Analysis
- max time kernel
122s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_b455228fdcafc3b7f41a08cb9ab58a7d_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_b455228fdcafc3b7f41a08cb9ab58a7d_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_b455228fdcafc3b7f41a08cb9ab58a7d_elex_mafia.exe
- Size 561KB
- Sample260817-3z9ewsec98
- SHA256 5c2037fc29bc626530bad652601386f4ffb1787a854b0abfb9212b354feb6d94
- MD5 b455228fdcafc3b7f41a08cb9ab58a7d
- SHA1 a0298bb511098c6cc1af31b861939128713082ca
- SHA512 83f792dccf0c0b1185af2952f980fd0ffe9ca8080b8c01d6d48c7f04eb4cd3fb73dc83ce757dd7746f4570f7f5c94b99430c64c8a3026eadfb17f7b596b8114a
- SSDEEP 12288:VuelPWET0yh6oIKOVfHr01lGIWJj//Ee3nDZuL:8eEEvh6oM2z6XFnDoL
- TLSH T1E4C4DF11B2C8C436F1F21A344AF09BA24D7B7C619B71E9CB2788166D1FB02D1EA79713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1996 ECA8.tmp 4944 ED64.tmp 5984 EE3E.tmp 5976 EEEA.tmp 4976 EFD5.tmp 3164 F090.tmp 2360 F13C.tmp 3612 F217.tmp 4344 F301.tmp 3144 F3CC.tmp 4144 F468.tmp 4004 F524.tmp 2020 F5DF.tmp 3984 F66C.tmp 2808 F6F9.tmp 5044 F7C4.tmp 3960 F8BE.tmp 1176 F95A.tmp 1244 FA54.tmp 3952 FB3E.tmp 3340 FBDB.tmp 472 FCA6.tmp 5864 FD52.tmp 4240 FDFE.tmp 3836 FED8.tmp 1888 FFA3.tmp 2948 40.tmp 3840 10B.tmp 824 197.tmp 2768 224.tmp 3944 2D0.tmp 3880 36C.tmp 2072 447.tmp 3112 4D4.tmp 2624 560.tmp 4940 5FC.tmp 5412 689.tmp 4308 706.tmp 4732 783.tmp 1408 800.tmp 4456 89C.tmp 3928 958.tmp 1380 9E4.tmp 6000 A71.tmp 4100 AEE.tmp 4816 B7B.tmp 1140 BF8.tmp 6004 C75.tmp 4480 CF2.tmp 5048 D9E.tmp 1840 E2A.tmp 4860 EB7.tmp 4880 F53.tmp 3152 FD0.tmp 5056 105D.tmp 1356 1118.tmp 5952 11A5.tmp 4396 1241.tmp 4188 12CE.tmp 944 135A.tmp 2672 13E7.tmp 984 1464.tmp 5064 14F1.tmp 3936 156E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 737C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 539F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 532D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C669.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4581.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B775.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1256 wrote to memory of 1996 1256 2026-08-17_b455228fdcafc3b7f41a08cb9ab58a7d_elex_mafia.exe 89 PID 1996 wrote to memory of 4944 1996 ECA8.tmp 90 PID 4944 wrote to memory of 5984 4944 ED64.tmp 91 PID 5984 wrote to memory of 5976 5984 EE3E.tmp 92 PID 5976 wrote to memory of 4976 5976 EEEA.tmp 93 PID 4976 wrote to memory of 3164 4976 EFD5.tmp 94 PID 3164 wrote to memory of 2360 3164 F090.tmp 95 PID 2360 wrote to memory of 3612 2360 F13C.tmp 96 PID 3612 wrote to memory of 4344 3612 F217.tmp 97 PID 4344 wrote to memory of 3144 4344 F301.tmp 98 PID 3144 wrote to memory of 4144 3144 F3CC.tmp 99 PID 4144 wrote to memory of 4004 4144 F468.tmp 100 PID 4004 wrote to memory of 2020 4004 F524.tmp 101 PID 2020 wrote to memory of 3984 2020 F5DF.tmp 102 PID 3984 wrote to memory of 2808 3984 F66C.tmp 103 PID 2808 wrote to memory of 5044 2808 F6F9.tmp 104 PID 5044 wrote to memory of 3960 5044 F7C4.tmp 105 PID 3960 wrote to memory of 1176 3960 F8BE.tmp 106 PID 1176 wrote to memory of 1244 1176 F95A.tmp 107 PID 1244 wrote to memory of 3952 1244 FA54.tmp 108 PID 3952 wrote to memory of 3340 3952 FB3E.tmp 109 PID 3340 wrote to memory of 472 3340 FBDB.tmp 110 PID 472 wrote to memory of 5864 472 FCA6.tmp 111 PID 5864 wrote to memory of 4240 5864 FD52.tmp 112 PID 4240 wrote to memory of 3836 4240 FDFE.tmp 113 PID 3836 wrote to memory of 1888 3836 FED8.tmp 114 PID 1888 wrote to memory of 2948 1888 FFA3.tmp 115 PID 2948 wrote to memory of 3840 2948 40.tmp 116 PID 3840 wrote to memory of 824 3840 10B.tmp 117 PID 824 wrote to memory of 2768 824 197.tmp 118 PID 2768 wrote to memory of 3944 2768 224.tmp 119 PID 3944 wrote to memory of 3880 3944 2D0.tmp 120 PID 3880 wrote to memory of 2072 3880 36C.tmp 121 PID 2072 wrote to memory of 3112 2072 447.tmp 122 PID 3112 wrote to memory of 2624 3112 4D4.tmp 123 PID 2624 wrote to memory of 4940 2624 560.tmp 124 PID 4940 wrote to memory of 5412 4940 5FC.tmp 125 PID 5412 wrote to memory of 4308 5412 689.tmp 126 PID 4308 wrote to memory of 4732 4308 706.tmp 127 PID 4732 wrote to memory of 1408 4732 783.tmp 128 PID 1408 wrote to memory of 4456 1408 800.tmp 129 PID 4456 wrote to memory of 3928 4456 89C.tmp 130 PID 3928 wrote to memory of 1380 3928 958.tmp 131 PID 1380 wrote to memory of 6000 1380 9E4.tmp 132 PID 6000 wrote to memory of 4100 6000 A71.tmp 133 PID 4100 wrote to memory of 4816 4100 AEE.tmp 134 PID 4816 wrote to memory of 1140 4816 B7B.tmp 135 PID 1140 wrote to memory of 6004 1140 BF8.tmp 136 PID 6004 wrote to memory of 4480 6004 C75.tmp 137 PID 4480 wrote to memory of 5048 4480 CF2.tmp 138 PID 5048 wrote to memory of 1840 5048 D9E.tmp 139 PID 1840 wrote to memory of 4860 1840 E2A.tmp 140 PID 4860 wrote to memory of 4880 4860 EB7.tmp 141 PID 4880 wrote to memory of 3152 4880 F53.tmp 142 PID 3152 wrote to memory of 5056 3152 FD0.tmp 143 PID 5056 wrote to memory of 1356 5056 105D.tmp 144 PID 1356 wrote to memory of 5952 1356 1118.tmp 145 PID 5952 wrote to memory of 4396 5952 11A5.tmp 146 PID 4396 wrote to memory of 4188 4396 1241.tmp 147 PID 4188 wrote to memory of 944 4188 12CE.tmp 148 PID 944 wrote to memory of 2672 944 135A.tmp 149 PID 2672 wrote to memory of 984 2672 13E7.tmp 150 PID 984 wrote to memory of 5064 984 1464.tmp 151 PID 5064 wrote to memory of 3936 5064 14F1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_b455228fdcafc3b7f41a08cb9ab58a7d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b455228fdcafc3b7f41a08cb9ab58a7d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\F090.tmp"C:\Users\Admin\AppData\Local\Temp\F090.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\F468.tmp"C:\Users\Admin\AppData\Local\Temp\F468.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\560.tmp"C:\Users\Admin\AppData\Local\Temp\560.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\89C.tmp"C:\Users\Admin\AppData\Local\Temp\89C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\958.tmp"C:\Users\Admin\AppData\Local\Temp\958.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\A71.tmp"C:\Users\Admin\AppData\Local\Temp\A71.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\AEE.tmp"C:\Users\Admin\AppData\Local\Temp\AEE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\B7B.tmp"C:\Users\Admin\AppData\Local\Temp\B7B.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\D9E.tmp"C:\Users\Admin\AppData\Local\Temp\D9E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\F53.tmp"C:\Users\Admin\AppData\Local\Temp\F53.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\1118.tmp"C:\Users\Admin\AppData\Local\Temp\1118.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\13E7.tmp"C:\Users\Admin\AppData\Local\Temp\13E7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\14F1.tmp"C:\Users\Admin\AppData\Local\Temp\14F1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"65⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"66⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"67⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"68⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"69⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\181D.tmp"C:\Users\Admin\AppData\Local\Temp\181D.tmp"70⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"71⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\1956.tmp"C:\Users\Admin\AppData\Local\Temp\1956.tmp"72⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\19F2.tmp"C:\Users\Admin\AppData\Local\Temp\19F2.tmp"73⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"74⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1B69.tmp"C:\Users\Admin\AppData\Local\Temp\1B69.tmp"75⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"76⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\1C44.tmp"C:\Users\Admin\AppData\Local\Temp\1C44.tmp"77⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"80⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"81⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"82⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"83⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"84⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"85⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\20F7.tmp"C:\Users\Admin\AppData\Local\Temp\20F7.tmp"86⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"87⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"88⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"89⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"90⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\23A6.tmp"C:\Users\Admin\AppData\Local\Temp\23A6.tmp"91⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\2442.tmp"C:\Users\Admin\AppData\Local\Temp\2442.tmp"92⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"93⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"94⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"95⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"96⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\26F2.tmp"C:\Users\Admin\AppData\Local\Temp\26F2.tmp"97⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"98⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\27FC.tmp"C:\Users\Admin\AppData\Local\Temp\27FC.tmp"99⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"100⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"101⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\29B1.tmp"C:\Users\Admin\AppData\Local\Temp\29B1.tmp"102⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"103⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"104⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"105⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"106⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"C:\Users\Admin\AppData\Local\Temp\2C8F.tmp"107⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"108⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"C:\Users\Admin\AppData\Local\Temp\2DA9.tmp"109⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\2E26.tmp"C:\Users\Admin\AppData\Local\Temp\2E26.tmp"110⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"111⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"112⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"113⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\301A.tmp"C:\Users\Admin\AppData\Local\Temp\301A.tmp"114⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\3087.tmp"C:\Users\Admin\AppData\Local\Temp\3087.tmp"115⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"116⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"117⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\322D.tmp"C:\Users\Admin\AppData\Local\Temp\322D.tmp"118⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"119⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\33B4.tmp"C:\Users\Admin\AppData\Local\Temp\33B4.tmp"120⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\3440.tmp"C:\Users\Admin\AppData\Local\Temp\3440.tmp"121⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\34CD.tmp"C:\Users\Admin\AppData\Local\Temp\34CD.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-