Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 11:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_22b5e81eba3bdbbe593fe1270f219f2d_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_22b5e81eba3bdbbe593fe1270f219f2d_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-19_22b5e81eba3bdbbe593fe1270f219f2d_elex_mafia.exe
- Size 520KB
- Sample260419-n4yfvset9x
- SHA256 a9ced2f36b0acc11370c02abd9615ee6ace7fb6cdc27d625bb830725fd784601
- MD5 22b5e81eba3bdbbe593fe1270f219f2d
- SHA1 8a3dd59c412b9fef8ec7ac41dbc3b23e80c4995e
- SHA512 71fb953b357ba8bb8e1913f58fbccd03793b630d61c979ceb7c174527e32b2d42b02b0a1c395126c236eba6aabb1e6c2ec128049f0813e408b29b0dc7984850c
- SSDEEP 12288:roRXOQjmOyHPcPekJRK5b+CBHGXpBjNDhj3LM7xoZNZ:rogQ9yHPcPeQEp+C6LjPMaZN
- TLSH T15EB4E0127984C032E9C265348B26DFA10A3F7D76172652C73BC43AAD6FB42D1D775382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4956 F0D8.tmp 4304 F155.tmp 2040 F1C2.tmp 5028 F23F.tmp 4912 F31A.tmp 4860 F3B6.tmp 2892 F405.tmp 1588 F482.tmp 5668 F4D0.tmp 1604 F51E.tmp 2372 F58B.tmp 952 F656.tmp 5204 F6F3.tmp 2212 F750.tmp 2980 F7CD.tmp 2968 F82B.tmp 3960 F8A8.tmp 4616 F925.tmp 3052 F9A2.tmp 3580 FA2F.tmp 5016 FAAC.tmp 2188 FB09.tmp 4220 FB77.tmp 1768 FBF4.tmp 1092 FC71.tmp 1800 FCCF.tmp 3384 FD3C.tmp 5320 FD9A.tmp 2160 FE17.tmp 2380 FE94.tmp 4260 FF30.tmp 608 FFBD.tmp 5916 49.tmp 5272 97.tmp 4356 105.tmp 3560 153.tmp 5552 1A1.tmp 2508 1EF.tmp 680 24D.tmp 5904 2BA.tmp 3412 328.tmp 1216 3A5.tmp 2120 3F3.tmp 4044 441.tmp 2180 4AE.tmp 5900 4FC.tmp 960 54A.tmp 2132 5B8.tmp 5944 625.tmp 3148 693.tmp 3056 700.tmp 5352 76D.tmp 4472 7CB.tmp 4564 819.tmp 3400 887.tmp 5600 8E4.tmp 1488 932.tmp 2716 981.tmp 2872 9DE.tmp 5420 A2C.tmp 4332 A8A.tmp 2572 AE8.tmp 3268 B55.tmp 4512 BA3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 460D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F79A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D56C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 213A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 489D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C53F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E6B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1452 wrote to memory of 4956 1452 2026-04-19_22b5e81eba3bdbbe593fe1270f219f2d_elex_mafia.exe 79 PID 4956 wrote to memory of 4304 4956 F0D8.tmp 80 PID 4304 wrote to memory of 2040 4304 F155.tmp 81 PID 2040 wrote to memory of 5028 2040 F1C2.tmp 82 PID 5028 wrote to memory of 4912 5028 F23F.tmp 83 PID 4912 wrote to memory of 4860 4912 F31A.tmp 84 PID 4860 wrote to memory of 2892 4860 F3B6.tmp 85 PID 2892 wrote to memory of 1588 2892 F405.tmp 86 PID 1588 wrote to memory of 5668 1588 F482.tmp 87 PID 5668 wrote to memory of 1604 5668 F4D0.tmp 88 PID 1604 wrote to memory of 2372 1604 F51E.tmp 89 PID 2372 wrote to memory of 952 2372 F58B.tmp 90 PID 952 wrote to memory of 5204 952 F656.tmp 91 PID 5204 wrote to memory of 2212 5204 F6F3.tmp 92 PID 2212 wrote to memory of 2980 2212 F750.tmp 93 PID 2980 wrote to memory of 2968 2980 F7CD.tmp 94 PID 2968 wrote to memory of 3960 2968 F82B.tmp 95 PID 3960 wrote to memory of 4616 3960 F8A8.tmp 96 PID 4616 wrote to memory of 3052 4616 F925.tmp 97 PID 3052 wrote to memory of 3580 3052 F9A2.tmp 98 PID 3580 wrote to memory of 5016 3580 FA2F.tmp 99 PID 5016 wrote to memory of 2188 5016 FAAC.tmp 100 PID 2188 wrote to memory of 4220 2188 FB09.tmp 101 PID 4220 wrote to memory of 1768 4220 FB77.tmp 102 PID 1768 wrote to memory of 1092 1768 FBF4.tmp 103 PID 1092 wrote to memory of 1800 1092 FC71.tmp 104 PID 1800 wrote to memory of 3384 1800 FCCF.tmp 105 PID 3384 wrote to memory of 5320 3384 FD3C.tmp 106 PID 5320 wrote to memory of 2160 5320 FD9A.tmp 107 PID 2160 wrote to memory of 2380 2160 FE17.tmp 108 PID 2380 wrote to memory of 4260 2380 FE94.tmp 109 PID 4260 wrote to memory of 608 4260 FF30.tmp 110 PID 608 wrote to memory of 5916 608 FFBD.tmp 111 PID 5916 wrote to memory of 5272 5916 49.tmp 112 PID 5272 wrote to memory of 4356 5272 97.tmp 113 PID 4356 wrote to memory of 3560 4356 105.tmp 114 PID 3560 wrote to memory of 5552 3560 153.tmp 115 PID 5552 wrote to memory of 2508 5552 1A1.tmp 116 PID 2508 wrote to memory of 680 2508 1EF.tmp 117 PID 680 wrote to memory of 5904 680 24D.tmp 118 PID 5904 wrote to memory of 3412 5904 2BA.tmp 119 PID 3412 wrote to memory of 1216 3412 328.tmp 120 PID 1216 wrote to memory of 2120 1216 3A5.tmp 121 PID 2120 wrote to memory of 4044 2120 3F3.tmp 122 PID 4044 wrote to memory of 2180 4044 441.tmp 123 PID 2180 wrote to memory of 5900 2180 4AE.tmp 124 PID 5900 wrote to memory of 960 5900 4FC.tmp 125 PID 960 wrote to memory of 2132 960 54A.tmp 126 PID 2132 wrote to memory of 5944 2132 5B8.tmp 127 PID 5944 wrote to memory of 3148 5944 625.tmp 128 PID 3148 wrote to memory of 3056 3148 693.tmp 129 PID 3056 wrote to memory of 5352 3056 700.tmp 130 PID 5352 wrote to memory of 4472 5352 76D.tmp 131 PID 4472 wrote to memory of 4564 4472 7CB.tmp 132 PID 4564 wrote to memory of 3400 4564 819.tmp 133 PID 3400 wrote to memory of 5600 3400 887.tmp 134 PID 5600 wrote to memory of 1488 5600 8E4.tmp 135 PID 1488 wrote to memory of 2716 1488 932.tmp 136 PID 2716 wrote to memory of 2872 2716 981.tmp 137 PID 2872 wrote to memory of 5420 2872 9DE.tmp 138 PID 5420 wrote to memory of 4332 5420 A2C.tmp 139 PID 4332 wrote to memory of 2572 4332 A8A.tmp 140 PID 2572 wrote to memory of 3268 2572 AE8.tmp 141 PID 3268 wrote to memory of 4512 3268 B55.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_22b5e81eba3bdbbe593fe1270f219f2d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_22b5e81eba3bdbbe593fe1270f219f2d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\76D.tmp"C:\Users\Admin\AppData\Local\Temp\76D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\819.tmp"C:\Users\Admin\AppData\Local\Temp\819.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\8E4.tmp"C:\Users\Admin\AppData\Local\Temp\8E4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\AE8.tmp"C:\Users\Admin\AppData\Local\Temp\AE8.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"66⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"67⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"68⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"69⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"70⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"71⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"72⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"73⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"74⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"75⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"76⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"77⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"78⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"79⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"80⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"81⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"82⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"83⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"84⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"85⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"86⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"87⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"88⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"89⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"90⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"91⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"92⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"93⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"94⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"95⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\1613.tmp"C:\Users\Admin\AppData\Local\Temp\1613.tmp"96⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"97⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"98⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"99⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"100⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"101⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"102⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"103⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"104⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"105⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"106⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"107⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"108⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"109⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"110⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"C:\Users\Admin\AppData\Local\Temp\1AD6.tmp"111⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"112⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"113⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"114⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"115⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"116⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"117⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"118⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"119⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"120⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"121⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-