Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_cab4439775a881ebabafa4c2c423cdcd_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_cab4439775a881ebabafa4c2c423cdcd_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-15_cab4439775a881ebabafa4c2c423cdcd_elex_mafia.exe
- Size 816KB
- Sample260420-ltpd4abs5y
- SHA256 6f8704f59182ddc7a51e511e8b56b68c980d0df66fd103468d4e907eaa240395
- MD5 cab4439775a881ebabafa4c2c423cdcd
- SHA1 c76f38427b1ae5c4d42c5a5a551d58ce06d63cb5
- SHA512 06db02cbc870e2f01b192227637324def91fbeaf54f3fd894cfa8087a6ee11861a68fc1da9c3aca60b95b96923ddba3b0ce02bcfd4f4b4a23caacddce858012c
- SSDEEP 12288:+mF/W8Dsy3CVmrZxt/H+jbMbakadJzC8W3Z:+m0833CmZx1H+vWIW3
- TLSH T1D405F121F644C532E69201344EAAEB62097B7D615B2764C7BB9037BDAFB13D2DA35303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4896 1A.tmp 3276 78.tmp 4620 D6.tmp 2952 143.tmp 4404 191.tmp 2872 20E.tmp 3636 25C.tmp 5028 2BA.tmp 5048 318.tmp 4712 366.tmp 2780 3B4.tmp 3372 3F3.tmp 1628 49F.tmp 1944 4ED.tmp 2112 53B.tmp 908 589.tmp 4280 5D7.tmp 4364 635.tmp 5868 6B2.tmp 5640 700.tmp 3380 74E.tmp 5632 7BB.tmp 6036 838.tmp 1300 887.tmp 4688 8F4.tmp 3188 961.tmp 2816 9EE.tmp 480 A5B.tmp 3128 AC9.tmp 2124 B26.tmp 1832 B84.tmp 5256 BF2.tmp 588 C6F.tmp 5308 CCC.tmp 3908 D49.tmp 5668 DA7.tmp 1956 E05.tmp 5964 E72.tmp 1604 EE0.tmp 8 F3D.tmp 3368 FAB.tmp 2488 1008.tmp 2008 1076.tmp 2304 10D4.tmp 2924 1141.tmp 2868 11AE.tmp 1848 120C.tmp 5464 125A.tmp 1584 12A8.tmp 1760 1306.tmp 3904 1354.tmp 5176 13D1.tmp 5724 142F.tmp 4276 147D.tmp 4976 14DB.tmp 736 1529.tmp 5320 1577.tmp 896 15D5.tmp 4576 1633.tmp 1232 1681.tmp 1824 16DE.tmp 5568 172D.tmp 2540 177B.tmp 1752 17C9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4225.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A38E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 411B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 125A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5678.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD71.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 4896 4924 2026-04-15_cab4439775a881ebabafa4c2c423cdcd_elex_mafia.exe 79 PID 4896 wrote to memory of 3276 4896 1A.tmp 80 PID 3276 wrote to memory of 4620 3276 78.tmp 81 PID 4620 wrote to memory of 2952 4620 D6.tmp 82 PID 2952 wrote to memory of 4404 2952 143.tmp 83 PID 4404 wrote to memory of 2872 4404 191.tmp 84 PID 2872 wrote to memory of 3636 2872 20E.tmp 85 PID 3636 wrote to memory of 5028 3636 25C.tmp 86 PID 5028 wrote to memory of 5048 5028 2BA.tmp 87 PID 5048 wrote to memory of 4712 5048 318.tmp 88 PID 4712 wrote to memory of 2780 4712 366.tmp 89 PID 2780 wrote to memory of 3372 2780 3B4.tmp 90 PID 3372 wrote to memory of 1628 3372 3F3.tmp 91 PID 1628 wrote to memory of 1944 1628 49F.tmp 92 PID 1944 wrote to memory of 2112 1944 4ED.tmp 93 PID 2112 wrote to memory of 908 2112 53B.tmp 94 PID 908 wrote to memory of 4280 908 589.tmp 95 PID 4280 wrote to memory of 4364 4280 5D7.tmp 96 PID 4364 wrote to memory of 5868 4364 635.tmp 97 PID 5868 wrote to memory of 5640 5868 6B2.tmp 98 PID 5640 wrote to memory of 3380 5640 700.tmp 99 PID 3380 wrote to memory of 5632 3380 74E.tmp 100 PID 5632 wrote to memory of 6036 5632 7BB.tmp 101 PID 6036 wrote to memory of 1300 6036 838.tmp 102 PID 1300 wrote to memory of 4688 1300 887.tmp 103 PID 4688 wrote to memory of 3188 4688 8F4.tmp 104 PID 3188 wrote to memory of 2816 3188 961.tmp 105 PID 2816 wrote to memory of 480 2816 9EE.tmp 106 PID 480 wrote to memory of 3128 480 A5B.tmp 107 PID 3128 wrote to memory of 2124 3128 AC9.tmp 108 PID 2124 wrote to memory of 1832 2124 B26.tmp 109 PID 1832 wrote to memory of 5256 1832 B84.tmp 110 PID 5256 wrote to memory of 588 5256 BF2.tmp 111 PID 588 wrote to memory of 5308 588 C6F.tmp 112 PID 5308 wrote to memory of 3908 5308 CCC.tmp 113 PID 3908 wrote to memory of 5668 3908 D49.tmp 114 PID 5668 wrote to memory of 1956 5668 DA7.tmp 115 PID 1956 wrote to memory of 5964 1956 E05.tmp 116 PID 5964 wrote to memory of 1604 5964 E72.tmp 117 PID 1604 wrote to memory of 8 1604 EE0.tmp 118 PID 8 wrote to memory of 3368 8 F3D.tmp 119 PID 3368 wrote to memory of 2488 3368 FAB.tmp 120 PID 2488 wrote to memory of 2008 2488 1008.tmp 121 PID 2008 wrote to memory of 2304 2008 1076.tmp 122 PID 2304 wrote to memory of 2924 2304 10D4.tmp 123 PID 2924 wrote to memory of 2868 2924 1141.tmp 124 PID 2868 wrote to memory of 1848 2868 11AE.tmp 125 PID 1848 wrote to memory of 5464 1848 120C.tmp 126 PID 5464 wrote to memory of 1584 5464 125A.tmp 127 PID 1584 wrote to memory of 1760 1584 12A8.tmp 128 PID 1760 wrote to memory of 3904 1760 1306.tmp 129 PID 3904 wrote to memory of 5176 3904 1354.tmp 130 PID 5176 wrote to memory of 5724 5176 13D1.tmp 131 PID 5724 wrote to memory of 4276 5724 142F.tmp 132 PID 4276 wrote to memory of 4976 4276 147D.tmp 133 PID 4976 wrote to memory of 736 4976 14DB.tmp 134 PID 736 wrote to memory of 5320 736 1529.tmp 135 PID 5320 wrote to memory of 896 5320 1577.tmp 136 PID 896 wrote to memory of 4576 896 15D5.tmp 137 PID 4576 wrote to memory of 1232 4576 1633.tmp 138 PID 1232 wrote to memory of 1824 1232 1681.tmp 139 PID 1824 wrote to memory of 5568 1824 16DE.tmp 140 PID 5568 wrote to memory of 2540 5568 172D.tmp 141 PID 2540 wrote to memory of 1752 2540 177B.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_cab4439775a881ebabafa4c2c423cdcd_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_cab4439775a881ebabafa4c2c423cdcd_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"65⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"66⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"67⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"68⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"70⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"71⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"72⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"73⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"74⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"75⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"76⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"77⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"78⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"79⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:132 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"81⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"82⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"83⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"84⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"85⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"86⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"87⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"88⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"89⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"90⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"91⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"92⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"93⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"94⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"96⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"97⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"98⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"99⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"100⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"101⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"102⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"103⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"104⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"105⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\2556.tmp"C:\Users\Admin\AppData\Local\Temp\2556.tmp"106⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"107⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"108⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"109⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"110⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"111⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"112⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"113⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"114⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"115⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"116⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"117⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"118⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"119⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"120⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"121⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"122⤵PID:6080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-