Analysis
- max time kernel
111s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_3f32048aba8b6f66b4a80a5faebac1d5_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_3f32048aba8b6f66b4a80a5faebac1d5_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-19_3f32048aba8b6f66b4a80a5faebac1d5_elex_mafia.exe
- Size 520KB
- Sample260819-cdgjwack51
- SHA256 5cd1b45419a52d568144e9f20c568acd78a0068d675a2d9531ee86c4474275a9
- MD5 3f32048aba8b6f66b4a80a5faebac1d5
- SHA1 efd4932773a2ef2dee3831ef612f5d0e8b1809c2
- SHA512 279f86dd95f6bdc20c7b5028a51fd452ac11698842728feaee6458bbb0e772282114da22d0ab9d0d31e4a864c00668cec5d1eeba97abb4387b7c972e3148bf66
- SSDEEP 12288:gj8fuxR21t5i8fBXIzL7dIY3rjLEylIhbgmWgMNZ6:gj8fuK1GYxDY78QIhONI
- TLSH T179B4F112B545C032E59615305A66EFA60BBEBC344B36D1C73B8436ADAFB52D1E73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1856 5DC6.tmp 4280 5E53.tmp 2472 5EDF.tmp 4712 5F6C.tmp 1300 5FD9.tmp 4504 6085.tmp 6056 6160.tmp 3468 6298.tmp 5204 63A2.tmp 3340 644E.tmp 2036 6538.tmp 2908 65D4.tmp 2848 6680.tmp 1336 671D.tmp 5928 67D8.tmp 6076 68A3.tmp 4188 693F.tmp 2480 6A39.tmp 5284 6AF5.tmp 1512 6BEF.tmp 2868 6C7C.tmp 2836 6D27.tmp 1036 6DB4.tmp 6060 6E50.tmp 1808 6ECD.tmp 4540 6F5A.tmp 2688 6FD7.tmp 1160 7044.tmp 5240 70C1.tmp 4328 713E.tmp 4900 71AC.tmp 3400 7219.tmp 3920 7286.tmp 2292 72F4.tmp 5588 7352.tmp 5084 73CF.tmp 5260 743C.tmp 4424 749A.tmp 5372 7507.tmp 1280 7565.tmp 4464 75F1.tmp 4484 768E.tmp 3548 770B.tmp 4664 7797.tmp 3008 7834.tmp 4320 78D0.tmp 5644 796C.tmp 5672 7A18.tmp 1352 7A95.tmp 3844 7B22.tmp 5268 7BBE.tmp 2460 7C2B.tmp 712 7CD7.tmp 2140 7D54.tmp 2544 7DC1.tmp 2188 7E2F.tmp 3088 7EDB.tmp 4704 7F67.tmp 5328 7FF4.tmp 1584 8081.tmp 3312 810D.tmp 1732 818A.tmp 4284 81F8.tmp 5488 8265.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 279E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A09B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5836 wrote to memory of 1856 5836 2026-08-19_3f32048aba8b6f66b4a80a5faebac1d5_elex_mafia.exe 89 PID 1856 wrote to memory of 4280 1856 5DC6.tmp 90 PID 4280 wrote to memory of 2472 4280 5E53.tmp 91 PID 2472 wrote to memory of 4712 2472 5EDF.tmp 92 PID 4712 wrote to memory of 1300 4712 5F6C.tmp 93 PID 1300 wrote to memory of 4504 1300 5FD9.tmp 94 PID 4504 wrote to memory of 6056 4504 6085.tmp 95 PID 6056 wrote to memory of 3468 6056 6160.tmp 96 PID 3468 wrote to memory of 5204 3468 6298.tmp 97 PID 5204 wrote to memory of 3340 5204 63A2.tmp 98 PID 3340 wrote to memory of 2036 3340 644E.tmp 99 PID 2036 wrote to memory of 2908 2036 6538.tmp 100 PID 2908 wrote to memory of 2848 2908 65D4.tmp 101 PID 2848 wrote to memory of 1336 2848 6680.tmp 102 PID 1336 wrote to memory of 5928 1336 671D.tmp 103 PID 5928 wrote to memory of 6076 5928 67D8.tmp 104 PID 6076 wrote to memory of 4188 6076 68A3.tmp 105 PID 4188 wrote to memory of 2480 4188 693F.tmp 106 PID 2480 wrote to memory of 5284 2480 6A39.tmp 107 PID 5284 wrote to memory of 1512 5284 6AF5.tmp 108 PID 1512 wrote to memory of 2868 1512 6BEF.tmp 109 PID 2868 wrote to memory of 2836 2868 6C7C.tmp 110 PID 2836 wrote to memory of 1036 2836 6D27.tmp 111 PID 1036 wrote to memory of 6060 1036 6DB4.tmp 112 PID 6060 wrote to memory of 1808 6060 6E50.tmp 113 PID 1808 wrote to memory of 4540 1808 6ECD.tmp 114 PID 4540 wrote to memory of 2688 4540 6F5A.tmp 115 PID 2688 wrote to memory of 1160 2688 6FD7.tmp 116 PID 1160 wrote to memory of 5240 1160 7044.tmp 117 PID 5240 wrote to memory of 4328 5240 70C1.tmp 118 PID 4328 wrote to memory of 4900 4328 713E.tmp 119 PID 4900 wrote to memory of 3400 4900 71AC.tmp 120 PID 3400 wrote to memory of 3920 3400 7219.tmp 121 PID 3920 wrote to memory of 2292 3920 7286.tmp 122 PID 2292 wrote to memory of 5588 2292 72F4.tmp 123 PID 5588 wrote to memory of 5084 5588 7352.tmp 124 PID 5084 wrote to memory of 5260 5084 73CF.tmp 125 PID 5260 wrote to memory of 4424 5260 743C.tmp 126 PID 4424 wrote to memory of 5372 4424 749A.tmp 127 PID 5372 wrote to memory of 1280 5372 7507.tmp 128 PID 1280 wrote to memory of 4464 1280 7565.tmp 129 PID 4464 wrote to memory of 4484 4464 75F1.tmp 130 PID 4484 wrote to memory of 3548 4484 768E.tmp 131 PID 3548 wrote to memory of 4664 3548 770B.tmp 132 PID 4664 wrote to memory of 3008 4664 7797.tmp 133 PID 3008 wrote to memory of 4320 3008 7834.tmp 134 PID 4320 wrote to memory of 5644 4320 78D0.tmp 135 PID 5644 wrote to memory of 5672 5644 796C.tmp 136 PID 5672 wrote to memory of 1352 5672 7A18.tmp 137 PID 1352 wrote to memory of 3844 1352 7A95.tmp 138 PID 3844 wrote to memory of 5268 3844 7B22.tmp 139 PID 5268 wrote to memory of 2460 5268 7BBE.tmp 140 PID 2460 wrote to memory of 712 2460 7C2B.tmp 141 PID 712 wrote to memory of 2140 712 7CD7.tmp 142 PID 2140 wrote to memory of 2544 2140 7D54.tmp 143 PID 2544 wrote to memory of 2188 2544 7DC1.tmp 144 PID 2188 wrote to memory of 3088 2188 7E2F.tmp 145 PID 3088 wrote to memory of 4704 3088 7EDB.tmp 146 PID 4704 wrote to memory of 5328 4704 7F67.tmp 147 PID 5328 wrote to memory of 1584 5328 7FF4.tmp 148 PID 1584 wrote to memory of 3312 1584 8081.tmp 149 PID 3312 wrote to memory of 1732 3312 810D.tmp 150 PID 1732 wrote to memory of 4284 1732 818A.tmp 151 PID 4284 wrote to memory of 5488 4284 81F8.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_3f32048aba8b6f66b4a80a5faebac1d5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3f32048aba8b6f66b4a80a5faebac1d5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\5E53.tmp"C:\Users\Admin\AppData\Local\Temp\5E53.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\6160.tmp"C:\Users\Admin\AppData\Local\Temp\6160.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\63A2.tmp"C:\Users\Admin\AppData\Local\Temp\63A2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\67D8.tmp"C:\Users\Admin\AppData\Local\Temp\67D8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\68A3.tmp"C:\Users\Admin\AppData\Local\Temp\68A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6AF5.tmp"C:\Users\Admin\AppData\Local\Temp\6AF5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\6E50.tmp"C:\Users\Admin\AppData\Local\Temp\6E50.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\7352.tmp"C:\Users\Admin\AppData\Local\Temp\7352.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\73CF.tmp"C:\Users\Admin\AppData\Local\Temp\73CF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\743C.tmp"C:\Users\Admin\AppData\Local\Temp\743C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\770B.tmp"C:\Users\Admin\AppData\Local\Temp\770B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\7797.tmp"C:\Users\Admin\AppData\Local\Temp\7797.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\78D0.tmp"C:\Users\Admin\AppData\Local\Temp\78D0.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\7A95.tmp"C:\Users\Admin\AppData\Local\Temp\7A95.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7B22.tmp"C:\Users\Admin\AppData\Local\Temp\7B22.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\810D.tmp"C:\Users\Admin\AppData\Local\Temp\810D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\818A.tmp"C:\Users\Admin\AppData\Local\Temp\818A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"65⤵
- Executes dropped EXE
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\8320.tmp"C:\Users\Admin\AppData\Local\Temp\8320.tmp"66⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"67⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"68⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"69⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"70⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"71⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"72⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"73⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"74⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"76⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"77⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"78⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"79⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\8A64.tmp"C:\Users\Admin\AppData\Local\Temp\8A64.tmp"80⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"81⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"83⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"84⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"85⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"86⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"87⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"88⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"89⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\8F65.tmp"C:\Users\Admin\AppData\Local\Temp\8F65.tmp"90⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"91⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\907E.tmp"C:\Users\Admin\AppData\Local\Temp\907E.tmp"92⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"93⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"94⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"95⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\92C0.tmp"C:\Users\Admin\AppData\Local\Temp\92C0.tmp"96⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\933D.tmp"C:\Users\Admin\AppData\Local\Temp\933D.tmp"97⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9476.tmp"C:\Users\Admin\AppData\Local\Temp\9476.tmp"99⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\9503.tmp"C:\Users\Admin\AppData\Local\Temp\9503.tmp"100⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\958F.tmp"C:\Users\Admin\AppData\Local\Temp\958F.tmp"101⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"102⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\9699.tmp"C:\Users\Admin\AppData\Local\Temp\9699.tmp"103⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\9725.tmp"C:\Users\Admin\AppData\Local\Temp\9725.tmp"104⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"105⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"106⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"107⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"108⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"109⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"110⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"111⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"112⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\9C65.tmp"C:\Users\Admin\AppData\Local\Temp\9C65.tmp"113⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"114⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"115⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"116⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"117⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"118⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\9F82.tmp"C:\Users\Admin\AppData\Local\Temp\9F82.tmp"119⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A00F.tmp"C:\Users\Admin\AppData\Local\Temp\A00F.tmp"120⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\A09B.tmp"C:\Users\Admin\AppData\Local\Temp\A09B.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\A118.tmp"C:\Users\Admin\AppData\Local\Temp\A118.tmp"122⤵PID:4972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-