Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_73d7b3e0f7d437dcde99034dd84d3d19_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_73d7b3e0f7d437dcde99034dd84d3d19_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_73d7b3e0f7d437dcde99034dd84d3d19_elex_mafia.exe
- Size 518KB
- Sample260717-2dv5psfx8m
- SHA256 4154dd6fffc8a2147f2ce0b71e57f5e625853bee381fe95dc046a9a7809eb150
- MD5 73d7b3e0f7d437dcde99034dd84d3d19
- SHA1 2dd5730b749c5a1e9f19270943d072b45a455204
- SHA512 aa9862ce5e6fa784c9d4cfde990081cdfdc037967f276f47ef918f0c896bf418faab22d67dbf7ff981d7c9c8924ae2ea22582938bb2ac2d9bb9255bec874209e
- SSDEEP 12288:Jf1yBOtIZdpH+IKeUglMjjQnNu7AbvYCDZXKZofl+NZ:JfcBzZdcIKdglMjjANu7AAaYN
- TLSH T1F6B4F111B984C036E6D306308B62EBA2593A3CB59B2694CBABC4767E2F753D1D734347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4912 F095.tmp 1528 F160.tmp 3088 F25A.tmp 4916 F335.tmp 4184 F42F.tmp 4312 F519.tmp 1408 F623.tmp 4380 F6DE.tmp 5520 F7C9.tmp 2404 F8D2.tmp 5640 F98E.tmp 4308 FA78.tmp 4072 FB91.tmp 3652 FC9B.tmp 2788 FD66.tmp 1740 FE9F.tmp 5476 FFA8.tmp 464 93.tmp 264 18D.tmp 3228 287.tmp 1480 390.tmp 4284 48A.tmp 1644 555.tmp 1140 640.tmp 2440 749.tmp 5980 814.tmp 4692 90E.tmp 3424 9F9.tmp 3176 AD4.tmp 2564 BDD.tmp 5744 D06.tmp 1324 DD1.tmp 4604 ECB.tmp 5516 F87.tmp 5836 1004.tmp 3184 1090.tmp 6136 112D.tmp 4700 11C9.tmp 3048 1246.tmp 3948 12F2.tmp 1068 138E.tmp 1988 143A.tmp 5388 14E6.tmp 5108 1563.tmp 1444 160F.tmp 1084 16CA.tmp 5780 1757.tmp 5976 17C4.tmp 1116 1870.tmp 3744 18ED.tmp 2156 1989.tmp 4924 1A35.tmp 3776 1AC2.tmp 3940 1B4E.tmp 2004 1BEB.tmp 6096 1C87.tmp 3944 1D04.tmp 3808 1DA0.tmp 5492 1E2D.tmp 2260 1EAA.tmp 1204 1F46.tmp 5372 2001.tmp 2600 207E.tmp 4628 211B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 709D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B84A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B75F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 867C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 717D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 143A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8514.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4912 3428 2026-07-17_73d7b3e0f7d437dcde99034dd84d3d19_elex_mafia.exe 89 PID 4912 wrote to memory of 1528 4912 F095.tmp 90 PID 1528 wrote to memory of 3088 1528 F160.tmp 91 PID 3088 wrote to memory of 4916 3088 F25A.tmp 92 PID 4916 wrote to memory of 4184 4916 F335.tmp 93 PID 4184 wrote to memory of 4312 4184 F42F.tmp 94 PID 4312 wrote to memory of 1408 4312 F519.tmp 95 PID 1408 wrote to memory of 4380 1408 F623.tmp 96 PID 4380 wrote to memory of 5520 4380 F6DE.tmp 97 PID 5520 wrote to memory of 2404 5520 F7C9.tmp 98 PID 2404 wrote to memory of 5640 2404 F8D2.tmp 99 PID 5640 wrote to memory of 4308 5640 F98E.tmp 100 PID 4308 wrote to memory of 4072 4308 FA78.tmp 101 PID 4072 wrote to memory of 3652 4072 FB91.tmp 102 PID 3652 wrote to memory of 2788 3652 FC9B.tmp 103 PID 2788 wrote to memory of 1740 2788 FD66.tmp 104 PID 1740 wrote to memory of 5476 1740 FE9F.tmp 105 PID 5476 wrote to memory of 464 5476 FFA8.tmp 106 PID 464 wrote to memory of 264 464 93.tmp 107 PID 264 wrote to memory of 3228 264 18D.tmp 108 PID 3228 wrote to memory of 1480 3228 287.tmp 109 PID 1480 wrote to memory of 4284 1480 390.tmp 110 PID 4284 wrote to memory of 1644 4284 48A.tmp 111 PID 1644 wrote to memory of 1140 1644 555.tmp 112 PID 1140 wrote to memory of 2440 1140 640.tmp 113 PID 2440 wrote to memory of 5980 2440 749.tmp 114 PID 5980 wrote to memory of 4692 5980 814.tmp 115 PID 4692 wrote to memory of 3424 4692 90E.tmp 116 PID 3424 wrote to memory of 3176 3424 9F9.tmp 117 PID 3176 wrote to memory of 2564 3176 AD4.tmp 118 PID 2564 wrote to memory of 5744 2564 BDD.tmp 119 PID 5744 wrote to memory of 1324 5744 D06.tmp 120 PID 1324 wrote to memory of 4604 1324 DD1.tmp 121 PID 4604 wrote to memory of 5516 4604 ECB.tmp 122 PID 5516 wrote to memory of 5836 5516 F87.tmp 123 PID 5836 wrote to memory of 3184 5836 1004.tmp 124 PID 3184 wrote to memory of 6136 3184 1090.tmp 125 PID 6136 wrote to memory of 4700 6136 112D.tmp 126 PID 4700 wrote to memory of 3048 4700 11C9.tmp 127 PID 3048 wrote to memory of 3948 3048 1246.tmp 128 PID 3948 wrote to memory of 1068 3948 12F2.tmp 129 PID 1068 wrote to memory of 1988 1068 138E.tmp 130 PID 1988 wrote to memory of 5388 1988 143A.tmp 131 PID 5388 wrote to memory of 5108 5388 14E6.tmp 132 PID 5108 wrote to memory of 1444 5108 1563.tmp 133 PID 1444 wrote to memory of 1084 1444 160F.tmp 134 PID 1084 wrote to memory of 5780 1084 16CA.tmp 135 PID 5780 wrote to memory of 5976 5780 1757.tmp 136 PID 5976 wrote to memory of 1116 5976 17C4.tmp 137 PID 1116 wrote to memory of 3744 1116 1870.tmp 138 PID 3744 wrote to memory of 2156 3744 18ED.tmp 139 PID 2156 wrote to memory of 4924 2156 1989.tmp 140 PID 4924 wrote to memory of 3776 4924 1A35.tmp 141 PID 3776 wrote to memory of 3940 3776 1AC2.tmp 142 PID 3940 wrote to memory of 2004 3940 1B4E.tmp 143 PID 2004 wrote to memory of 6096 2004 1BEB.tmp 144 PID 6096 wrote to memory of 3944 6096 1C87.tmp 145 PID 3944 wrote to memory of 3808 3944 1D04.tmp 146 PID 3808 wrote to memory of 5492 3808 1DA0.tmp 147 PID 5492 wrote to memory of 2260 5492 1E2D.tmp 148 PID 2260 wrote to memory of 1204 2260 1EAA.tmp 149 PID 1204 wrote to memory of 5372 1204 1F46.tmp 150 PID 5372 wrote to memory of 2600 5372 2001.tmp 151 PID 2600 wrote to memory of 4628 2600 207E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_73d7b3e0f7d437dcde99034dd84d3d19_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_73d7b3e0f7d437dcde99034dd84d3d19_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\F095.tmp"C:\Users\Admin\AppData\Local\Temp\F095.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\F160.tmp"C:\Users\Admin\AppData\Local\Temp\F160.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\F42F.tmp"C:\Users\Admin\AppData\Local\Temp\F42F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\F623.tmp"C:\Users\Admin\AppData\Local\Temp\F623.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"C:\Users\Admin\AppData\Local\Temp\F7C9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\F98E.tmp"C:\Users\Admin\AppData\Local\Temp\F98E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\FB91.tmp"C:\Users\Admin\AppData\Local\Temp\FB91.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\287.tmp"C:\Users\Admin\AppData\Local\Temp\287.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\390.tmp"C:\Users\Admin\AppData\Local\Temp\390.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\555.tmp"C:\Users\Admin\AppData\Local\Temp\555.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\640.tmp"C:\Users\Admin\AppData\Local\Temp\640.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\814.tmp"C:\Users\Admin\AppData\Local\Temp\814.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\AD4.tmp"C:\Users\Admin\AppData\Local\Temp\AD4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\DD1.tmp"C:\Users\Admin\AppData\Local\Temp\DD1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\112D.tmp"C:\Users\Admin\AppData\Local\Temp\112D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\1246.tmp"C:\Users\Admin\AppData\Local\Temp\1246.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\12F2.tmp"C:\Users\Admin\AppData\Local\Temp\12F2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\138E.tmp"C:\Users\Admin\AppData\Local\Temp\138E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\1D04.tmp"C:\Users\Admin\AppData\Local\Temp\1D04.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\1E2D.tmp"C:\Users\Admin\AppData\Local\Temp\1E2D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\1EAA.tmp"C:\Users\Admin\AppData\Local\Temp\1EAA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\1F46.tmp"C:\Users\Admin\AppData\Local\Temp\1F46.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\2001.tmp"C:\Users\Admin\AppData\Local\Temp\2001.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\207E.tmp"C:\Users\Admin\AppData\Local\Temp\207E.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"65⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"67⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"68⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"69⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\23DA.tmp"C:\Users\Admin\AppData\Local\Temp\23DA.tmp"70⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"71⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"72⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\2560.tmp"C:\Users\Admin\AppData\Local\Temp\2560.tmp"73⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"74⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"75⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\26E7.tmp"C:\Users\Admin\AppData\Local\Temp\26E7.tmp"76⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"77⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"78⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"79⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"80⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\29B6.tmp"C:\Users\Admin\AppData\Local\Temp\29B6.tmp"81⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\2A33.tmp"C:\Users\Admin\AppData\Local\Temp\2A33.tmp"82⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"83⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"84⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"85⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"86⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\2C85.tmp"C:\Users\Admin\AppData\Local\Temp\2C85.tmp"87⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\2D11.tmp"C:\Users\Admin\AppData\Local\Temp\2D11.tmp"88⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"89⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"90⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2E98.tmp"C:\Users\Admin\AppData\Local\Temp\2E98.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"93⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"94⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"95⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"96⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"98⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\329F.tmp"C:\Users\Admin\AppData\Local\Temp\329F.tmp"99⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"100⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\33A9.tmp"C:\Users\Admin\AppData\Local\Temp\33A9.tmp"101⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"102⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"103⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"104⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"105⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\3629.tmp"C:\Users\Admin\AppData\Local\Temp\3629.tmp"106⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"107⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"108⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\37A0.tmp"C:\Users\Admin\AppData\Local\Temp\37A0.tmp"109⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"110⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"111⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"112⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"113⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\3A31.tmp"C:\Users\Admin\AppData\Local\Temp\3A31.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"115⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"116⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"117⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"118⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"119⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"120⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"121⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"122⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-