Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 20:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_e355b8e62ee7ee53fc426a10be49d121_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-02_e355b8e62ee7ee53fc426a10be49d121_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-02_e355b8e62ee7ee53fc426a10be49d121_elex_mafia.exe
- Size 524KB
- Sample261102-yzs1pacz9v
- SHA256 a8651faaecd51b6c14b960cf8605bab1abd1e6ac79c22e31552fb95ad6828e4a
- MD5 e355b8e62ee7ee53fc426a10be49d121
- SHA1 4c2cb20b9a0bda9044e81bc63a47511204a6736a
- SHA512 b7a91fd46ea9727916fc978a97fb9b6d484383c8a3bd0eeee6c77f3872ff51414a9b83306598c3eb303e1ae2404356ba446bb73093669d7c3fb53ae0afa903a6
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf78LOhYWsa65cSWHCOyPsn7gFUjzoRLJR9BcRcD9:TRyZzqyL66T4esbEcFU/CLJMcJNZ
- TLSH T11FB4F115B545C032E6D201358A6AEBA25A7B7CB19B66A5CB3B80367E2FF03D1D375303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2364 EB45.tmp 5764 EC6E.tmp 4708 ECFB.tmp 5616 ED78.tmp 2596 EE82.tmp 6036 EFCA.tmp 5408 F0A4.tmp 2500 F1FC.tmp 5672 F298.tmp 5952 F3A2.tmp 3260 F47D.tmp 2700 F596.tmp 3900 F671.tmp 4836 F7A9.tmp 2728 F894.tmp 304 F96E.tmp 4296 FA3A.tmp 1584 FB82.tmp 1288 FC8B.tmp 2568 FD66.tmp 1176 FE22.tmp 3496 FF2B.tmp 6132 35.tmp 2664 11F.tmp 2256 258.tmp 3364 332.tmp 4500 43C.tmp 5740 555.tmp 444 620.tmp 4388 769.tmp 6136 853.tmp 5004 94D.tmp 3468 A37.tmp 2956 B02.tmp 2068 B9F.tmp 5464 C5A.tmp 3204 D54.tmp 5580 DF0.tmp 4256 E8D.tmp 2152 F48.tmp 1180 FD5.tmp 2252 1081.tmp 604 113C.tmp 2948 1236.tmp 4120 12E2.tmp 1908 135F.tmp 3668 140B.tmp 5536 14C6.tmp 4636 1572.tmp 5880 15EF.tmp 4604 166C.tmp 4652 16DA.tmp 5440 1757.tmp 5472 17D4.tmp 5636 1851.tmp 1244 18CE.tmp 4876 195A.tmp 3340 19C8.tmp 824 1A35.tmp 4352 1AC2.tmp 5720 1B2F.tmp 4844 1BAC.tmp 4884 1C39.tmp 5796 1CB6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C64F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 417F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 547A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 805D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B44D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E12F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 500A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A86B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5732 wrote to memory of 2364 5732 2026-11-02_e355b8e62ee7ee53fc426a10be49d121_elex_mafia.exe 89 PID 2364 wrote to memory of 5764 2364 EB45.tmp 90 PID 5764 wrote to memory of 4708 5764 EC6E.tmp 91 PID 4708 wrote to memory of 5616 4708 ECFB.tmp 92 PID 5616 wrote to memory of 2596 5616 ED78.tmp 93 PID 2596 wrote to memory of 6036 2596 EE82.tmp 94 PID 6036 wrote to memory of 5408 6036 EFCA.tmp 95 PID 5408 wrote to memory of 2500 5408 F0A4.tmp 96 PID 2500 wrote to memory of 5672 2500 F1FC.tmp 97 PID 5672 wrote to memory of 5952 5672 F298.tmp 98 PID 5952 wrote to memory of 3260 5952 F3A2.tmp 99 PID 3260 wrote to memory of 2700 3260 F47D.tmp 100 PID 2700 wrote to memory of 3900 2700 F596.tmp 101 PID 3900 wrote to memory of 4836 3900 F671.tmp 102 PID 4836 wrote to memory of 2728 4836 F7A9.tmp 103 PID 2728 wrote to memory of 304 2728 F894.tmp 104 PID 304 wrote to memory of 4296 304 F96E.tmp 105 PID 4296 wrote to memory of 1584 4296 FA3A.tmp 106 PID 1584 wrote to memory of 1288 1584 FB82.tmp 107 PID 1288 wrote to memory of 2568 1288 FC8B.tmp 108 PID 2568 wrote to memory of 1176 2568 FD66.tmp 109 PID 1176 wrote to memory of 3496 1176 FE22.tmp 110 PID 3496 wrote to memory of 6132 3496 FF2B.tmp 111 PID 6132 wrote to memory of 2664 6132 35.tmp 112 PID 2664 wrote to memory of 2256 2664 11F.tmp 113 PID 2256 wrote to memory of 3364 2256 258.tmp 114 PID 3364 wrote to memory of 4500 3364 332.tmp 115 PID 4500 wrote to memory of 5740 4500 43C.tmp 116 PID 5740 wrote to memory of 444 5740 555.tmp 117 PID 444 wrote to memory of 4388 444 620.tmp 118 PID 4388 wrote to memory of 6136 4388 769.tmp 119 PID 6136 wrote to memory of 5004 6136 853.tmp 120 PID 5004 wrote to memory of 3468 5004 94D.tmp 121 PID 3468 wrote to memory of 2956 3468 A37.tmp 122 PID 2956 wrote to memory of 2068 2956 B02.tmp 123 PID 2068 wrote to memory of 5464 2068 B9F.tmp 124 PID 5464 wrote to memory of 3204 5464 C5A.tmp 125 PID 3204 wrote to memory of 5580 3204 D54.tmp 126 PID 5580 wrote to memory of 4256 5580 DF0.tmp 127 PID 4256 wrote to memory of 2152 4256 E8D.tmp 128 PID 2152 wrote to memory of 1180 2152 F48.tmp 129 PID 1180 wrote to memory of 2252 1180 FD5.tmp 130 PID 2252 wrote to memory of 604 2252 1081.tmp 131 PID 604 wrote to memory of 2948 604 113C.tmp 132 PID 2948 wrote to memory of 4120 2948 1236.tmp 133 PID 4120 wrote to memory of 1908 4120 12E2.tmp 134 PID 1908 wrote to memory of 3668 1908 135F.tmp 135 PID 3668 wrote to memory of 5536 3668 140B.tmp 136 PID 5536 wrote to memory of 4636 5536 14C6.tmp 137 PID 4636 wrote to memory of 5880 4636 1572.tmp 138 PID 5880 wrote to memory of 4604 5880 15EF.tmp 139 PID 4604 wrote to memory of 4652 4604 166C.tmp 140 PID 4652 wrote to memory of 5440 4652 16DA.tmp 141 PID 5440 wrote to memory of 5472 5440 1757.tmp 142 PID 5472 wrote to memory of 5636 5472 17D4.tmp 143 PID 5636 wrote to memory of 1244 5636 1851.tmp 144 PID 1244 wrote to memory of 4876 1244 18CE.tmp 145 PID 4876 wrote to memory of 3340 4876 195A.tmp 146 PID 3340 wrote to memory of 824 3340 19C8.tmp 147 PID 824 wrote to memory of 4352 824 1A35.tmp 148 PID 4352 wrote to memory of 5720 4352 1AC2.tmp 149 PID 5720 wrote to memory of 4844 5720 1B2F.tmp 150 PID 4844 wrote to memory of 4884 4844 1BAC.tmp 151 PID 4884 wrote to memory of 5796 4884 1C39.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_e355b8e62ee7ee53fc426a10be49d121_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e355b8e62ee7ee53fc426a10be49d121_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\EB45.tmp"C:\Users\Admin\AppData\Local\Temp\EB45.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\ED78.tmp"C:\Users\Admin\AppData\Local\Temp\ED78.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\F47D.tmp"C:\Users\Admin\AppData\Local\Temp\F47D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\F894.tmp"C:\Users\Admin\AppData\Local\Temp\F894.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\F96E.tmp"C:\Users\Admin\AppData\Local\Temp\F96E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\FB82.tmp"C:\Users\Admin\AppData\Local\Temp\FB82.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\332.tmp"C:\Users\Admin\AppData\Local\Temp\332.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\555.tmp"C:\Users\Admin\AppData\Local\Temp\555.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\620.tmp"C:\Users\Admin\AppData\Local\Temp\620.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\769.tmp"C:\Users\Admin\AppData\Local\Temp\769.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\A37.tmp"C:\Users\Admin\AppData\Local\Temp\A37.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\B9F.tmp"C:\Users\Admin\AppData\Local\Temp\B9F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\DF0.tmp"C:\Users\Admin\AppData\Local\Temp\DF0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\F48.tmp"C:\Users\Admin\AppData\Local\Temp\F48.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\FD5.tmp"C:\Users\Admin\AppData\Local\Temp\FD5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1081.tmp"C:\Users\Admin\AppData\Local\Temp\1081.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\113C.tmp"C:\Users\Admin\AppData\Local\Temp\113C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\1C39.tmp"C:\Users\Admin\AppData\Local\Temp\1C39.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"C:\Users\Admin\AppData\Local\Temp\1CB6.tmp"65⤵
- Executes dropped EXE
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\1D42.tmp"C:\Users\Admin\AppData\Local\Temp\1D42.tmp"66⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"67⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"68⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"69⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1F56.tmp"C:\Users\Admin\AppData\Local\Temp\1F56.tmp"70⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2001.tmp"C:\Users\Admin\AppData\Local\Temp\2001.tmp"71⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"72⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"73⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"74⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"75⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"76⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\23AB.tmp"C:\Users\Admin\AppData\Local\Temp\23AB.tmp"77⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"79⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"80⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\25ED.tmp"C:\Users\Admin\AppData\Local\Temp\25ED.tmp"81⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\26A9.tmp"C:\Users\Admin\AppData\Local\Temp\26A9.tmp"82⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\2726.tmp"C:\Users\Admin\AppData\Local\Temp\2726.tmp"83⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\27B2.tmp"C:\Users\Admin\AppData\Local\Temp\27B2.tmp"84⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"85⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"86⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\2977.tmp"C:\Users\Admin\AppData\Local\Temp\2977.tmp"87⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"88⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"89⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"90⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"91⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"92⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2D11.tmp"C:\Users\Admin\AppData\Local\Temp\2D11.tmp"93⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"94⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"95⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"96⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\2F44.tmp"C:\Users\Admin\AppData\Local\Temp\2F44.tmp"97⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"98⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\306D.tmp"C:\Users\Admin\AppData\Local\Temp\306D.tmp"99⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"100⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"101⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\3212.tmp"C:\Users\Admin\AppData\Local\Temp\3212.tmp"102⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\329F.tmp"C:\Users\Admin\AppData\Local\Temp\329F.tmp"103⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"104⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"105⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\3426.tmp"C:\Users\Admin\AppData\Local\Temp\3426.tmp"106⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"108⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\35AC.tmp"C:\Users\Admin\AppData\Local\Temp\35AC.tmp"109⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"110⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\3687.tmp"C:\Users\Admin\AppData\Local\Temp\3687.tmp"111⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"112⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"113⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"114⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\388B.tmp"C:\Users\Admin\AppData\Local\Temp\388B.tmp"115⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3908.tmp"C:\Users\Admin\AppData\Local\Temp\3908.tmp"116⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3985.tmp"C:\Users\Admin\AppData\Local\Temp\3985.tmp"117⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\3A11.tmp"C:\Users\Admin\AppData\Local\Temp\3A11.tmp"118⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"119⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"C:\Users\Admin\AppData\Local\Temp\3B0B.tmp"120⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"121⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"122⤵PID:5360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-