Analysis
- max time kernel
122s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_575afd3dbaa0e585f7e386cfd0283690_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_575afd3dbaa0e585f7e386cfd0283690_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_575afd3dbaa0e585f7e386cfd0283690_elex_mafia.exe
- Size 524KB
- Sample260728-2x8vxacd38
- SHA256 f6293f50ab3b393318c60dc4cb895bc78d4a77aed15fe719929914efaa607693
- MD5 575afd3dbaa0e585f7e386cfd0283690
- SHA1 af63def25fadb49182a5aee11e3aa04267653521
- SHA512 ae15321cb6582be6a65133b9b823966a33741a6f4b80c911918bab07be115482084b680b52067649d07464950a9c2af61186918dc2d507dc333ef1c844d4b5fe
- SSDEEP 12288:TRyZzqyL66Twmtt/0wccpA9Y7JlT2IMK4Ppy3dkNZ:TRyQylTwYtDLJH4Ppy3dkN
- TLSH T138B4F1167584C032E69212354B66EBA2497E7CB15B27A1C73FD526AE2FF03D2D278307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4156 DF98.tmp 1076 E0C1.tmp 1688 E1EA.tmp 3380 E2F4.tmp 4768 E3DE.tmp 4440 E5E2.tmp 5052 E6EB.tmp 1692 E7B6.tmp 3656 E8DF.tmp 1800 EA27.tmp 1456 EB31.tmp 4072 EC5A.tmp 4960 ED73.tmp 5916 EE5E.tmp 3632 EF67.tmp 4152 F042.tmp 5416 F0FD.tmp 4676 F274.tmp 3944 F35F.tmp 5628 F468.tmp 4800 F5B1.tmp 4696 F6AB.tmp 5692 F7B4.tmp 2984 F87F.tmp 4752 F9A8.tmp 2404 FAC1.tmp 3692 FB9C.tmp 4284 FC77.tmp 2828 FD71.tmp 5304 FE8A.tmp 3652 FF84.tmp 2436 6F.tmp 3500 159.tmp 3060 1E6.tmp 5188 291.tmp 1548 35D.tmp 5100 428.tmp 2064 4B4.tmp 2876 551.tmp 1768 5CE.tmp 2604 689.tmp 4224 773.tmp 4896 810.tmp 1828 8AC.tmp 2060 948.tmp 2124 9F4.tmp 6080 AB0.tmp 5984 B5B.tmp 1628 BD8.tmp 5720 C65.tmp 5316 CD2.tmp 4132 D5F.tmp 5520 DFB.tmp 3780 E78.tmp 2596 EF5.tmp 1804 F82.tmp 3984 FFF.tmp 3752 106C.tmp 4808 10E9.tmp 3564 1157.tmp 892 11F3.tmp 3864 1260.tmp 4756 12DD.tmp 4000 136A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F85B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C005.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38A0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 4156 4484 2026-07-28_575afd3dbaa0e585f7e386cfd0283690_elex_mafia.exe 88 PID 4156 wrote to memory of 1076 4156 DF98.tmp 89 PID 1076 wrote to memory of 1688 1076 E0C1.tmp 90 PID 1688 wrote to memory of 3380 1688 E1EA.tmp 91 PID 3380 wrote to memory of 4768 3380 E2F4.tmp 92 PID 4768 wrote to memory of 4440 4768 E3DE.tmp 93 PID 4440 wrote to memory of 5052 4440 E5E2.tmp 94 PID 5052 wrote to memory of 1692 5052 E6EB.tmp 95 PID 1692 wrote to memory of 3656 1692 E7B6.tmp 96 PID 3656 wrote to memory of 1800 3656 E8DF.tmp 97 PID 1800 wrote to memory of 1456 1800 EA27.tmp 98 PID 1456 wrote to memory of 4072 1456 EB31.tmp 99 PID 4072 wrote to memory of 4960 4072 EC5A.tmp 100 PID 4960 wrote to memory of 5916 4960 ED73.tmp 101 PID 5916 wrote to memory of 3632 5916 EE5E.tmp 102 PID 3632 wrote to memory of 4152 3632 EF67.tmp 103 PID 4152 wrote to memory of 5416 4152 F042.tmp 104 PID 5416 wrote to memory of 4676 5416 F0FD.tmp 105 PID 4676 wrote to memory of 3944 4676 F274.tmp 106 PID 3944 wrote to memory of 5628 3944 F35F.tmp 107 PID 5628 wrote to memory of 4800 5628 F468.tmp 108 PID 4800 wrote to memory of 4696 4800 F5B1.tmp 109 PID 4696 wrote to memory of 5692 4696 F6AB.tmp 110 PID 5692 wrote to memory of 2984 5692 F7B4.tmp 111 PID 2984 wrote to memory of 4752 2984 F87F.tmp 112 PID 4752 wrote to memory of 2404 4752 F9A8.tmp 113 PID 2404 wrote to memory of 3692 2404 FAC1.tmp 114 PID 3692 wrote to memory of 4284 3692 FB9C.tmp 115 PID 4284 wrote to memory of 2828 4284 FC77.tmp 116 PID 2828 wrote to memory of 5304 2828 FD71.tmp 117 PID 5304 wrote to memory of 3652 5304 FE8A.tmp 118 PID 3652 wrote to memory of 2436 3652 FF84.tmp 119 PID 2436 wrote to memory of 3500 2436 6F.tmp 120 PID 3500 wrote to memory of 3060 3500 159.tmp 121 PID 3060 wrote to memory of 5188 3060 1E6.tmp 122 PID 5188 wrote to memory of 1548 5188 291.tmp 123 PID 1548 wrote to memory of 5100 1548 35D.tmp 124 PID 5100 wrote to memory of 2064 5100 428.tmp 125 PID 2064 wrote to memory of 2876 2064 4B4.tmp 126 PID 2876 wrote to memory of 1768 2876 551.tmp 127 PID 1768 wrote to memory of 2604 1768 5CE.tmp 128 PID 2604 wrote to memory of 4224 2604 689.tmp 129 PID 4224 wrote to memory of 4896 4224 773.tmp 130 PID 4896 wrote to memory of 1828 4896 810.tmp 131 PID 1828 wrote to memory of 2060 1828 8AC.tmp 132 PID 2060 wrote to memory of 2124 2060 948.tmp 133 PID 2124 wrote to memory of 6080 2124 9F4.tmp 134 PID 6080 wrote to memory of 5984 6080 AB0.tmp 135 PID 5984 wrote to memory of 1628 5984 B5B.tmp 136 PID 1628 wrote to memory of 5720 1628 BD8.tmp 137 PID 5720 wrote to memory of 5316 5720 C65.tmp 138 PID 5316 wrote to memory of 4132 5316 CD2.tmp 139 PID 4132 wrote to memory of 5520 4132 D5F.tmp 140 PID 5520 wrote to memory of 3780 5520 DFB.tmp 141 PID 3780 wrote to memory of 2596 3780 E78.tmp 142 PID 2596 wrote to memory of 1804 2596 EF5.tmp 143 PID 1804 wrote to memory of 3984 1804 F82.tmp 144 PID 3984 wrote to memory of 3752 3984 FFF.tmp 145 PID 3752 wrote to memory of 4808 3752 106C.tmp 146 PID 4808 wrote to memory of 3564 4808 10E9.tmp 147 PID 3564 wrote to memory of 892 3564 1157.tmp 148 PID 892 wrote to memory of 3864 892 11F3.tmp 149 PID 3864 wrote to memory of 4756 3864 1260.tmp 150 PID 4756 wrote to memory of 4000 4756 12DD.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_575afd3dbaa0e585f7e386cfd0283690_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_575afd3dbaa0e585f7e386cfd0283690_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\DF98.tmp"C:\Users\Admin\AppData\Local\Temp\DF98.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"C:\Users\Admin\AppData\Local\Temp\E1EA.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"C:\Users\Admin\AppData\Local\Temp\E2F4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\EB31.tmp"C:\Users\Admin\AppData\Local\Temp\EB31.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\EF67.tmp"C:\Users\Admin\AppData\Local\Temp\EF67.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\F274.tmp"C:\Users\Admin\AppData\Local\Temp\F274.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\F468.tmp"C:\Users\Admin\AppData\Local\Temp\F468.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\6F.tmp"C:\Users\Admin\AppData\Local\Temp\6F.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\159.tmp"C:\Users\Admin\AppData\Local\Temp\159.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\35D.tmp"C:\Users\Admin\AppData\Local\Temp\35D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\428.tmp"C:\Users\Admin\AppData\Local\Temp\428.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\773.tmp"C:\Users\Admin\AppData\Local\Temp\773.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\8AC.tmp"C:\Users\Admin\AppData\Local\Temp\8AC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9F4.tmp"C:\Users\Admin\AppData\Local\Temp\9F4.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\B5B.tmp"C:\Users\Admin\AppData\Local\Temp\B5B.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\BD8.tmp"C:\Users\Admin\AppData\Local\Temp\BD8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\D5F.tmp"C:\Users\Admin\AppData\Local\Temp\D5F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\EF5.tmp"C:\Users\Admin\AppData\Local\Temp\EF5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\10E9.tmp"C:\Users\Admin\AppData\Local\Temp\10E9.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\1157.tmp"C:\Users\Admin\AppData\Local\Temp\1157.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\11F3.tmp"C:\Users\Admin\AppData\Local\Temp\11F3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\136A.tmp"C:\Users\Admin\AppData\Local\Temp\136A.tmp"65⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\13E7.tmp"C:\Users\Admin\AppData\Local\Temp\13E7.tmp"66⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"67⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"68⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"69⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\15AC.tmp"C:\Users\Admin\AppData\Local\Temp\15AC.tmp"70⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"71⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"72⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\1704.tmp"C:\Users\Admin\AppData\Local\Temp\1704.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\17A0.tmp"C:\Users\Admin\AppData\Local\Temp\17A0.tmp"74⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\183C.tmp"C:\Users\Admin\AppData\Local\Temp\183C.tmp"75⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"76⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1956.tmp"C:\Users\Admin\AppData\Local\Temp\1956.tmp"77⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\19D3.tmp"C:\Users\Admin\AppData\Local\Temp\19D3.tmp"78⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"79⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"80⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"81⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"82⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\1C34.tmp"C:\Users\Admin\AppData\Local\Temp\1C34.tmp"83⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"84⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"85⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"86⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\1E28.tmp"C:\Users\Admin\AppData\Local\Temp\1E28.tmp"87⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\1E95.tmp"C:\Users\Admin\AppData\Local\Temp\1E95.tmp"88⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\1F22.tmp"C:\Users\Admin\AppData\Local\Temp\1F22.tmp"89⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"90⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"91⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"92⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"93⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"94⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\21F1.tmp"C:\Users\Admin\AppData\Local\Temp\21F1.tmp"95⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\227D.tmp"C:\Users\Admin\AppData\Local\Temp\227D.tmp"96⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"98⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"99⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"100⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"101⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"102⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"103⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"104⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"105⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"106⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\27CD.tmp"C:\Users\Admin\AppData\Local\Temp\27CD.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2859.tmp"C:\Users\Admin\AppData\Local\Temp\2859.tmp"108⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\28C7.tmp"C:\Users\Admin\AppData\Local\Temp\28C7.tmp"109⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"110⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\29C1.tmp"C:\Users\Admin\AppData\Local\Temp\29C1.tmp"111⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"112⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"113⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\2B28.tmp"C:\Users\Admin\AppData\Local\Temp\2B28.tmp"114⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"C:\Users\Admin\AppData\Local\Temp\2BB5.tmp"115⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2C41.tmp"C:\Users\Admin\AppData\Local\Temp\2C41.tmp"116⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"117⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"118⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"119⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\2E45.tmp"C:\Users\Admin\AppData\Local\Temp\2E45.tmp"120⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"121⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"C:\Users\Admin\AppData\Local\Temp\2F2F.tmp"122⤵PID:5652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-