Analysis
- max time kernel
127s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 11:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_aa093d531faa461dcb4146261632c9b6_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_aa093d531faa461dcb4146261632c9b6_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-27_aa093d531faa461dcb4146261632c9b6_elex_mafia.exe
- Size 520KB
- Sample260727-na4e1sae92
- SHA256 1a12cbd0cd5a274e82ad7aef971b2c94ec6420a6a0ed65a1f735fb4cba61d403
- MD5 aa093d531faa461dcb4146261632c9b6
- SHA1 0fcaca02ddb264d9e4b574f3ba7ade9702418056
- SHA512 2539691e4837471b775b0f65475d490e2168f44898591e8ec63a03336272b5544a8530f758d1e7c9c48192a2b7e9acf7e5604b443cb536361c8b251403de8ed3
- SSDEEP 12288:gj8fuxR21t5i8fktIKdySPkwam/jxsy/Y8cDEnCaNZ:gj8fuK1GYkFjkfm/1nhcDsDN
- TLSH T16DB4F112B845C032E9D214304A52EBA107BEBD798B3695C73BD43A6D6FB52D1E73930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4604 BED.tmp 2736 CB8.tmp 4508 D83.tmp 4840 E1F.tmp 4296 ECB.tmp 3408 F48.tmp 2336 1023.tmp 2756 10DE.tmp 1128 118A.tmp 3396 1217.tmp 4360 1330.tmp 5464 142A.tmp 5924 14D6.tmp 1788 1582.tmp 3516 160F.tmp 5828 16AB.tmp 616 1737.tmp 52 17C4.tmp 4812 1851.tmp 4304 18DD.tmp 4744 197A.tmp 4816 19F7.tmp 5740 1AC2.tmp 6024 1B8D.tmp 1948 1C58.tmp 4904 1D13.tmp 2876 1DA0.tmp 3680 1E3C.tmp 2764 1EC9.tmp 4356 1F75.tmp 1432 205F.tmp 4176 210B.tmp 5364 2178.tmp 5832 21E6.tmp 4336 2272.tmp 3080 22EF.tmp 3624 235D.tmp 5520 23F9.tmp 3580 2466.tmp 4340 24E3.tmp 1972 2551.tmp 3904 25BE.tmp 5928 262C.tmp 3296 26B8.tmp 3040 2735.tmp 2144 27B2.tmp 5816 2810.tmp 3656 289D.tmp 5104 290A.tmp 6060 2987.tmp 3152 29F4.tmp 1888 2A62.tmp 2660 2ACF.tmp 4720 2B5C.tmp 3224 2BD9.tmp 2692 2C46.tmp 5240 2CC3.tmp 3616 2D30.tmp 2200 2D9E.tmp 4716 2E2A.tmp 5536 2EA7.tmp 5032 2F24.tmp 2012 2FA1.tmp 2920 302E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 989C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 422F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 618F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 230A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 326B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E89C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22EF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 4604 1772 2026-07-27_aa093d531faa461dcb4146261632c9b6_elex_mafia.exe 89 PID 4604 wrote to memory of 2736 4604 BED.tmp 90 PID 2736 wrote to memory of 4508 2736 CB8.tmp 91 PID 4508 wrote to memory of 4840 4508 D83.tmp 92 PID 4840 wrote to memory of 4296 4840 E1F.tmp 93 PID 4296 wrote to memory of 3408 4296 ECB.tmp 94 PID 3408 wrote to memory of 2336 3408 F48.tmp 95 PID 2336 wrote to memory of 2756 2336 1023.tmp 96 PID 2756 wrote to memory of 1128 2756 10DE.tmp 97 PID 1128 wrote to memory of 3396 1128 118A.tmp 98 PID 3396 wrote to memory of 4360 3396 1217.tmp 99 PID 4360 wrote to memory of 5464 4360 1330.tmp 100 PID 5464 wrote to memory of 5924 5464 142A.tmp 101 PID 5924 wrote to memory of 1788 5924 14D6.tmp 102 PID 1788 wrote to memory of 3516 1788 1582.tmp 103 PID 3516 wrote to memory of 5828 3516 160F.tmp 104 PID 5828 wrote to memory of 616 5828 16AB.tmp 105 PID 616 wrote to memory of 52 616 1737.tmp 106 PID 52 wrote to memory of 4812 52 17C4.tmp 107 PID 4812 wrote to memory of 4304 4812 1851.tmp 108 PID 4304 wrote to memory of 4744 4304 18DD.tmp 109 PID 4744 wrote to memory of 4816 4744 197A.tmp 110 PID 4816 wrote to memory of 5740 4816 19F7.tmp 111 PID 5740 wrote to memory of 6024 5740 1AC2.tmp 112 PID 6024 wrote to memory of 1948 6024 1B8D.tmp 113 PID 1948 wrote to memory of 4904 1948 1C58.tmp 114 PID 4904 wrote to memory of 2876 4904 1D13.tmp 115 PID 2876 wrote to memory of 3680 2876 1DA0.tmp 116 PID 3680 wrote to memory of 2764 3680 1E3C.tmp 117 PID 2764 wrote to memory of 4356 2764 1EC9.tmp 118 PID 4356 wrote to memory of 1432 4356 1F75.tmp 119 PID 1432 wrote to memory of 4176 1432 205F.tmp 120 PID 4176 wrote to memory of 5364 4176 210B.tmp 121 PID 5364 wrote to memory of 5832 5364 2178.tmp 122 PID 5832 wrote to memory of 4336 5832 21E6.tmp 123 PID 4336 wrote to memory of 3080 4336 2272.tmp 124 PID 3080 wrote to memory of 3624 3080 22EF.tmp 125 PID 3624 wrote to memory of 5520 3624 235D.tmp 126 PID 5520 wrote to memory of 3580 5520 23F9.tmp 127 PID 3580 wrote to memory of 4340 3580 2466.tmp 128 PID 4340 wrote to memory of 1972 4340 24E3.tmp 129 PID 1972 wrote to memory of 3904 1972 2551.tmp 130 PID 3904 wrote to memory of 5928 3904 25BE.tmp 131 PID 5928 wrote to memory of 3296 5928 262C.tmp 132 PID 3296 wrote to memory of 3040 3296 26B8.tmp 133 PID 3040 wrote to memory of 2144 3040 2735.tmp 134 PID 2144 wrote to memory of 5816 2144 27B2.tmp 135 PID 5816 wrote to memory of 3656 5816 2810.tmp 136 PID 3656 wrote to memory of 5104 3656 289D.tmp 137 PID 5104 wrote to memory of 6060 5104 290A.tmp 138 PID 6060 wrote to memory of 3152 6060 2987.tmp 139 PID 3152 wrote to memory of 1888 3152 29F4.tmp 140 PID 1888 wrote to memory of 2660 1888 2A62.tmp 141 PID 2660 wrote to memory of 4720 2660 2ACF.tmp 142 PID 4720 wrote to memory of 3224 4720 2B5C.tmp 143 PID 3224 wrote to memory of 2692 3224 2BD9.tmp 144 PID 2692 wrote to memory of 5240 2692 2C46.tmp 145 PID 5240 wrote to memory of 3616 5240 2CC3.tmp 146 PID 3616 wrote to memory of 2200 3616 2D30.tmp 147 PID 2200 wrote to memory of 4716 2200 2D9E.tmp 148 PID 4716 wrote to memory of 5536 4716 2E2A.tmp 149 PID 5536 wrote to memory of 5032 5536 2EA7.tmp 150 PID 5032 wrote to memory of 2012 5032 2F24.tmp 151 PID 2012 wrote to memory of 2920 2012 2FA1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_aa093d531faa461dcb4146261632c9b6_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_aa093d531faa461dcb4146261632c9b6_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\BED.tmp"C:\Users\Admin\AppData\Local\Temp\BED.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\CB8.tmp"C:\Users\Admin\AppData\Local\Temp\CB8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\D83.tmp"C:\Users\Admin\AppData\Local\Temp\D83.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\F48.tmp"C:\Users\Admin\AppData\Local\Temp\F48.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\10DE.tmp"C:\Users\Admin\AppData\Local\Temp\10DE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\118A.tmp"C:\Users\Admin\AppData\Local\Temp\118A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\142A.tmp"C:\Users\Admin\AppData\Local\Temp\142A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\14D6.tmp"C:\Users\Admin\AppData\Local\Temp\14D6.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\1582.tmp"C:\Users\Admin\AppData\Local\Temp\1582.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\1737.tmp"C:\Users\Admin\AppData\Local\Temp\1737.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\18DD.tmp"C:\Users\Admin\AppData\Local\Temp\18DD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\19F7.tmp"C:\Users\Admin\AppData\Local\Temp\19F7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\1C58.tmp"C:\Users\Admin\AppData\Local\Temp\1C58.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"C:\Users\Admin\AppData\Local\Temp\1DA0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1F75.tmp"C:\Users\Admin\AppData\Local\Temp\1F75.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\205F.tmp"C:\Users\Admin\AppData\Local\Temp\205F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\23F9.tmp"C:\Users\Admin\AppData\Local\Temp\23F9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\25BE.tmp"C:\Users\Admin\AppData\Local\Temp\25BE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\2735.tmp"C:\Users\Admin\AppData\Local\Temp\2735.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\27B2.tmp"C:\Users\Admin\AppData\Local\Temp\27B2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\2987.tmp"C:\Users\Admin\AppData\Local\Temp\2987.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"C:\Users\Admin\AppData\Local\Temp\2BD9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\2C46.tmp"C:\Users\Admin\AppData\Local\Temp\2C46.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\2D30.tmp"C:\Users\Admin\AppData\Local\Temp\2D30.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\2F24.tmp"C:\Users\Admin\AppData\Local\Temp\2F24.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"65⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\309B.tmp"C:\Users\Admin\AppData\Local\Temp\309B.tmp"66⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\3109.tmp"C:\Users\Admin\AppData\Local\Temp\3109.tmp"67⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"68⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\31F3.tmp"C:\Users\Admin\AppData\Local\Temp\31F3.tmp"69⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"70⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"71⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\334B.tmp"C:\Users\Admin\AppData\Local\Temp\334B.tmp"72⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\33C8.tmp"C:\Users\Admin\AppData\Local\Temp\33C8.tmp"73⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3445.tmp"C:\Users\Admin\AppData\Local\Temp\3445.tmp"74⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"75⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"77⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3697.tmp"C:\Users\Admin\AppData\Local\Temp\3697.tmp"79⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\3714.tmp"C:\Users\Admin\AppData\Local\Temp\3714.tmp"80⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\37A0.tmp"C:\Users\Admin\AppData\Local\Temp\37A0.tmp"81⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"82⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"83⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\3908.tmp"C:\Users\Admin\AppData\Local\Temp\3908.tmp"84⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\3994.tmp"C:\Users\Admin\AppData\Local\Temp\3994.tmp"85⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"86⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"87⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:256 -
C:\Users\Admin\AppData\Local\Temp\3B79.tmp"C:\Users\Admin\AppData\Local\Temp\3B79.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:108 -
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"90⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"91⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"93⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"94⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"95⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"97⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"98⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"99⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"100⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"101⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\41C2.tmp"C:\Users\Admin\AppData\Local\Temp\41C2.tmp"102⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\42CC.tmp"C:\Users\Admin\AppData\Local\Temp\42CC.tmp"104⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"105⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"106⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\4452.tmp"C:\Users\Admin\AppData\Local\Temp\4452.tmp"107⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"108⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"109⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"110⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"111⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\46D3.tmp"C:\Users\Admin\AppData\Local\Temp\46D3.tmp"112⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"113⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"114⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"115⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"116⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4944.tmp"C:\Users\Admin\AppData\Local\Temp\4944.tmp"117⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"118⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"119⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"120⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"121⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"122⤵PID:5488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-