Analysis
- max time kernel
121s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_3bbc85c89f9949c3b6bb1ccbc6471ce0_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_3bbc85c89f9949c3b6bb1ccbc6471ce0_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_3bbc85c89f9949c3b6bb1ccbc6471ce0_elex_mafia.exe
- Size 524KB
- Sample260730-wfz9jsdr4s
- SHA256 f97327c304e305a8d793c8e3cd746172780e626f893bf226b04566a9e72d4f2e
- MD5 3bbc85c89f9949c3b6bb1ccbc6471ce0
- SHA1 727966557427e2eedfbfdf9f369ca6675200f28f
- SHA512 2ccfaeaff04be91154f9cf8dc57403c7fc145e19d978697d4973e428055623da9d25eee4ace4cd5e84320356fbbc487fff3a7a8c51fbf586cfbcdf7cedd2e169
- SSDEEP 12288:TRyZzqyL66TEOJQsa+O4w4YTOnCaj/qkNZ:TRyQylTEFs2YZ/bN
- TLSH T11BB4F016B684C032E69201758A16EBA29D3E3C75AB27A4C737D4377D6EF62D0D2B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4296 304.tmp 2780 42C.tmp 5000 4B9.tmp 5580 5E2.tmp 5456 6AD.tmp 2868 769.tmp 2956 853.tmp 4856 95D.tmp 4496 9CA.tmp 3144 AF3.tmp 3576 C1C.tmp 4360 D06.tmp 3152 E1F.tmp 5816 F19.tmp 5032 1052.tmp 804 112D.tmp 1636 1227.tmp 248 1340.tmp 2468 1478.tmp 4696 1543.tmp 1376 15FF.tmp 4448 1728.tmp 6104 1812.tmp 1492 194B.tmp 2208 1A45.tmp 2884 1B2F.tmp 4896 1C0A.tmp 5712 1CD5.tmp 4924 1DBF.tmp 4512 1ED9.tmp 688 1FF2.tmp 4476 20CD.tmp 2348 21D6.tmp 3236 22A1.tmp 1128 235D.tmp 3556 2418.tmp 5660 2495.tmp 4192 2570.tmp 1940 262C.tmp 5560 26F7.tmp 3216 27D1.tmp 3156 289D.tmp 2800 2968.tmp 2704 2A52.tmp 5984 2ACF.tmp 3564 2B5C.tmp 4440 2C36.tmp 5060 2CF2.tmp 5524 2D5F.tmp 1860 2E0B.tmp 6096 2E79.tmp 5772 2EF6.tmp 5388 2F63.tmp 3772 2FF0.tmp 2052 306D.tmp 1864 3128.tmp 4132 31B5.tmp 1292 3251.tmp 1480 32CE.tmp 2256 336A.tmp 1512 3406.tmp 4720 3474.tmp 2448 34E1.tmp 1344 356E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 978E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B94F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 593D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7262.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 664D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 852F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D67B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 336A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 527B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 887B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B43E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 112D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 4296 3212 2026-07-30_3bbc85c89f9949c3b6bb1ccbc6471ce0_elex_mafia.exe 89 PID 4296 wrote to memory of 2780 4296 304.tmp 90 PID 2780 wrote to memory of 5000 2780 42C.tmp 91 PID 5000 wrote to memory of 5580 5000 4B9.tmp 92 PID 5580 wrote to memory of 5456 5580 5E2.tmp 93 PID 5456 wrote to memory of 2868 5456 6AD.tmp 94 PID 2868 wrote to memory of 2956 2868 769.tmp 95 PID 2956 wrote to memory of 4856 2956 853.tmp 96 PID 4856 wrote to memory of 4496 4856 95D.tmp 97 PID 4496 wrote to memory of 3144 4496 9CA.tmp 98 PID 3144 wrote to memory of 3576 3144 AF3.tmp 99 PID 3576 wrote to memory of 4360 3576 C1C.tmp 100 PID 4360 wrote to memory of 3152 4360 D06.tmp 101 PID 3152 wrote to memory of 5816 3152 E1F.tmp 102 PID 5816 wrote to memory of 5032 5816 F19.tmp 103 PID 5032 wrote to memory of 804 5032 1052.tmp 104 PID 804 wrote to memory of 1636 804 112D.tmp 105 PID 1636 wrote to memory of 248 1636 1227.tmp 106 PID 248 wrote to memory of 2468 248 1340.tmp 107 PID 2468 wrote to memory of 4696 2468 1478.tmp 108 PID 4696 wrote to memory of 1376 4696 1543.tmp 109 PID 1376 wrote to memory of 4448 1376 15FF.tmp 110 PID 4448 wrote to memory of 6104 4448 1728.tmp 111 PID 6104 wrote to memory of 1492 6104 1812.tmp 112 PID 1492 wrote to memory of 2208 1492 194B.tmp 113 PID 2208 wrote to memory of 2884 2208 1A45.tmp 114 PID 2884 wrote to memory of 4896 2884 1B2F.tmp 115 PID 4896 wrote to memory of 5712 4896 1C0A.tmp 116 PID 5712 wrote to memory of 4924 5712 1CD5.tmp 117 PID 4924 wrote to memory of 4512 4924 1DBF.tmp 118 PID 4512 wrote to memory of 688 4512 1ED9.tmp 119 PID 688 wrote to memory of 4476 688 1FF2.tmp 120 PID 4476 wrote to memory of 2348 4476 20CD.tmp 121 PID 2348 wrote to memory of 3236 2348 21D6.tmp 122 PID 3236 wrote to memory of 1128 3236 22A1.tmp 123 PID 1128 wrote to memory of 3556 1128 235D.tmp 124 PID 3556 wrote to memory of 5660 3556 2418.tmp 125 PID 5660 wrote to memory of 4192 5660 2495.tmp 126 PID 4192 wrote to memory of 1940 4192 2570.tmp 127 PID 1940 wrote to memory of 5560 1940 262C.tmp 128 PID 5560 wrote to memory of 3216 5560 26F7.tmp 129 PID 3216 wrote to memory of 3156 3216 27D1.tmp 130 PID 3156 wrote to memory of 2800 3156 289D.tmp 131 PID 2800 wrote to memory of 2704 2800 2968.tmp 132 PID 2704 wrote to memory of 5984 2704 2A52.tmp 133 PID 5984 wrote to memory of 3564 5984 2ACF.tmp 134 PID 3564 wrote to memory of 4440 3564 2B5C.tmp 135 PID 4440 wrote to memory of 5060 4440 2C36.tmp 136 PID 5060 wrote to memory of 5524 5060 2CF2.tmp 137 PID 5524 wrote to memory of 1860 5524 2D5F.tmp 138 PID 1860 wrote to memory of 6096 1860 2E0B.tmp 139 PID 6096 wrote to memory of 5772 6096 2E79.tmp 140 PID 5772 wrote to memory of 5388 5772 2EF6.tmp 141 PID 5388 wrote to memory of 3772 5388 2F63.tmp 142 PID 3772 wrote to memory of 2052 3772 2FF0.tmp 143 PID 2052 wrote to memory of 1864 2052 306D.tmp 144 PID 1864 wrote to memory of 4132 1864 3128.tmp 145 PID 4132 wrote to memory of 1292 4132 31B5.tmp 146 PID 1292 wrote to memory of 1480 1292 3251.tmp 147 PID 1480 wrote to memory of 2256 1480 32CE.tmp 148 PID 2256 wrote to memory of 1512 2256 336A.tmp 149 PID 1512 wrote to memory of 4720 1512 3406.tmp 150 PID 4720 wrote to memory of 2448 4720 3474.tmp 151 PID 2448 wrote to memory of 1344 2448 34E1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_3bbc85c89f9949c3b6bb1ccbc6471ce0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3bbc85c89f9949c3b6bb1ccbc6471ce0_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4B9.tmp"C:\Users\Admin\AppData\Local\Temp\4B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\769.tmp"C:\Users\Admin\AppData\Local\Temp\769.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\9CA.tmp"C:\Users\Admin\AppData\Local\Temp\9CA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\112D.tmp"C:\Users\Admin\AppData\Local\Temp\112D.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1340.tmp"C:\Users\Admin\AppData\Local\Temp\1340.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\1478.tmp"C:\Users\Admin\AppData\Local\Temp\1478.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1728.tmp"C:\Users\Admin\AppData\Local\Temp\1728.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\1812.tmp"C:\Users\Admin\AppData\Local\Temp\1812.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\21D6.tmp"C:\Users\Admin\AppData\Local\Temp\21D6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\2570.tmp"C:\Users\Admin\AppData\Local\Temp\2570.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\289D.tmp"C:\Users\Admin\AppData\Local\Temp\289D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"C:\Users\Admin\AppData\Local\Temp\2B5C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\2C36.tmp"C:\Users\Admin\AppData\Local\Temp\2C36.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2E79.tmp"C:\Users\Admin\AppData\Local\Temp\2E79.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\306D.tmp"C:\Users\Admin\AppData\Local\Temp\306D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3128.tmp"C:\Users\Admin\AppData\Local\Temp\3128.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3251.tmp"C:\Users\Admin\AppData\Local\Temp\3251.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\32CE.tmp"C:\Users\Admin\AppData\Local\Temp\32CE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3406.tmp"C:\Users\Admin\AppData\Local\Temp\3406.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3474.tmp"C:\Users\Admin\AppData\Local\Temp\3474.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"65⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\35EB.tmp"C:\Users\Admin\AppData\Local\Temp\35EB.tmp"66⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"67⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\36F4.tmp"C:\Users\Admin\AppData\Local\Temp\36F4.tmp"68⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"69⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"70⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"71⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\3946.tmp"C:\Users\Admin\AppData\Local\Temp\3946.tmp"72⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\39B4.tmp"C:\Users\Admin\AppData\Local\Temp\39B4.tmp"73⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\3A31.tmp"C:\Users\Admin\AppData\Local\Temp\3A31.tmp"74⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"75⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"76⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"77⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"78⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"79⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"80⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"81⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\3E47.tmp"C:\Users\Admin\AppData\Local\Temp\3E47.tmp"82⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"84⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"85⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"86⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"88⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\41C2.tmp"C:\Users\Admin\AppData\Local\Temp\41C2.tmp"89⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"90⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\42BC.tmp"C:\Users\Admin\AppData\Local\Temp\42BC.tmp"91⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"92⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"93⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\4462.tmp"C:\Users\Admin\AppData\Local\Temp\4462.tmp"94⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:792 -
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"96⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"97⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"98⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"99⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\47AE.tmp"C:\Users\Admin\AppData\Local\Temp\47AE.tmp"100⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"101⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"102⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\4954.tmp"C:\Users\Admin\AppData\Local\Temp\4954.tmp"103⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"104⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"105⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"C:\Users\Admin\AppData\Local\Temp\4ADA.tmp"106⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"107⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"108⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"109⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"110⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"111⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"112⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\4E74.tmp"C:\Users\Admin\AppData\Local\Temp\4E74.tmp"113⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"114⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"116⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"117⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\50F5.tmp"C:\Users\Admin\AppData\Local\Temp\50F5.tmp"118⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"119⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\51EF.tmp"C:\Users\Admin\AppData\Local\Temp\51EF.tmp"120⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-