Analysis
- max time kernel
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_b3dad6ebe61e74f6ba4b0a39fd11b4ba_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_b3dad6ebe61e74f6ba4b0a39fd11b4ba_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-18_b3dad6ebe61e74f6ba4b0a39fd11b4ba_elex_mafia.exe
- Size 520KB
- Sample260818-24sr9styht
- SHA256 3b109fcbd9fc2b0387596c97c29a87503a4067047890c7a6fda4331de7a589f1
- MD5 b3dad6ebe61e74f6ba4b0a39fd11b4ba
- SHA1 3f69e82e3a1179a904400912a37a430ddd6a4be5
- SHA512 07498429fdbca566b1a2a41e2e086e09c19931c9652ac5007f5f019b288fee446158f4abb8b2806e798c020e512a06cc69176c8cf327ae95c92705e84f9b1318
- SSDEEP 12288:gj8fuxR21t5i8fRCm27OBhzo0nws1V+TdbeNZ6:gj8fuK1GYc9OTzo0nws+T1eNI
- TLSH T14FB4F1167445C033E99205318B52DBA50BBABC795B26C1C73BD03BAD6FB52D1EA3830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 824 41FC.tmp 4136 42E6.tmp 4264 43C1.tmp 5488 44EA.tmp 1492 45B5.tmp 5108 4670.tmp 3200 46FD.tmp 5652 47A9.tmp 1876 4845.tmp 4856 48E1.tmp 3044 498D.tmp 4344 4A68.tmp 2300 4B62.tmp 1192 4C4C.tmp 1028 4D46.tmp 3836 4DB4.tmp 3288 4E40.tmp 3008 4ECD.tmp 5020 4F4A.tmp 1940 5015.tmp 4132 511F.tmp 4808 51EA.tmp 3976 52B5.tmp 4748 5351.tmp 1104 53CE.tmp 1608 54C8.tmp 5908 5555.tmp 4556 5601.tmp 2416 569D.tmp 1720 572A.tmp 5256 57E5.tmp 2724 5862.tmp 2788 593D.tmp 5064 59BA.tmp 2000 5A56.tmp 3924 5AC4.tmp 4752 5B41.tmp 5868 5BBE.tmp 1932 5C4A.tmp 5956 5CC7.tmp 3896 5D44.tmp 3832 5DB2.tmp 1312 5E3E.tmp 2172 5E9C.tmp 3652 5F38.tmp 4904 5FB5.tmp 2864 6023.tmp 1560 60A0.tmp 1916 611D.tmp 552 618A.tmp 4480 6207.tmp 2428 6284.tmp 5692 6311.tmp 4000 639D.tmp 2952 642A.tmp 2408 64D6.tmp 2920 6562.tmp 4140 65EF.tmp 3480 669B.tmp 4364 6708.tmp 5824 67A4.tmp 4316 6821.tmp 5308 689E.tmp 5296 691B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2840.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B562.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E79D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 735C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E53C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 169D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 996E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 237D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 881D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B34F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 299D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C370.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D4B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 824 3260 2026-08-18_b3dad6ebe61e74f6ba4b0a39fd11b4ba_elex_mafia.exe 89 PID 824 wrote to memory of 4136 824 41FC.tmp 90 PID 4136 wrote to memory of 4264 4136 42E6.tmp 91 PID 4264 wrote to memory of 5488 4264 43C1.tmp 92 PID 5488 wrote to memory of 1492 5488 44EA.tmp 93 PID 1492 wrote to memory of 5108 1492 45B5.tmp 94 PID 5108 wrote to memory of 3200 5108 4670.tmp 95 PID 3200 wrote to memory of 5652 3200 46FD.tmp 96 PID 5652 wrote to memory of 1876 5652 47A9.tmp 97 PID 1876 wrote to memory of 4856 1876 4845.tmp 98 PID 4856 wrote to memory of 3044 4856 48E1.tmp 99 PID 3044 wrote to memory of 4344 3044 498D.tmp 100 PID 4344 wrote to memory of 2300 4344 4A68.tmp 101 PID 2300 wrote to memory of 1192 2300 4B62.tmp 102 PID 1192 wrote to memory of 1028 1192 4C4C.tmp 103 PID 1028 wrote to memory of 3836 1028 4D46.tmp 104 PID 3836 wrote to memory of 3288 3836 4DB4.tmp 105 PID 3288 wrote to memory of 3008 3288 4E40.tmp 106 PID 3008 wrote to memory of 5020 3008 4ECD.tmp 107 PID 5020 wrote to memory of 1940 5020 4F4A.tmp 108 PID 1940 wrote to memory of 4132 1940 5015.tmp 109 PID 4132 wrote to memory of 4808 4132 511F.tmp 110 PID 4808 wrote to memory of 3976 4808 51EA.tmp 111 PID 3976 wrote to memory of 4748 3976 52B5.tmp 112 PID 4748 wrote to memory of 1104 4748 5351.tmp 113 PID 1104 wrote to memory of 1608 1104 53CE.tmp 114 PID 1608 wrote to memory of 5908 1608 54C8.tmp 115 PID 5908 wrote to memory of 4556 5908 5555.tmp 116 PID 4556 wrote to memory of 2416 4556 5601.tmp 117 PID 2416 wrote to memory of 1720 2416 569D.tmp 118 PID 1720 wrote to memory of 5256 1720 572A.tmp 119 PID 5256 wrote to memory of 2724 5256 57E5.tmp 120 PID 2724 wrote to memory of 2788 2724 5862.tmp 121 PID 2788 wrote to memory of 5064 2788 593D.tmp 122 PID 5064 wrote to memory of 2000 5064 59BA.tmp 123 PID 2000 wrote to memory of 3924 2000 5A56.tmp 124 PID 3924 wrote to memory of 4752 3924 5AC4.tmp 125 PID 4752 wrote to memory of 5868 4752 5B41.tmp 126 PID 5868 wrote to memory of 1932 5868 5BBE.tmp 127 PID 1932 wrote to memory of 5956 1932 5C4A.tmp 128 PID 5956 wrote to memory of 3896 5956 5CC7.tmp 129 PID 3896 wrote to memory of 3832 3896 5D44.tmp 130 PID 3832 wrote to memory of 1312 3832 5DB2.tmp 131 PID 1312 wrote to memory of 2172 1312 5E3E.tmp 132 PID 2172 wrote to memory of 3652 2172 5E9C.tmp 133 PID 3652 wrote to memory of 4904 3652 5F38.tmp 134 PID 4904 wrote to memory of 2864 4904 5FB5.tmp 135 PID 2864 wrote to memory of 1560 2864 6023.tmp 136 PID 1560 wrote to memory of 1916 1560 60A0.tmp 137 PID 1916 wrote to memory of 552 1916 611D.tmp 138 PID 552 wrote to memory of 4480 552 618A.tmp 139 PID 4480 wrote to memory of 2428 4480 6207.tmp 140 PID 2428 wrote to memory of 5692 2428 6284.tmp 141 PID 5692 wrote to memory of 4000 5692 6311.tmp 142 PID 4000 wrote to memory of 2952 4000 639D.tmp 143 PID 2952 wrote to memory of 2408 2952 642A.tmp 144 PID 2408 wrote to memory of 2920 2408 64D6.tmp 145 PID 2920 wrote to memory of 4140 2920 6562.tmp 146 PID 4140 wrote to memory of 3480 4140 65EF.tmp 147 PID 3480 wrote to memory of 4364 3480 669B.tmp 148 PID 4364 wrote to memory of 5824 4364 6708.tmp 149 PID 5824 wrote to memory of 4316 5824 67A4.tmp 150 PID 4316 wrote to memory of 5308 4316 6821.tmp 151 PID 5308 wrote to memory of 5296 5308 689E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_b3dad6ebe61e74f6ba4b0a39fd11b4ba_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_b3dad6ebe61e74f6ba4b0a39fd11b4ba_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\41FC.tmp"C:\Users\Admin\AppData\Local\Temp\41FC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\43C1.tmp"C:\Users\Admin\AppData\Local\Temp\43C1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\44EA.tmp"C:\Users\Admin\AppData\Local\Temp\44EA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\45B5.tmp"C:\Users\Admin\AppData\Local\Temp\45B5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\4670.tmp"C:\Users\Admin\AppData\Local\Temp\4670.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\46FD.tmp"C:\Users\Admin\AppData\Local\Temp\46FD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\47A9.tmp"C:\Users\Admin\AppData\Local\Temp\47A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\4845.tmp"C:\Users\Admin\AppData\Local\Temp\4845.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\48E1.tmp"C:\Users\Admin\AppData\Local\Temp\48E1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\498D.tmp"C:\Users\Admin\AppData\Local\Temp\498D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\4E40.tmp"C:\Users\Admin\AppData\Local\Temp\4E40.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4ECD.tmp"C:\Users\Admin\AppData\Local\Temp\4ECD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"C:\Users\Admin\AppData\Local\Temp\4F4A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5015.tmp"C:\Users\Admin\AppData\Local\Temp\5015.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\511F.tmp"C:\Users\Admin\AppData\Local\Temp\511F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\51EA.tmp"C:\Users\Admin\AppData\Local\Temp\51EA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\52B5.tmp"C:\Users\Admin\AppData\Local\Temp\52B5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5351.tmp"C:\Users\Admin\AppData\Local\Temp\5351.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\53CE.tmp"C:\Users\Admin\AppData\Local\Temp\53CE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\54C8.tmp"C:\Users\Admin\AppData\Local\Temp\54C8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5555.tmp"C:\Users\Admin\AppData\Local\Temp\5555.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\5601.tmp"C:\Users\Admin\AppData\Local\Temp\5601.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\569D.tmp"C:\Users\Admin\AppData\Local\Temp\569D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\572A.tmp"C:\Users\Admin\AppData\Local\Temp\572A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\57E5.tmp"C:\Users\Admin\AppData\Local\Temp\57E5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\5862.tmp"C:\Users\Admin\AppData\Local\Temp\5862.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\593D.tmp"C:\Users\Admin\AppData\Local\Temp\593D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\59BA.tmp"C:\Users\Admin\AppData\Local\Temp\59BA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5A56.tmp"C:\Users\Admin\AppData\Local\Temp\5A56.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\5AC4.tmp"C:\Users\Admin\AppData\Local\Temp\5AC4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\5BBE.tmp"C:\Users\Admin\AppData\Local\Temp\5BBE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\5D44.tmp"C:\Users\Admin\AppData\Local\Temp\5D44.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\5DB2.tmp"C:\Users\Admin\AppData\Local\Temp\5DB2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5F38.tmp"C:\Users\Admin\AppData\Local\Temp\5F38.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5FB5.tmp"C:\Users\Admin\AppData\Local\Temp\5FB5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\6023.tmp"C:\Users\Admin\AppData\Local\Temp\6023.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\60A0.tmp"C:\Users\Admin\AppData\Local\Temp\60A0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\618A.tmp"C:\Users\Admin\AppData\Local\Temp\618A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\6207.tmp"C:\Users\Admin\AppData\Local\Temp\6207.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\6284.tmp"C:\Users\Admin\AppData\Local\Temp\6284.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6311.tmp"C:\Users\Admin\AppData\Local\Temp\6311.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\639D.tmp"C:\Users\Admin\AppData\Local\Temp\639D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\642A.tmp"C:\Users\Admin\AppData\Local\Temp\642A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\64D6.tmp"C:\Users\Admin\AppData\Local\Temp\64D6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\6562.tmp"C:\Users\Admin\AppData\Local\Temp\6562.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\65EF.tmp"C:\Users\Admin\AppData\Local\Temp\65EF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\669B.tmp"C:\Users\Admin\AppData\Local\Temp\669B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\6708.tmp"C:\Users\Admin\AppData\Local\Temp\6708.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\67A4.tmp"C:\Users\Admin\AppData\Local\Temp\67A4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\689E.tmp"C:\Users\Admin\AppData\Local\Temp\689E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\691B.tmp"C:\Users\Admin\AppData\Local\Temp\691B.tmp"65⤵
- Executes dropped EXE
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\6998.tmp"C:\Users\Admin\AppData\Local\Temp\6998.tmp"66⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6A06.tmp"C:\Users\Admin\AppData\Local\Temp\6A06.tmp"67⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\6E7A.tmp"C:\Users\Admin\AppData\Local\Temp\6E7A.tmp"68⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6F17.tmp"C:\Users\Admin\AppData\Local\Temp\6F17.tmp"69⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"C:\Users\Admin\AppData\Local\Temp\6FA3.tmp"70⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\7030.tmp"C:\Users\Admin\AppData\Local\Temp\7030.tmp"71⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"72⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\7168.tmp"C:\Users\Admin\AppData\Local\Temp\7168.tmp"73⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"74⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"75⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\72D0.tmp"C:\Users\Admin\AppData\Local\Temp\72D0.tmp"76⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"78⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7476.tmp"C:\Users\Admin\AppData\Local\Temp\7476.tmp"79⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"80⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\757F.tmp"C:\Users\Admin\AppData\Local\Temp\757F.tmp"81⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\75ED.tmp"C:\Users\Admin\AppData\Local\Temp\75ED.tmp"82⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\7699.tmp"C:\Users\Admin\AppData\Local\Temp\7699.tmp"83⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7716.tmp"C:\Users\Admin\AppData\Local\Temp\7716.tmp"84⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\77A2.tmp"C:\Users\Admin\AppData\Local\Temp\77A2.tmp"85⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\782F.tmp"C:\Users\Admin\AppData\Local\Temp\782F.tmp"86⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\78BB.tmp"C:\Users\Admin\AppData\Local\Temp\78BB.tmp"87⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\7938.tmp"C:\Users\Admin\AppData\Local\Temp\7938.tmp"88⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"89⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\7A61.tmp"C:\Users\Admin\AppData\Local\Temp\7A61.tmp"90⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"91⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"92⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\7C07.tmp"C:\Users\Admin\AppData\Local\Temp\7C07.tmp"93⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\7C94.tmp"C:\Users\Admin\AppData\Local\Temp\7C94.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7D30.tmp"C:\Users\Admin\AppData\Local\Temp\7D30.tmp"95⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"96⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"C:\Users\Admin\AppData\Local\Temp\7E3A.tmp"97⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"98⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"99⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"100⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\808B.tmp"C:\Users\Admin\AppData\Local\Temp\808B.tmp"101⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\8118.tmp"C:\Users\Admin\AppData\Local\Temp\8118.tmp"102⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\8176.tmp"C:\Users\Admin\AppData\Local\Temp\8176.tmp"103⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\8212.tmp"C:\Users\Admin\AppData\Local\Temp\8212.tmp"104⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\82BE.tmp"C:\Users\Admin\AppData\Local\Temp\82BE.tmp"105⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\833B.tmp"C:\Users\Admin\AppData\Local\Temp\833B.tmp"106⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\83B8.tmp"C:\Users\Admin\AppData\Local\Temp\83B8.tmp"107⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\8454.tmp"C:\Users\Admin\AppData\Local\Temp\8454.tmp"108⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\84D1.tmp"C:\Users\Admin\AppData\Local\Temp\84D1.tmp"109⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\854E.tmp"C:\Users\Admin\AppData\Local\Temp\854E.tmp"110⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\85BC.tmp"C:\Users\Admin\AppData\Local\Temp\85BC.tmp"111⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\8629.tmp"C:\Users\Admin\AppData\Local\Temp\8629.tmp"112⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8687.tmp"C:\Users\Admin\AppData\Local\Temp\8687.tmp"113⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"114⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\8781.tmp"C:\Users\Admin\AppData\Local\Temp\8781.tmp"115⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\881D.tmp"C:\Users\Admin\AppData\Local\Temp\881D.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\88AA.tmp"C:\Users\Admin\AppData\Local\Temp\88AA.tmp"117⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\8936.tmp"C:\Users\Admin\AppData\Local\Temp\8936.tmp"118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\89B3.tmp"C:\Users\Admin\AppData\Local\Temp\89B3.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8A40.tmp"C:\Users\Admin\AppData\Local\Temp\8A40.tmp"120⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"121⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\8B3A.tmp"C:\Users\Admin\AppData\Local\Temp\8B3A.tmp"122⤵PID:5200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-