Analysis
- max time kernel
125s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 02:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-12_5b2938da150977032121e2932ab9b51d_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-12_5b2938da150977032121e2932ab9b51d_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-12_5b2938da150977032121e2932ab9b51d_elex_mafia.exe
- Size 518KB
- Sample261113-csbbeaey5x
- SHA256 89b94bd7a7695ba8b6010f5db37a34298919d53bc13cae9f4399af683a37440c
- MD5 5b2938da150977032121e2932ab9b51d
- SHA1 1f4a1336a334eefa0eee1c38a1dde2aeeb51fa91
- SHA512 bf7e58dc0438dbdb7756bf38e4a61bba721fdf9e1e7e410cf7aea1de19f6c6f725a4f973d3d698c41c7f3b9d2aaf30d97827112d56c060b7d5b1caa63a8f2158
- SSDEEP 12288:anTpha1Jvu4CsEhY4yxOcJIFQkwI/6ZW1l0MBMeMNZ:any1E4xocJIlrOnN
- TLSH T142B4F112B881C032F69211354A66EB52583A7C715B3A64C73BC8367E6FB53C2E77531B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3228 225E.tmp 4080 22FA.tmp 4784 23E5.tmp 5860 2636.tmp 1892 26C3.tmp 4160 275F.tmp 560 27DC.tmp 5444 2879.tmp 4256 2924.tmp 5100 29E0.tmp 2572 2AAB.tmp 616 2B95.tmp 3076 2C41.tmp 4208 2CCE.tmp 3100 2D7A.tmp 4196 2E16.tmp 2284 2EC2.tmp 3460 2F3F.tmp 1504 2FDB.tmp 5096 3077.tmp 4568 3114.tmp 1112 31C0.tmp 1816 325C.tmp 4532 3308.tmp 700 33A4.tmp 4756 345F.tmp 4268 350B.tmp 4228 3598.tmp 5832 3644.tmp 5188 36FF.tmp 3104 379C.tmp 5004 3838.tmp 2208 3903.tmp 3776 3970.tmp 4052 39DE.tmp 1272 3A7A.tmp 5740 3B07.tmp 2852 3B84.tmp 3116 3C01.tmp 4332 3C6E.tmp 1152 3CEB.tmp 1376 3D68.tmp 3748 3DE5.tmp 4616 3E62.tmp 3640 3EFE.tmp 2144 3F5C.tmp 772 3FD9.tmp 5144 4075.tmp 4928 40F2.tmp 5784 416F.tmp 4044 41EC.tmp 1636 425A.tmp 3688 42D7.tmp 5888 4344.tmp 1140 43A2.tmp 1344 441F.tmp 5084 449C.tmp 2272 4538.tmp 4948 45B5.tmp 1844 4613.tmp 2532 4690.tmp 2204 470D.tmp 2348 47A9.tmp 5608 4826.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A941.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 436E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 470D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7967.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C05E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 703B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E66A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 293F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58DF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3652 wrote to memory of 3228 3652 2026-11-12_5b2938da150977032121e2932ab9b51d_elex_mafia.exe 88 PID 3228 wrote to memory of 4080 3228 225E.tmp 89 PID 4080 wrote to memory of 4784 4080 22FA.tmp 90 PID 4784 wrote to memory of 5860 4784 23E5.tmp 91 PID 5860 wrote to memory of 1892 5860 2636.tmp 92 PID 1892 wrote to memory of 4160 1892 26C3.tmp 93 PID 4160 wrote to memory of 560 4160 275F.tmp 94 PID 560 wrote to memory of 5444 560 27DC.tmp 95 PID 5444 wrote to memory of 4256 5444 2879.tmp 96 PID 4256 wrote to memory of 5100 4256 2924.tmp 97 PID 5100 wrote to memory of 2572 5100 29E0.tmp 98 PID 2572 wrote to memory of 616 2572 2AAB.tmp 99 PID 616 wrote to memory of 3076 616 2B95.tmp 100 PID 3076 wrote to memory of 4208 3076 2C41.tmp 101 PID 4208 wrote to memory of 3100 4208 2CCE.tmp 102 PID 3100 wrote to memory of 4196 3100 2D7A.tmp 103 PID 4196 wrote to memory of 2284 4196 2E16.tmp 104 PID 2284 wrote to memory of 3460 2284 2EC2.tmp 105 PID 3460 wrote to memory of 1504 3460 2F3F.tmp 106 PID 1504 wrote to memory of 5096 1504 2FDB.tmp 107 PID 5096 wrote to memory of 4568 5096 3077.tmp 108 PID 4568 wrote to memory of 1112 4568 3114.tmp 109 PID 1112 wrote to memory of 1816 1112 31C0.tmp 110 PID 1816 wrote to memory of 4532 1816 325C.tmp 111 PID 4532 wrote to memory of 700 4532 3308.tmp 112 PID 700 wrote to memory of 4756 700 33A4.tmp 113 PID 4756 wrote to memory of 4268 4756 345F.tmp 114 PID 4268 wrote to memory of 4228 4268 350B.tmp 115 PID 4228 wrote to memory of 5832 4228 3598.tmp 116 PID 5832 wrote to memory of 5188 5832 3644.tmp 117 PID 5188 wrote to memory of 3104 5188 36FF.tmp 118 PID 3104 wrote to memory of 5004 3104 379C.tmp 119 PID 5004 wrote to memory of 2208 5004 3838.tmp 120 PID 2208 wrote to memory of 3776 2208 3903.tmp 121 PID 3776 wrote to memory of 4052 3776 3970.tmp 122 PID 4052 wrote to memory of 1272 4052 39DE.tmp 123 PID 1272 wrote to memory of 5740 1272 3A7A.tmp 124 PID 5740 wrote to memory of 2852 5740 3B07.tmp 125 PID 2852 wrote to memory of 3116 2852 3B84.tmp 126 PID 3116 wrote to memory of 4332 3116 3C01.tmp 127 PID 4332 wrote to memory of 1152 4332 3C6E.tmp 128 PID 1152 wrote to memory of 1376 1152 3CEB.tmp 129 PID 1376 wrote to memory of 3748 1376 3D68.tmp 130 PID 3748 wrote to memory of 4616 3748 3DE5.tmp 131 PID 4616 wrote to memory of 3640 4616 3E62.tmp 132 PID 3640 wrote to memory of 2144 3640 3EFE.tmp 133 PID 2144 wrote to memory of 772 2144 3F5C.tmp 134 PID 772 wrote to memory of 5144 772 3FD9.tmp 135 PID 5144 wrote to memory of 4928 5144 4075.tmp 136 PID 4928 wrote to memory of 5784 4928 40F2.tmp 137 PID 5784 wrote to memory of 4044 5784 416F.tmp 138 PID 4044 wrote to memory of 1636 4044 41EC.tmp 139 PID 1636 wrote to memory of 3688 1636 425A.tmp 140 PID 3688 wrote to memory of 5888 3688 42D7.tmp 141 PID 5888 wrote to memory of 1140 5888 4344.tmp 142 PID 1140 wrote to memory of 1344 1140 43A2.tmp 143 PID 1344 wrote to memory of 5084 1344 441F.tmp 144 PID 5084 wrote to memory of 2272 5084 449C.tmp 145 PID 2272 wrote to memory of 4948 2272 4538.tmp 146 PID 4948 wrote to memory of 1844 4948 45B5.tmp 147 PID 1844 wrote to memory of 2532 1844 4613.tmp 148 PID 2532 wrote to memory of 2204 2532 4690.tmp 149 PID 2204 wrote to memory of 2348 2204 470D.tmp 150 PID 2348 wrote to memory of 5608 2348 47A9.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_5b2938da150977032121e2932ab9b51d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_5b2938da150977032121e2932ab9b51d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\225E.tmp"C:\Users\Admin\AppData\Local\Temp\225E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2B95.tmp"C:\Users\Admin\AppData\Local\Temp\2B95.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\2C41.tmp"C:\Users\Admin\AppData\Local\Temp\2C41.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\2E16.tmp"C:\Users\Admin\AppData\Local\Temp\2E16.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"C:\Users\Admin\AppData\Local\Temp\2F3F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"C:\Users\Admin\AppData\Local\Temp\2FDB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\3077.tmp"C:\Users\Admin\AppData\Local\Temp\3077.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3114.tmp"C:\Users\Admin\AppData\Local\Temp\3114.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\325C.tmp"C:\Users\Admin\AppData\Local\Temp\325C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3308.tmp"C:\Users\Admin\AppData\Local\Temp\3308.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\33A4.tmp"C:\Users\Admin\AppData\Local\Temp\33A4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\345F.tmp"C:\Users\Admin\AppData\Local\Temp\345F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\350B.tmp"C:\Users\Admin\AppData\Local\Temp\350B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\3644.tmp"C:\Users\Admin\AppData\Local\Temp\3644.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\36FF.tmp"C:\Users\Admin\AppData\Local\Temp\36FF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\379C.tmp"C:\Users\Admin\AppData\Local\Temp\379C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\3838.tmp"C:\Users\Admin\AppData\Local\Temp\3838.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3903.tmp"C:\Users\Admin\AppData\Local\Temp\3903.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3970.tmp"C:\Users\Admin\AppData\Local\Temp\3970.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\39DE.tmp"C:\Users\Admin\AppData\Local\Temp\39DE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"C:\Users\Admin\AppData\Local\Temp\3A7A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3B07.tmp"C:\Users\Admin\AppData\Local\Temp\3B07.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\3B84.tmp"C:\Users\Admin\AppData\Local\Temp\3B84.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3C01.tmp"C:\Users\Admin\AppData\Local\Temp\3C01.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"C:\Users\Admin\AppData\Local\Temp\3CEB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\3D68.tmp"C:\Users\Admin\AppData\Local\Temp\3D68.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\3E62.tmp"C:\Users\Admin\AppData\Local\Temp\3E62.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3EFE.tmp"C:\Users\Admin\AppData\Local\Temp\3EFE.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3FD9.tmp"C:\Users\Admin\AppData\Local\Temp\3FD9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\4075.tmp"C:\Users\Admin\AppData\Local\Temp\4075.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\40F2.tmp"C:\Users\Admin\AppData\Local\Temp\40F2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\416F.tmp"C:\Users\Admin\AppData\Local\Temp\416F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\41EC.tmp"C:\Users\Admin\AppData\Local\Temp\41EC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\425A.tmp"C:\Users\Admin\AppData\Local\Temp\425A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\42D7.tmp"C:\Users\Admin\AppData\Local\Temp\42D7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4344.tmp"C:\Users\Admin\AppData\Local\Temp\4344.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\43A2.tmp"C:\Users\Admin\AppData\Local\Temp\43A2.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\441F.tmp"C:\Users\Admin\AppData\Local\Temp\441F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\449C.tmp"C:\Users\Admin\AppData\Local\Temp\449C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\4538.tmp"C:\Users\Admin\AppData\Local\Temp\4538.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\45B5.tmp"C:\Users\Admin\AppData\Local\Temp\45B5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\4690.tmp"C:\Users\Admin\AppData\Local\Temp\4690.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\470D.tmp"C:\Users\Admin\AppData\Local\Temp\470D.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\47A9.tmp"C:\Users\Admin\AppData\Local\Temp\47A9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\4826.tmp"C:\Users\Admin\AppData\Local\Temp\4826.tmp"65⤵
- Executes dropped EXE
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\48A3.tmp"C:\Users\Admin\AppData\Local\Temp\48A3.tmp"66⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\493F.tmp"C:\Users\Admin\AppData\Local\Temp\493F.tmp"67⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\49DB.tmp"C:\Users\Admin\AppData\Local\Temp\49DB.tmp"68⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\4A58.tmp"C:\Users\Admin\AppData\Local\Temp\4A58.tmp"69⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"C:\Users\Admin\AppData\Local\Temp\4AD5.tmp"70⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"71⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"72⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"73⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"74⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"75⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"76⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\4E21.tmp"C:\Users\Admin\AppData\Local\Temp\4E21.tmp"77⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"78⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\4EEC.tmp"C:\Users\Admin\AppData\Local\Temp\4EEC.tmp"79⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4F69.tmp"C:\Users\Admin\AppData\Local\Temp\4F69.tmp"80⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"81⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\5054.tmp"C:\Users\Admin\AppData\Local\Temp\5054.tmp"82⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\50E0.tmp"C:\Users\Admin\AppData\Local\Temp\50E0.tmp"83⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\515D.tmp"C:\Users\Admin\AppData\Local\Temp\515D.tmp"84⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\51EA.tmp"C:\Users\Admin\AppData\Local\Temp\51EA.tmp"85⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\5286.tmp"C:\Users\Admin\AppData\Local\Temp\5286.tmp"86⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\52F4.tmp"C:\Users\Admin\AppData\Local\Temp\52F4.tmp"87⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5361.tmp"C:\Users\Admin\AppData\Local\Temp\5361.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\53BF.tmp"C:\Users\Admin\AppData\Local\Temp\53BF.tmp"89⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\542C.tmp"C:\Users\Admin\AppData\Local\Temp\542C.tmp"90⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\5499.tmp"C:\Users\Admin\AppData\Local\Temp\5499.tmp"91⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\5516.tmp"C:\Users\Admin\AppData\Local\Temp\5516.tmp"92⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5593.tmp"C:\Users\Admin\AppData\Local\Temp\5593.tmp"93⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\5610.tmp"C:\Users\Admin\AppData\Local\Temp\5610.tmp"94⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\569D.tmp"C:\Users\Admin\AppData\Local\Temp\569D.tmp"95⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\570A.tmp"C:\Users\Admin\AppData\Local\Temp\570A.tmp"96⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5787.tmp"C:\Users\Admin\AppData\Local\Temp\5787.tmp"97⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\57F5.tmp"C:\Users\Admin\AppData\Local\Temp\57F5.tmp"98⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\5881.tmp"C:\Users\Admin\AppData\Local\Temp\5881.tmp"99⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\58DF.tmp"C:\Users\Admin\AppData\Local\Temp\58DF.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\596C.tmp"C:\Users\Admin\AppData\Local\Temp\596C.tmp"101⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\59E9.tmp"C:\Users\Admin\AppData\Local\Temp\59E9.tmp"102⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5A75.tmp"C:\Users\Admin\AppData\Local\Temp\5A75.tmp"103⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\5AF2.tmp"C:\Users\Admin\AppData\Local\Temp\5AF2.tmp"104⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5B60.tmp"C:\Users\Admin\AppData\Local\Temp\5B60.tmp"105⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"106⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"107⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"108⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5D25.tmp"C:\Users\Admin\AppData\Local\Temp\5D25.tmp"109⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"110⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"111⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\5EAC.tmp"C:\Users\Admin\AppData\Local\Temp\5EAC.tmp"112⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5F38.tmp"C:\Users\Admin\AppData\Local\Temp\5F38.tmp"113⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\5FD4.tmp"C:\Users\Admin\AppData\Local\Temp\5FD4.tmp"114⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6051.tmp"C:\Users\Admin\AppData\Local\Temp\6051.tmp"115⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\60DE.tmp"C:\Users\Admin\AppData\Local\Temp\60DE.tmp"116⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\615B.tmp"C:\Users\Admin\AppData\Local\Temp\615B.tmp"117⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\61F7.tmp"C:\Users\Admin\AppData\Local\Temp\61F7.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6294.tmp"C:\Users\Admin\AppData\Local\Temp\6294.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\6301.tmp"C:\Users\Admin\AppData\Local\Temp\6301.tmp"120⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\637E.tmp"C:\Users\Admin\AppData\Local\Temp\637E.tmp"121⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\63FB.tmp"C:\Users\Admin\AppData\Local\Temp\63FB.tmp"122⤵PID:476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-