Analysis
- max time kernel
132s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_73207aba1083126b03d889ff2ae3d1c4_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_73207aba1083126b03d889ff2ae3d1c4_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_73207aba1083126b03d889ff2ae3d1c4_elex_mafia.exe
- Size 520KB
- Sample260802-dh2laack5y
- SHA256 b390871b6e6567f62ab78e986fb2aae48ab97d5f685d840f556b4b06f1efefdb
- MD5 73207aba1083126b03d889ff2ae3d1c4
- SHA1 2744cc4ccbe232fdbdfc031757b60a9df0cd3160
- SHA512 998235e7e384d0be7160bd1a0cfae28ac63fdf44d5cdacfcbd9acacb7767a08e536201128f2634aedc67646e2d7d902518cf80cc4284266481e0131fd3cf3171
- SSDEEP 12288:gj8fuxR21t5i8fqJB1fjZYuRJ6uenHLJcZKHVc6f0VorTa2NZ6:gj8fuK1GYqJz9Vd6HFDc6SsNI
- TLSH T15AB4F112B945C033E59205354A62DBA107BE7D759B3985C73BC43ABE6EB42C1DB3930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3356 E569.tmp 4496 E635.tmp 5844 E70F.tmp 5072 E7AC.tmp 4128 E848.tmp 5316 E903.tmp 1156 E9A0.tmp 564 EA2C.tmp 2252 EAA9.tmp 1344 ECEB.tmp 4344 EDD6.tmp 3684 EE82.tmp 4864 EF1E.tmp 5492 EFE9.tmp 2248 F085.tmp 3428 F141.tmp 700 F1DD.tmp 4788 F2A8.tmp 2400 F383.tmp 3724 F41F.tmp 5692 F509.tmp 3392 F596.tmp 1868 F642.tmp 2512 F6EE.tmp 4256 F7A9.tmp 4220 F846.tmp 5092 F930.tmp 5912 F9CC.tmp 5816 FA97.tmp 2484 FB72.tmp 3484 FC0E.tmp 2532 FCBA.tmp 5584 FD85.tmp 1804 FE12.tmp 6020 FE8F.tmp 2328 FEFC.tmp 2832 FFB8.tmp 4060 44.tmp 4984 C1.tmp 6060 14E.tmp 5460 1BB.tmp 4832 238.tmp 4924 2B5.tmp 3268 342.tmp 3548 3BF.tmp 4680 44C.tmp 2740 4D8.tmp 1696 555.tmp 6068 5D2.tmp 2488 65F.tmp 1536 6DC.tmp 1188 759.tmp 5360 805.tmp 6040 8B1.tmp 2276 92E.tmp 2808 9AB.tmp 2260 A28.tmp 6116 A95.tmp 1944 B22.tmp 3400 B8F.tmp 2876 C2B.tmp 5688 C99.tmp 1240 D25.tmp 3304 DA2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 544B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E611.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E71A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 349E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 884C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5864 wrote to memory of 3356 5864 2026-08-02_73207aba1083126b03d889ff2ae3d1c4_elex_mafia.exe 89 PID 3356 wrote to memory of 4496 3356 E569.tmp 90 PID 4496 wrote to memory of 5844 4496 E635.tmp 91 PID 5844 wrote to memory of 5072 5844 E70F.tmp 92 PID 5072 wrote to memory of 4128 5072 E7AC.tmp 93 PID 4128 wrote to memory of 5316 4128 E848.tmp 94 PID 5316 wrote to memory of 1156 5316 E903.tmp 95 PID 1156 wrote to memory of 564 1156 E9A0.tmp 96 PID 564 wrote to memory of 2252 564 EA2C.tmp 97 PID 2252 wrote to memory of 1344 2252 EAA9.tmp 98 PID 1344 wrote to memory of 4344 1344 ECEB.tmp 99 PID 4344 wrote to memory of 3684 4344 EDD6.tmp 100 PID 3684 wrote to memory of 4864 3684 EE82.tmp 101 PID 4864 wrote to memory of 5492 4864 EF1E.tmp 102 PID 5492 wrote to memory of 2248 5492 EFE9.tmp 103 PID 2248 wrote to memory of 3428 2248 F085.tmp 104 PID 3428 wrote to memory of 700 3428 F141.tmp 105 PID 700 wrote to memory of 4788 700 F1DD.tmp 106 PID 4788 wrote to memory of 2400 4788 F2A8.tmp 107 PID 2400 wrote to memory of 3724 2400 F383.tmp 108 PID 3724 wrote to memory of 5692 3724 F41F.tmp 109 PID 5692 wrote to memory of 3392 5692 F509.tmp 110 PID 3392 wrote to memory of 1868 3392 F596.tmp 111 PID 1868 wrote to memory of 2512 1868 F642.tmp 112 PID 2512 wrote to memory of 4256 2512 F6EE.tmp 113 PID 4256 wrote to memory of 4220 4256 F7A9.tmp 114 PID 4220 wrote to memory of 5092 4220 F846.tmp 115 PID 5092 wrote to memory of 5912 5092 F930.tmp 116 PID 5912 wrote to memory of 5816 5912 F9CC.tmp 117 PID 5816 wrote to memory of 2484 5816 FA97.tmp 118 PID 2484 wrote to memory of 3484 2484 FB72.tmp 119 PID 3484 wrote to memory of 2532 3484 FC0E.tmp 120 PID 2532 wrote to memory of 5584 2532 FCBA.tmp 121 PID 5584 wrote to memory of 1804 5584 FD85.tmp 122 PID 1804 wrote to memory of 6020 1804 FE12.tmp 123 PID 6020 wrote to memory of 2328 6020 FE8F.tmp 124 PID 2328 wrote to memory of 2832 2328 FEFC.tmp 125 PID 2832 wrote to memory of 4060 2832 FFB8.tmp 126 PID 4060 wrote to memory of 4984 4060 44.tmp 127 PID 4984 wrote to memory of 6060 4984 C1.tmp 128 PID 6060 wrote to memory of 5460 6060 14E.tmp 129 PID 5460 wrote to memory of 4832 5460 1BB.tmp 130 PID 4832 wrote to memory of 4924 4832 238.tmp 131 PID 4924 wrote to memory of 3268 4924 2B5.tmp 132 PID 3268 wrote to memory of 3548 3268 342.tmp 133 PID 3548 wrote to memory of 4680 3548 3BF.tmp 134 PID 4680 wrote to memory of 2740 4680 44C.tmp 135 PID 2740 wrote to memory of 1696 2740 4D8.tmp 136 PID 1696 wrote to memory of 6068 1696 555.tmp 137 PID 6068 wrote to memory of 2488 6068 5D2.tmp 138 PID 2488 wrote to memory of 1536 2488 65F.tmp 139 PID 1536 wrote to memory of 1188 1536 6DC.tmp 140 PID 1188 wrote to memory of 5360 1188 759.tmp 141 PID 5360 wrote to memory of 6040 5360 805.tmp 142 PID 6040 wrote to memory of 2276 6040 8B1.tmp 143 PID 2276 wrote to memory of 2808 2276 92E.tmp 144 PID 2808 wrote to memory of 2260 2808 9AB.tmp 145 PID 2260 wrote to memory of 6116 2260 A28.tmp 146 PID 6116 wrote to memory of 1944 6116 A95.tmp 147 PID 1944 wrote to memory of 3400 1944 B22.tmp 148 PID 3400 wrote to memory of 2876 3400 B8F.tmp 149 PID 2876 wrote to memory of 5688 2876 C2B.tmp 150 PID 5688 wrote to memory of 1240 5688 C99.tmp 151 PID 1240 wrote to memory of 3304 1240 D25.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_73207aba1083126b03d889ff2ae3d1c4_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_73207aba1083126b03d889ff2ae3d1c4_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\E635.tmp"C:\Users\Admin\AppData\Local\Temp\E635.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\E70F.tmp"C:\Users\Admin\AppData\Local\Temp\E70F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"C:\Users\Admin\AppData\Local\Temp\EA2C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\F085.tmp"C:\Users\Admin\AppData\Local\Temp\F085.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\F141.tmp"C:\Users\Admin\AppData\Local\Temp\F141.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\F642.tmp"C:\Users\Admin\AppData\Local\Temp\F642.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\F846.tmp"C:\Users\Admin\AppData\Local\Temp\F846.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\F930.tmp"C:\Users\Admin\AppData\Local\Temp\F930.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\FA97.tmp"C:\Users\Admin\AppData\Local\Temp\FA97.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\FD85.tmp"C:\Users\Admin\AppData\Local\Temp\FD85.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"C:\Users\Admin\AppData\Local\Temp\FE8F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\FEFC.tmp"C:\Users\Admin\AppData\Local\Temp\FEFC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\44.tmp"C:\Users\Admin\AppData\Local\Temp\44.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\1BB.tmp"C:\Users\Admin\AppData\Local\Temp\1BB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\238.tmp"C:\Users\Admin\AppData\Local\Temp\238.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\342.tmp"C:\Users\Admin\AppData\Local\Temp\342.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\44C.tmp"C:\Users\Admin\AppData\Local\Temp\44C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\555.tmp"C:\Users\Admin\AppData\Local\Temp\555.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6DC.tmp"C:\Users\Admin\AppData\Local\Temp\6DC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\805.tmp"C:\Users\Admin\AppData\Local\Temp\805.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\B8F.tmp"C:\Users\Admin\AppData\Local\Temp\B8F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\C99.tmp"C:\Users\Admin\AppData\Local\Temp\C99.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\DA2.tmp"C:\Users\Admin\AppData\Local\Temp\DA2.tmp"65⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"66⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"67⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"68⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"69⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"70⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\1061.tmp"C:\Users\Admin\AppData\Local\Temp\1061.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"72⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\118A.tmp"C:\Users\Admin\AppData\Local\Temp\118A.tmp"73⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"74⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"75⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\1321.tmp"C:\Users\Admin\AppData\Local\Temp\1321.tmp"76⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\13CC.tmp"C:\Users\Admin\AppData\Local\Temp\13CC.tmp"77⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"78⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\14B7.tmp"C:\Users\Admin\AppData\Local\Temp\14B7.tmp"79⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"81⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"82⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"83⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\1747.tmp"C:\Users\Admin\AppData\Local\Temp\1747.tmp"84⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"85⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"86⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"87⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"88⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"89⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"91⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"92⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"93⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\1C58.tmp"C:\Users\Admin\AppData\Local\Temp\1C58.tmp"94⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"95⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"96⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"97⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"C:\Users\Admin\AppData\Local\Temp\1E6B.tmp"98⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"99⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\1F56.tmp"C:\Users\Admin\AppData\Local\Temp\1F56.tmp"100⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"101⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\2050.tmp"C:\Users\Admin\AppData\Local\Temp\2050.tmp"102⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"103⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\214A.tmp"C:\Users\Admin\AppData\Local\Temp\214A.tmp"104⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\21E6.tmp"C:\Users\Admin\AppData\Local\Temp\21E6.tmp"105⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2263.tmp"C:\Users\Admin\AppData\Local\Temp\2263.tmp"106⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\22D0.tmp"C:\Users\Admin\AppData\Local\Temp\22D0.tmp"107⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"108⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"109⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\2457.tmp"C:\Users\Admin\AppData\Local\Temp\2457.tmp"110⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"111⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\2541.tmp"C:\Users\Admin\AppData\Local\Temp\2541.tmp"112⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\25BE.tmp"C:\Users\Admin\AppData\Local\Temp\25BE.tmp"113⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"114⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\26A9.tmp"C:\Users\Admin\AppData\Local\Temp\26A9.tmp"115⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\2726.tmp"C:\Users\Admin\AppData\Local\Temp\2726.tmp"116⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\27A3.tmp"C:\Users\Admin\AppData\Local\Temp\27A3.tmp"117⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\283F.tmp"C:\Users\Admin\AppData\Local\Temp\283F.tmp"118⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"119⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"120⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\29B6.tmp"C:\Users\Admin\AppData\Local\Temp\29B6.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2A42.tmp"C:\Users\Admin\AppData\Local\Temp\2A42.tmp"122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-