 PID 4756 wrote to memory of 4864 4756 141F.tmp 106 PID 4864 wrote to memory of 1092 4864 1529.tmp 107 PID 1092 wrote to memory of 5276 1092 1633.tmp 108 PID 5276 wrote to memory of 5420 5276 171D.tmp 109 PID 5420 wrote to memory of 5288 5420 1817.tmp 110 PID 5288 wrote to memory of 5436 5288 1901.tmp 111 PID 5436 wrote to memory of 5264 5436 1A0B.tmp 112 PID 5264 wrote to memory of 5524 5264 1B15.tmp 113 PID 5524 wrote to memory of 5516 5524 1BC0.tmp 114 PID 5516 wrote to memory of 5616 5516 1C6C.tmp 115 PID 5616 wrote to memory of 5856 5616 1D09.tmp 116 PID 5856 wrote to memory of 5552 5856 1DA5.tmp 117 PID 5552 wrote to memory of 3972 5552 1E80.tmp 118 PID 3972 wrote to memory of 3000 3972 1F5A.tmp 119 PID 3000 wrote to memory of 2852 3000 2016.tmp 120 PID 2852 wrote to memory of 980 2852 20D1.tmp 121 PID 980 wrote to memory of 2252 980 216E.tmp 122 PID 2252 wrote to memory of 5212 2252 220A.tmp 123 PID 5212 wrote to memory of 1608 5212 22C5.tmp 124 PID 1608 wrote to memory of 4808 1608 2390.tmp 125 PID 4808 wrote to memory of 5016 4808 243C.tmp 126 PID 5016 wrote to memory of 3188 5016 24E8.tmp 127 PID 3188 wrote to memory of 5968 3188 25A4.tmp 128 PID 5968 wrote to memory of 4464 5968 2630.tmp 129 PID 4464 wrote to memory of 2112 4464 268E.tmp 130 PID 2112 wrote to memory of 240 2112 26EC.tmp 131 PID 240 wrote to memory of 2008 240 273A.tmp 132 PID 2008 wrote to memory of 5736 2008 2788.tmp 133 PID 5736 wrote to memory of 404 5736 2805.tmp 134 PID 404 wrote to memory of 4460 404 2882.tmp 135 PID 4460 wrote to memory of 1596 4460 28D0.tmp 136 PID 1596 wrote to memory of 3828 1596 295D.tmp 137 PID 3828 wrote to memory of 2592 3828 29CA.tmp 138 PID 2592 wrote to memory of 1320 2592 2A28.tmp 139 PID 1320 wrote to memory of 4252 1320 2AB5.tmp 140 PID 4252 wrote to memory of 5680 4252 2B22.tmp 141 PID 5680 wrote to memory of 3548 5680 2B8F.tmp 142 PID 3548 wrote to memory of 5668 3548 2BED.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_86b156ef61ca542383917f402c04d2be_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_86b156ef61ca542383917f402c04d2be_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\29CA.tmp"C:\Users\Admin\AppData\Local\Temp\29CA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"65⤵
- Executes dropped EXE
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"66⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"67⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"68⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"69⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"70⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"71⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"72⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"73⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"74⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"75⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"76⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"77⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"78⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"80⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"81⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"82⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"83⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3311.tmp"C:\Users\Admin\AppData\Local\Temp\3311.tmp"84⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"85⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"86⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"87⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"88⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"89⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"90⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"91⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"92⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"93⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"94⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"95⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"96⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\3757.tmp"C:\Users\Admin\AppData\Local\Temp\3757.tmp"97⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\37A5.tmp"C:\Users\Admin\AppData\Local\Temp\37A5.tmp"98⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"99⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"100⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"101⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"102⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"103⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"104⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"105⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"106⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"107⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"108⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"109⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"110⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"111⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"112⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"113⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"114⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"115⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"116⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"117⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"118⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"119⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"120⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"121⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"122⤵PID:5956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-