Analysis
- max time kernel
116s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 11:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_9f5cdf99c31a6efa7846c256aa2fb5fd_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_9f5cdf99c31a6efa7846c256aa2fb5fd_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_9f5cdf99c31a6efa7846c256aa2fb5fd_elex_mafia.exe
- Size 520KB
- Sample260730-ndtpzswekd
- SHA256 b740f54b4da7d28ff4c36b4c1b2233758630e704eeb363c39f2bdd2c42c4cb25
- MD5 9f5cdf99c31a6efa7846c256aa2fb5fd
- SHA1 8ff5e206f90a943c3a60a54c22381c259ab65346
- SHA512 851c865cdf8d35000da46510199c32961b2eece6410630b0190482510f58695b19ffe6c2274c5b497662402b87a25ccf8858930771216c06fb221a3d491312d1
- SSDEEP 12288:gj8fuxR21t5i8fOVAvU7Ez3c/yMvMt1jDlkwuVNZ6:gj8fuK1GYxU7Ez3c/yFyTNI
- TLSH T123B4F1127945C432EED606314B66DBA10BBE7D789B2695C33B8035AE6FF42C1D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4892 DE6F.tmp 2360 DF4A.tmp 5488 E025.tmp 4236 E100.tmp 4160 E19C.tmp 4604 E248.tmp 4180 E303.tmp 2348 E3AF.tmp 1432 E46B.tmp 3640 E517.tmp 1136 E5B3.tmp 4264 E65F.tmp 5536 E71A.tmp 2788 E7F5.tmp 2888 E8A1.tmp 2536 E92D.tmp 2960 E9D9.tmp 1448 EA76.tmp 1672 EB50.tmp 4708 EBFC.tmp 4700 ECA8.tmp 2456 ED15.tmp 2956 EE00.tmp 5940 EEAC.tmp 5104 EF58.tmp 4768 EFE4.tmp 5780 F071.tmp 3836 F0EE.tmp 1252 F18A.tmp 3692 F236.tmp 3996 F2E2.tmp 4672 F36E.tmp 1332 F3FB.tmp 4932 F478.tmp 5472 F4F5.tmp 5176 F572.tmp 5692 F5FF.tmp 1772 F66C.tmp 4848 F6F9.tmp 4128 F766.tmp 4348 F7D3.tmp 1412 F841.tmp 1444 F8DD.tmp 204 F95A.tmp 2396 F9C7.tmp 3892 FA54.tmp 2088 FAF0.tmp 1472 FB6D.tmp 1804 FBEA.tmp 2832 FC58.tmp 528 FCC5.tmp 368 FD61.tmp 1524 FDCF.tmp 5804 FE6B.tmp 2576 FEE8.tmp 4864 FF84.tmp 924 11.tmp 4920 9D.tmp 1180 13A.tmp 4964 1F5.tmp 3456 272.tmp 900 2FF.tmp 2424 3AB.tmp 3312 447.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 789C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 562B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8307.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 920B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 669B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7456.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C564.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 131C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20A9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4892 3632 2026-07-30_9f5cdf99c31a6efa7846c256aa2fb5fd_elex_mafia.exe 88 PID 4892 wrote to memory of 2360 4892 DE6F.tmp 89 PID 2360 wrote to memory of 5488 2360 DF4A.tmp 90 PID 5488 wrote to memory of 4236 5488 E025.tmp 91 PID 4236 wrote to memory of 4160 4236 E100.tmp 92 PID 4160 wrote to memory of 4604 4160 E19C.tmp 93 PID 4604 wrote to memory of 4180 4604 E248.tmp 94 PID 4180 wrote to memory of 2348 4180 E303.tmp 95 PID 2348 wrote to memory of 1432 2348 E3AF.tmp 96 PID 1432 wrote to memory of 3640 1432 E46B.tmp 97 PID 3640 wrote to memory of 1136 3640 E517.tmp 98 PID 1136 wrote to memory of 4264 1136 E5B3.tmp 99 PID 4264 wrote to memory of 5536 4264 E65F.tmp 100 PID 5536 wrote to memory of 2788 5536 E71A.tmp 101 PID 2788 wrote to memory of 2888 2788 E7F5.tmp 102 PID 2888 wrote to memory of 2536 2888 E8A1.tmp 103 PID 2536 wrote to memory of 2960 2536 E92D.tmp 104 PID 2960 wrote to memory of 1448 2960 E9D9.tmp 105 PID 1448 wrote to memory of 1672 1448 EA76.tmp 106 PID 1672 wrote to memory of 4708 1672 EB50.tmp 107 PID 4708 wrote to memory of 4700 4708 EBFC.tmp 108 PID 4700 wrote to memory of 2456 4700 ECA8.tmp 109 PID 2456 wrote to memory of 2956 2456 ED15.tmp 110 PID 2956 wrote to memory of 5940 2956 EE00.tmp 111 PID 5940 wrote to memory of 5104 5940 EEAC.tmp 112 PID 5104 wrote to memory of 4768 5104 EF58.tmp 113 PID 4768 wrote to memory of 5780 4768 EFE4.tmp 114 PID 5780 wrote to memory of 3836 5780 F071.tmp 115 PID 3836 wrote to memory of 1252 3836 F0EE.tmp 116 PID 1252 wrote to memory of 3692 1252 F18A.tmp 117 PID 3692 wrote to memory of 3996 3692 F236.tmp 118 PID 3996 wrote to memory of 4672 3996 F2E2.tmp 119 PID 4672 wrote to memory of 1332 4672 F36E.tmp 120 PID 1332 wrote to memory of 4932 1332 F3FB.tmp 121 PID 4932 wrote to memory of 5472 4932 F478.tmp 122 PID 5472 wrote to memory of 5176 5472 F4F5.tmp 123 PID 5176 wrote to memory of 5692 5176 F572.tmp 124 PID 5692 wrote to memory of 1772 5692 F5FF.tmp 125 PID 1772 wrote to memory of 4848 1772 F66C.tmp 126 PID 4848 wrote to memory of 4128 4848 F6F9.tmp 127 PID 4128 wrote to memory of 4348 4128 F766.tmp 128 PID 4348 wrote to memory of 1412 4348 F7D3.tmp 129 PID 1412 wrote to memory of 1444 1412 F841.tmp 130 PID 1444 wrote to memory of 204 1444 F8DD.tmp 131 PID 204 wrote to memory of 2396 204 F95A.tmp 132 PID 2396 wrote to memory of 3892 2396 F9C7.tmp 133 PID 3892 wrote to memory of 2088 3892 FA54.tmp 134 PID 2088 wrote to memory of 1472 2088 FAF0.tmp 135 PID 1472 wrote to memory of 1804 1472 FB6D.tmp 136 PID 1804 wrote to memory of 2832 1804 FBEA.tmp 137 PID 2832 wrote to memory of 528 2832 FC58.tmp 138 PID 528 wrote to memory of 368 528 FCC5.tmp 139 PID 368 wrote to memory of 1524 368 FD61.tmp 140 PID 1524 wrote to memory of 5804 1524 FDCF.tmp 141 PID 5804 wrote to memory of 2576 5804 FE6B.tmp 142 PID 2576 wrote to memory of 4864 2576 FEE8.tmp 143 PID 4864 wrote to memory of 924 4864 FF84.tmp 144 PID 924 wrote to memory of 4920 924 11.tmp 145 PID 4920 wrote to memory of 1180 4920 9D.tmp 146 PID 1180 wrote to memory of 4964 1180 13A.tmp 147 PID 4964 wrote to memory of 3456 4964 1F5.tmp 148 PID 3456 wrote to memory of 900 3456 272.tmp 149 PID 900 wrote to memory of 2424 900 2FF.tmp 150 PID 2424 wrote to memory of 3312 2424 3AB.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_9f5cdf99c31a6efa7846c256aa2fb5fd_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_9f5cdf99c31a6efa7846c256aa2fb5fd_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\E517.tmp"C:\Users\Admin\AppData\Local\Temp\E517.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"C:\Users\Admin\AppData\Local\Temp\E7F5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\ED15.tmp"C:\Users\Admin\AppData\Local\Temp\ED15.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\F071.tmp"C:\Users\Admin\AppData\Local\Temp\F071.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\F18A.tmp"C:\Users\Admin\AppData\Local\Temp\F18A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\F36E.tmp"C:\Users\Admin\AppData\Local\Temp\F36E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\F841.tmp"C:\Users\Admin\AppData\Local\Temp\F841.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"C:\Users\Admin\AppData\Local\Temp\FBEA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\FC58.tmp"C:\Users\Admin\AppData\Local\Temp\FC58.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\13A.tmp"C:\Users\Admin\AppData\Local\Temp\13A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"65⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"66⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"67⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"68⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"69⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\6B8.tmp"C:\Users\Admin\AppData\Local\Temp\6B8.tmp"70⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"71⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\7C2.tmp"C:\Users\Admin\AppData\Local\Temp\7C2.tmp"72⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"73⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\8CB.tmp"C:\Users\Admin\AppData\Local\Temp\8CB.tmp"74⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\958.tmp"C:\Users\Admin\AppData\Local\Temp\958.tmp"75⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"76⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\A61.tmp"C:\Users\Admin\AppData\Local\Temp\A61.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\AFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFE.tmp"78⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B9A.tmp"C:\Users\Admin\AppData\Local\Temp\B9A.tmp"79⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"80⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"81⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"82⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"83⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"84⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\E88.tmp"C:\Users\Admin\AppData\Local\Temp\E88.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"86⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"87⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"88⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"89⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\1109.tmp"C:\Users\Admin\AppData\Local\Temp\1109.tmp"90⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"91⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\1203.tmp"C:\Users\Admin\AppData\Local\Temp\1203.tmp"92⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"93⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"95⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\1425.tmp"C:\Users\Admin\AppData\Local\Temp\1425.tmp"96⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"97⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"98⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"99⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"100⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"101⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\17A0.tmp"C:\Users\Admin\AppData\Local\Temp\17A0.tmp"102⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"103⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"104⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\1917.tmp"C:\Users\Admin\AppData\Local\Temp\1917.tmp"105⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"106⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"107⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"109⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"110⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"111⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\1C63.tmp"C:\Users\Admin\AppData\Local\Temp\1C63.tmp"112⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"113⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"115⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"116⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"117⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"118⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"C:\Users\Admin\AppData\Local\Temp\1FCE.tmp"119⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\203B.tmp"C:\Users\Admin\AppData\Local\Temp\203B.tmp"120⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\20A9.tmp"C:\Users\Admin\AppData\Local\Temp\20A9.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2126.tmp"C:\Users\Admin\AppData\Local\Temp\2126.tmp"122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-