Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe
- Size 524KB
- Sample261002-xe74fawanf
- SHA256 56b48a467006fd368c3db9194fe9d9ab4bacbf8fb1296fa535ef35ea1852e604
- MD5 1dcf92a4bb69ffb57067f024c5e14ca9
- SHA1 3594d1fbf9062a08f54bdf8074971b98d546d929
- SHA512 86b5ae2d66c5d84df261abec807ac14746ab9ad019f7740d3fdb836614910e5bcb32867b0bb6df42bda1ce88c1825e23d1ed2dd5d7d549fd8aa86a0b2f8f23b8
- SSDEEP 12288:TRyZzqyL66Tv+XH3O7jlvUVp9xaIdX6OpG96jNZ:TRyQylTvQevlvo28X6UGEjN
- TLSH T16EB4F126B188C432E5D205324E65DF92597A3C719B67A4CB3BC4266E2FF13E1E27530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 380 71D0.tmp 4724 72D9.tmp 2196 73E3.tmp 744 74BE.tmp 3852 75A8.tmp 2204 76B2.tmp 464 779C.tmp 3104 78A6.tmp 3972 79A0.tmp 3244 7A8A.tmp 752 7B74.tmp 260 7C5F.tmp 4064 7D68.tmp 3304 7E72.tmp 748 7F4D.tmp 1400 8056.tmp 5004 8160.tmp 2120 821C.tmp 3404 8316.tmp 1160 842F.tmp 4028 8519.tmp 2460 85F4.tmp 1140 86CF.tmp 1916 879A.tmp 4336 8894.tmp 4332 899D.tmp 3172 8A97.tmp 3736 8B82.tmp 2236 8CBA.tmp 4372 8D95.tmp 3608 8E70.tmp 1596 8F89.tmp 4356 9093.tmp 3932 913F.tmp 1232 91EA.tmp 3968 9277.tmp 1428 9323.tmp 1088 93A0.tmp 1712 943C.tmp 2444 94F8.tmp 2268 9594.tmp 2664 9621.tmp 3392 96CC.tmp 4712 9759.tmp 1852 97E6.tmp 2456 9872.tmp 1356 98FF.tmp 4756 999B.tmp 400 99E9.tmp 2012 9A47.tmp 1144 9A95.tmp 436 9AF3.tmp 4648 9B41.tmp 2648 9B8F.tmp 4820 9BDD.tmp 2744 9C2B.tmp 3524 9C7A.tmp 3772 9CC8.tmp 2488 9D25.tmp 1476 9D74.tmp 3964 9DC2.tmp 2332 9E10.tmp 1248 9E6E.tmp 800 9EBC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D378.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 549E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9621.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 209E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 677A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4284 wrote to memory of 380 4284 2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe 86 PID 380 wrote to memory of 4724 380 71D0.tmp 87 PID 4724 wrote to memory of 2196 4724 72D9.tmp 89 PID 2196 wrote to memory of 744 2196 73E3.tmp 91 PID 744 wrote to memory of 3852 744 74BE.tmp 93 PID 3852 wrote to memory of 2204 3852 75A8.tmp 94 PID 2204 wrote to memory of 464 2204 76B2.tmp 95 PID 464 wrote to memory of 3104 464 779C.tmp 96 PID 3104 wrote to memory of 3972 3104 78A6.tmp 97 PID 3972 wrote to memory of 3244 3972 79A0.tmp 98 PID 3244 wrote to memory of 752 3244 7A8A.tmp 99 PID 752 wrote to memory of 260 752 7B74.tmp 100 PID 260 wrote to memory of 4064 260 7C5F.tmp 101 PID 4064 wrote to memory of 3304 4064 7D68.tmp 102 PID 3304 wrote to memory of 748 3304 7E72.tmp 103 PID 748 wrote to memory of 1400 748 7F4D.tmp 104 PID 1400 wrote to memory of 5004 1400 8056.tmp 105 PID 5004 wrote to memory of 2120 5004 8160.tmp 106 PID 2120 wrote to memory of 3404 2120 821C.tmp 109 PID 3404 wrote to memory of 1160 3404 8316.tmp 110 PID 1160 wrote to memory of 4028 1160 842F.tmp 111 PID 4028 wrote to memory of 2460 4028 8519.tmp 112 PID 2460 wrote to memory of 1140 2460 85F4.tmp 114 PID 1140 wrote to memory of 1916 1140 86CF.tmp 115 PID 1916 wrote to memory of 4336 1916 879A.tmp 116 PID 4336 wrote to memory of 4332 4336 8894.tmp 118 PID 4332 wrote to memory of 3172 4332 899D.tmp 119 PID 3172 wrote to memory of 3736 3172 8A97.tmp 120 PID 3736 wrote to memory of 2236 3736 8B82.tmp 121 PID 2236 wrote to memory of 4372 2236 8CBA.tmp 122 PID 4372 wrote to memory of 3608 4372 8D95.tmp 123 PID 3608 wrote to memory of 1596 3608 8E70.tmp 124 PID 1596 wrote to memory of 4356 1596 8F89.tmp 125 PID 4356 wrote to memory of 3932 4356 9093.tmp 126 PID 3932 wrote to memory of 1232 3932 913F.tmp 127 PID 1232 wrote to memory of 3968 1232 91EA.tmp 128 PID 3968 wrote to memory of 1428 3968 9277.tmp 130 PID 1428 wrote to memory of 1088 1428 9323.tmp 131 PID 1088 wrote to memory of 1712 1088 93A0.tmp 132 PID 1712 wrote to memory of 2444 1712 943C.tmp 133 PID 2444 wrote to memory of 2268 2444 94F8.tmp 134 PID 2268 wrote to memory of 2664 2268 9594.tmp 135 PID 2664 wrote to memory of 3392 2664 9621.tmp 136 PID 3392 wrote to memory of 4712 3392 96CC.tmp 137 PID 4712 wrote to memory of 1852 4712 9759.tmp 138 PID 1852 wrote to memory of 2456 1852 97E6.tmp 139 PID 2456 wrote to memory of 1356 2456 9872.tmp 140 PID 1356 wrote to memory of 4756 1356 98FF.tmp 141 PID 4756 wrote to memory of 400 4756 999B.tmp 142 PID 400 wrote to memory of 2012 400 99E9.tmp 143 PID 2012 wrote to memory of 1144 2012 9A47.tmp 144 PID 1144 wrote to memory of 436 1144 9A95.tmp 145 PID 436 wrote to memory of 4648 436 9AF3.tmp 146 PID 4648 wrote to memory of 2648 4648 9B41.tmp 147 PID 2648 wrote to memory of 4820 2648 9B8F.tmp 148 PID 4820 wrote to memory of 2744 4820 9BDD.tmp 149 PID 2744 wrote to memory of 3524 2744 9C2B.tmp 150 PID 3524 wrote to memory of 3772 3524 9C7A.tmp 151 PID 3772 wrote to memory of 2488 3772 9CC8.tmp 152 PID 2488 wrote to memory of 1476 2488 9D25.tmp 153 PID 1476 wrote to memory of 3964 1476 9D74.tmp 154 PID 3964 wrote to memory of 2332 3964 9DC2.tmp 155 PID 2332 wrote to memory of 1248 2332 9E10.tmp 156 PID 1248 wrote to memory of 800 1248 9E6E.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_1dcf92a4bb69ffb57067f024c5e14ca9_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\71D0.tmp"C:\Users\Admin\AppData\Local\Temp\71D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\78A6.tmp"C:\Users\Admin\AppData\Local\Temp\78A6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\7D68.tmp"C:\Users\Admin\AppData\Local\Temp\7D68.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\7E72.tmp"C:\Users\Admin\AppData\Local\Temp\7E72.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\842F.tmp"C:\Users\Admin\AppData\Local\Temp\842F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\85F4.tmp"C:\Users\Admin\AppData\Local\Temp\85F4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8A97.tmp"C:\Users\Admin\AppData\Local\Temp\8A97.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8F89.tmp"C:\Users\Admin\AppData\Local\Temp\8F89.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\9093.tmp"C:\Users\Admin\AppData\Local\Temp\9093.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\913F.tmp"C:\Users\Admin\AppData\Local\Temp\913F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\91EA.tmp"C:\Users\Admin\AppData\Local\Temp\91EA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\9323.tmp"C:\Users\Admin\AppData\Local\Temp\9323.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\96CC.tmp"C:\Users\Admin\AppData\Local\Temp\96CC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\97E6.tmp"C:\Users\Admin\AppData\Local\Temp\97E6.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9872.tmp"C:\Users\Admin\AppData\Local\Temp\9872.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\98FF.tmp"C:\Users\Admin\AppData\Local\Temp\98FF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\999B.tmp"C:\Users\Admin\AppData\Local\Temp\999B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9A47.tmp"C:\Users\Admin\AppData\Local\Temp\9A47.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"C:\Users\Admin\AppData\Local\Temp\9AF3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"C:\Users\Admin\AppData\Local\Temp\9CC8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\9D25.tmp"C:\Users\Admin\AppData\Local\Temp\9D25.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9E10.tmp"C:\Users\Admin\AppData\Local\Temp\9E10.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"65⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"66⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\9F58.tmp"C:\Users\Admin\AppData\Local\Temp\9F58.tmp"67⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\9FA6.tmp"C:\Users\Admin\AppData\Local\Temp\9FA6.tmp"68⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"69⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"70⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"71⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"72⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\A14C.tmp"C:\Users\Admin\AppData\Local\Temp\A14C.tmp"73⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\A19A.tmp"C:\Users\Admin\AppData\Local\Temp\A19A.tmp"74⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"75⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"76⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"77⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"78⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"79⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\A37E.tmp"C:\Users\Admin\AppData\Local\Temp\A37E.tmp"80⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"81⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\A44A.tmp"C:\Users\Admin\AppData\Local\Temp\A44A.tmp"82⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"83⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"C:\Users\Admin\AppData\Local\Temp\A4F5.tmp"84⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"85⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"C:\Users\Admin\AppData\Local\Temp\A5A1.tmp"86⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"C:\Users\Admin\AppData\Local\Temp\A5EF.tmp"87⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"88⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"89⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"90⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"91⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"92⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"93⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\A832.tmp"C:\Users\Admin\AppData\Local\Temp\A832.tmp"94⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"95⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"96⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"97⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"98⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"99⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\AA06.tmp"C:\Users\Admin\AppData\Local\Temp\AA06.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"101⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"102⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"103⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"104⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"105⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\ABEB.tmp"C:\Users\Admin\AppData\Local\Temp\ABEB.tmp"106⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\AC39.tmp"C:\Users\Admin\AppData\Local\Temp\AC39.tmp"107⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"108⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"109⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"110⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"111⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\ADBF.tmp"C:\Users\Admin\AppData\Local\Temp\ADBF.tmp"112⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"113⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"114⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"C:\Users\Admin\AppData\Local\Temp\AEAA.tmp"115⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\AEF8.tmp"C:\Users\Admin\AppData\Local\Temp\AEF8.tmp"116⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\AF46.tmp"C:\Users\Admin\AppData\Local\Temp\AF46.tmp"117⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\AF94.tmp"C:\Users\Admin\AppData\Local\Temp\AF94.tmp"118⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\AFE2.tmp"C:\Users\Admin\AppData\Local\Temp\AFE2.tmp"119⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"120⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"121⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-