Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 23:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_e803f56f4d26cee7155511de30c77e3b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_e803f56f4d26cee7155511de30c77e3b_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-03_e803f56f4d26cee7155511de30c77e3b_elex_mafia.exe
- Size 521KB
- Sample260703-3pvtradv5j
- SHA256 7d8b5f52829f61c7e25f8f4ad760bda04d2037cab9cb7fed5f3f72935f672513
- MD5 e803f56f4d26cee7155511de30c77e3b
- SHA1 32d8da742a26cae0e56725c8fda8ad2cc5873c1d
- SHA512 6020443e0ce0346a1c878ac16d68f1ff9633b13f15e49a4ab12e2ed89ff758551d31c1af86a3091b3662f314796858adb4c20cacf859d55c6821ab5d05037ce5
- SSDEEP 12288:gOlvWUTES1PrFA0ygNjXtqKgCDcU5xQ6FkagRNZi:gOkU/1PpAeBIKDcUzpFrgNg
- TLSH T19EB4E011B559C033E29211304FA6EBB22C3F7C359B2559C72B903A2D6FB06E1E6B9717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1424 8577.tmp 2824 8604.tmp 544 8661.tmp 3484 86BF.tmp 1564 872C.tmp 1292 879A.tmp 5244 8807.tmp 3780 8865.tmp 3740 88B3.tmp 4484 8911.tmp 4072 897E.tmp 4304 89DC.tmp 5216 8A49.tmp 3804 8A97.tmp 4288 8AF5.tmp 5104 8B53.tmp 756 8BC0.tmp 2772 8C0E.tmp 5472 8C8B.tmp 5248 8D18.tmp 5424 8E22.tmp 5940 8E7F.tmp 5680 8EED.tmp 3444 8F4B.tmp 5376 8FA8.tmp 3928 8FF6.tmp 1952 9064.tmp 3088 90C2.tmp 5772 911F.tmp 1504 916D.tmp 5656 91BC.tmp 124 9239.tmp 3324 9296.tmp 4764 92F4.tmp 2644 9342.tmp 4148 9390.tmp 4728 93DE.tmp 4248 942D.tmp 4236 949A.tmp 3404 94E8.tmp 1184 9536.tmp 3864 9584.tmp 3256 95D2.tmp 5528 9621.tmp 3280 966F.tmp 2924 96CC.tmp 3872 972A.tmp 2812 9788.tmp 1768 97D6.tmp 5768 9824.tmp 5876 9872.tmp 6116 98D0.tmp 4060 992E.tmp 4224 997C.tmp 5208 99CA.tmp 3856 9A18.tmp 3792 9A66.tmp 4536 9AB4.tmp 4824 9B03.tmp 4876 9B51.tmp 2500 9B9F.tmp 5068 9BED.tmp 996 9C3B.tmp 5352 9C89.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B25E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 990A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 212A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A275.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1424 1928 2026-07-03_e803f56f4d26cee7155511de30c77e3b_elex_mafia.exe 88 PID 1424 wrote to memory of 2824 1424 8577.tmp 89 PID 2824 wrote to memory of 544 2824 8604.tmp 90 PID 544 wrote to memory of 3484 544 8661.tmp 91 PID 3484 wrote to memory of 1564 3484 86BF.tmp 92 PID 1564 wrote to memory of 1292 1564 872C.tmp 93 PID 1292 wrote to memory of 5244 1292 879A.tmp 94 PID 5244 wrote to memory of 3780 5244 8807.tmp 95 PID 3780 wrote to memory of 3740 3780 8865.tmp 96 PID 3740 wrote to memory of 4484 3740 88B3.tmp 97 PID 4484 wrote to memory of 4072 4484 8911.tmp 98 PID 4072 wrote to memory of 4304 4072 897E.tmp 99 PID 4304 wrote to memory of 5216 4304 89DC.tmp 100 PID 5216 wrote to memory of 3804 5216 8A49.tmp 101 PID 3804 wrote to memory of 4288 3804 8A97.tmp 102 PID 4288 wrote to memory of 5104 4288 8AF5.tmp 103 PID 5104 wrote to memory of 756 5104 8B53.tmp 104 PID 756 wrote to memory of 2772 756 8BC0.tmp 105 PID 2772 wrote to memory of 5472 2772 8C0E.tmp 106 PID 5472 wrote to memory of 5248 5472 8C8B.tmp 107 PID 5248 wrote to memory of 5424 5248 8D18.tmp 108 PID 5424 wrote to memory of 5940 5424 8E22.tmp 109 PID 5940 wrote to memory of 5680 5940 8E7F.tmp 110 PID 5680 wrote to memory of 3444 5680 8EED.tmp 111 PID 3444 wrote to memory of 5376 3444 8F4B.tmp 112 PID 5376 wrote to memory of 3928 5376 8FA8.tmp 113 PID 3928 wrote to memory of 1952 3928 8FF6.tmp 114 PID 1952 wrote to memory of 3088 1952 9064.tmp 115 PID 3088 wrote to memory of 5772 3088 90C2.tmp 116 PID 5772 wrote to memory of 1504 5772 911F.tmp 117 PID 1504 wrote to memory of 5656 1504 916D.tmp 118 PID 5656 wrote to memory of 124 5656 91BC.tmp 119 PID 124 wrote to memory of 3324 124 9239.tmp 120 PID 3324 wrote to memory of 4764 3324 9296.tmp 121 PID 4764 wrote to memory of 2644 4764 92F4.tmp 122 PID 2644 wrote to memory of 4148 2644 9342.tmp 123 PID 4148 wrote to memory of 4728 4148 9390.tmp 124 PID 4728 wrote to memory of 4248 4728 93DE.tmp 125 PID 4248 wrote to memory of 4236 4248 942D.tmp 126 PID 4236 wrote to memory of 3404 4236 949A.tmp 127 PID 3404 wrote to memory of 1184 3404 94E8.tmp 128 PID 1184 wrote to memory of 3864 1184 9536.tmp 129 PID 3864 wrote to memory of 3256 3864 9584.tmp 130 PID 3256 wrote to memory of 5528 3256 95D2.tmp 131 PID 5528 wrote to memory of 3280 5528 9621.tmp 132 PID 3280 wrote to memory of 2924 3280 966F.tmp 133 PID 2924 wrote to memory of 3872 2924 96CC.tmp 134 PID 3872 wrote to memory of 2812 3872 972A.tmp 135 PID 2812 wrote to memory of 1768 2812 9788.tmp 136 PID 1768 wrote to memory of 5768 1768 97D6.tmp 137 PID 5768 wrote to memory of 5876 5768 9824.tmp 138 PID 5876 wrote to memory of 6116 5876 9872.tmp 139 PID 6116 wrote to memory of 4060 6116 98D0.tmp 140 PID 4060 wrote to memory of 4224 4060 992E.tmp 141 PID 4224 wrote to memory of 5208 4224 997C.tmp 142 PID 5208 wrote to memory of 3856 5208 99CA.tmp 143 PID 3856 wrote to memory of 3792 3856 9A18.tmp 144 PID 3792 wrote to memory of 4536 3792 9A66.tmp 145 PID 4536 wrote to memory of 4824 4536 9AB4.tmp 146 PID 4824 wrote to memory of 4876 4824 9B03.tmp 147 PID 4876 wrote to memory of 2500 4876 9B51.tmp 148 PID 2500 wrote to memory of 5068 2500 9B9F.tmp 149 PID 5068 wrote to memory of 996 5068 9BED.tmp 150 PID 996 wrote to memory of 5352 996 9C3B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_e803f56f4d26cee7155511de30c77e3b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_e803f56f4d26cee7155511de30c77e3b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\8577.tmp"C:\Users\Admin\AppData\Local\Temp\8577.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\8604.tmp"C:\Users\Admin\AppData\Local\Temp\8604.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\897E.tmp"C:\Users\Admin\AppData\Local\Temp\897E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\89DC.tmp"C:\Users\Admin\AppData\Local\Temp\89DC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\8A97.tmp"C:\Users\Admin\AppData\Local\Temp\8A97.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\8B53.tmp"C:\Users\Admin\AppData\Local\Temp\8B53.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\8C0E.tmp"C:\Users\Admin\AppData\Local\Temp\8C0E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\8E22.tmp"C:\Users\Admin\AppData\Local\Temp\8E22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\90C2.tmp"C:\Users\Admin\AppData\Local\Temp\90C2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\91BC.tmp"C:\Users\Admin\AppData\Local\Temp\91BC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\92F4.tmp"C:\Users\Admin\AppData\Local\Temp\92F4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9342.tmp"C:\Users\Admin\AppData\Local\Temp\9342.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\942D.tmp"C:\Users\Admin\AppData\Local\Temp\942D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\949A.tmp"C:\Users\Admin\AppData\Local\Temp\949A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\9536.tmp"C:\Users\Admin\AppData\Local\Temp\9536.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9584.tmp"C:\Users\Admin\AppData\Local\Temp\9584.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\95D2.tmp"C:\Users\Admin\AppData\Local\Temp\95D2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\966F.tmp"C:\Users\Admin\AppData\Local\Temp\966F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\96CC.tmp"C:\Users\Admin\AppData\Local\Temp\96CC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\972A.tmp"C:\Users\Admin\AppData\Local\Temp\972A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\9788.tmp"C:\Users\Admin\AppData\Local\Temp\9788.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\97D6.tmp"C:\Users\Admin\AppData\Local\Temp\97D6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\9824.tmp"C:\Users\Admin\AppData\Local\Temp\9824.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\9872.tmp"C:\Users\Admin\AppData\Local\Temp\9872.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\98D0.tmp"C:\Users\Admin\AppData\Local\Temp\98D0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\992E.tmp"C:\Users\Admin\AppData\Local\Temp\992E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\9A18.tmp"C:\Users\Admin\AppData\Local\Temp\9A18.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"65⤵
- Executes dropped EXE
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"66⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"67⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"68⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"69⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"70⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"71⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"72⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\9F19.tmp"C:\Users\Admin\AppData\Local\Temp\9F19.tmp"73⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"74⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"75⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"76⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"77⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"78⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"C:\Users\Admin\AppData\Local\Temp\A0EE.tmp"79⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"80⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\A18A.tmp"C:\Users\Admin\AppData\Local\Temp\A18A.tmp"81⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"82⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\A227.tmp"C:\Users\Admin\AppData\Local\Temp\A227.tmp"83⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"C:\Users\Admin\AppData\Local\Temp\A2C3.tmp"85⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\A311.tmp"C:\Users\Admin\AppData\Local\Temp\A311.tmp"86⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\A35F.tmp"C:\Users\Admin\AppData\Local\Temp\A35F.tmp"87⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"88⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"89⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\A44A.tmp"C:\Users\Admin\AppData\Local\Temp\A44A.tmp"90⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"91⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"92⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\A572.tmp"C:\Users\Admin\AppData\Local\Temp\A572.tmp"93⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"94⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"95⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"96⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"97⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"98⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"99⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\A870.tmp"C:\Users\Admin\AppData\Local\Temp\A870.tmp"100⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"101⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\A94B.tmp"C:\Users\Admin\AppData\Local\Temp\A94B.tmp"102⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"103⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\AA45.tmp"C:\Users\Admin\AppData\Local\Temp\AA45.tmp"104⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"105⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"106⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"107⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"108⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\AC77.tmp"C:\Users\Admin\AppData\Local\Temp\AC77.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"110⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\AD81.tmp"C:\Users\Admin\AppData\Local\Temp\AD81.tmp"111⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"112⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"113⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\AF27.tmp"C:\Users\Admin\AppData\Local\Temp\AF27.tmp"115⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"116⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"117⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\B07F.tmp"C:\Users\Admin\AppData\Local\Temp\B07F.tmp"118⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"119⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\B215.tmp"C:\Users\Admin\AppData\Local\Temp\B215.tmp"121⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\B282.tmp"C:\Users\Admin\AppData\Local\Temp\B282.tmp"122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-