Analysis
- max time kernel
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_f923e8aa230b1172278f6c7ef3ed54a8_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_f923e8aa230b1172278f6c7ef3ed54a8_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_f923e8aa230b1172278f6c7ef3ed54a8_elex_mafia.exe
- Size 520KB
- Sample260712-mt19bsas6x
- SHA256 68f235ccc9325da42eb2db14ed77b09c11e0e394f5675e6e2eb18ff6fafa9d29
- MD5 f923e8aa230b1172278f6c7ef3ed54a8
- SHA1 a0f84bfe55382ce8fedab372a486f8f502e99a62
- SHA512 3bf4f022f97393c142e75d5fe64556e3df5d97b6e254ffc1e9d7a03daba48f925de7ba7971cfba6dbe9559998bdebf76001f9eb8e8d4e37f44ae996a7906c460
- SSDEEP 12288:gj8fuxR21t5i8fOtXc+6pQdKnurx3wxt4MGNZ6:gj8fuK1GYgb6ggut3BNI
- TLSH T161B4F1027589C432E8D611310F66DBA10BBE7D359B2695C73BC03A7EAEF56C1963831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4312 A493.tmp 240 A57D.tmp 4860 A629.tmp 980 A6E5.tmp 940 A781.tmp 3712 A85C.tmp 4172 A908.tmp 5984 A975.tmp 2940 AA11.tmp 1260 AA8E.tmp 4256 AB3A.tmp 4828 ABB7.tmp 2640 AC34.tmp 3192 ACD0.tmp 2760 AD9B.tmp 5236 AE28.tmp 4764 AEA5.tmp 4468 AF22.tmp 260 AFCE.tmp 5048 B06A.tmp 2728 B106.tmp 1908 B1C2.tmp 4968 B26E.tmp 5436 B30A.tmp 5364 B397.tmp 2928 B452.tmp 4496 B50E.tmp 1096 B5C9.tmp 4472 B685.tmp 5704 B731.tmp 1540 B7BD.tmp 4228 B8A8.tmp 4516 B973.tmp 784 B9E0.tmp 4264 BA4D.tmp 2608 BAEA.tmp 3184 BB67.tmp 2280 BBF3.tmp 2372 BC70.tmp 2476 BCED.tmp 3676 BD6A.tmp 4680 BE07.tmp 2576 BE84.tmp 1380 BF01.tmp 3196 BF7E.tmp 1204 BFEB.tmp 5968 C068.tmp 3380 C0F5.tmp 6088 C172.tmp 4796 C1EF.tmp 3348 C27B.tmp 5092 C317.tmp 5844 C3A4.tmp 4664 C431.tmp 200 C4AE.tmp 5764 C52B.tmp 4740 C5D7.tmp 1712 C654.tmp 5832 C6E0.tmp 5308 C78C.tmp 3016 C828.tmp 1860 C8C5.tmp 3872 C970.tmp 5200 C9ED.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 598B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5475.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 222F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3941.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E08E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C78C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABB7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 4312 4920 2026-07-12_f923e8aa230b1172278f6c7ef3ed54a8_elex_mafia.exe 86 PID 4312 wrote to memory of 240 4312 A493.tmp 87 PID 240 wrote to memory of 4860 240 A57D.tmp 88 PID 4860 wrote to memory of 980 4860 A629.tmp 89 PID 980 wrote to memory of 940 980 A6E5.tmp 90 PID 940 wrote to memory of 3712 940 A781.tmp 91 PID 3712 wrote to memory of 4172 3712 A85C.tmp 92 PID 4172 wrote to memory of 5984 4172 A908.tmp 93 PID 5984 wrote to memory of 2940 5984 A975.tmp 94 PID 2940 wrote to memory of 1260 2940 AA11.tmp 95 PID 1260 wrote to memory of 4256 1260 AA8E.tmp 96 PID 4256 wrote to memory of 4828 4256 AB3A.tmp 97 PID 4828 wrote to memory of 2640 4828 ABB7.tmp 98 PID 2640 wrote to memory of 3192 2640 AC34.tmp 99 PID 3192 wrote to memory of 2760 3192 ACD0.tmp 100 PID 2760 wrote to memory of 5236 2760 AD9B.tmp 101 PID 5236 wrote to memory of 4764 5236 AE28.tmp 102 PID 4764 wrote to memory of 4468 4764 AEA5.tmp 103 PID 4468 wrote to memory of 260 4468 AF22.tmp 104 PID 260 wrote to memory of 5048 260 AFCE.tmp 105 PID 5048 wrote to memory of 2728 5048 B06A.tmp 106 PID 2728 wrote to memory of 1908 2728 B106.tmp 107 PID 1908 wrote to memory of 4968 1908 B1C2.tmp 108 PID 4968 wrote to memory of 5436 4968 B26E.tmp 109 PID 5436 wrote to memory of 5364 5436 B30A.tmp 110 PID 5364 wrote to memory of 2928 5364 B397.tmp 111 PID 2928 wrote to memory of 4496 2928 B452.tmp 112 PID 4496 wrote to memory of 1096 4496 B50E.tmp 113 PID 1096 wrote to memory of 4472 1096 B5C9.tmp 114 PID 4472 wrote to memory of 5704 4472 B685.tmp 115 PID 5704 wrote to memory of 1540 5704 B731.tmp 116 PID 1540 wrote to memory of 4228 1540 B7BD.tmp 117 PID 4228 wrote to memory of 4516 4228 B8A8.tmp 118 PID 4516 wrote to memory of 784 4516 B973.tmp 119 PID 784 wrote to memory of 4264 784 B9E0.tmp 120 PID 4264 wrote to memory of 2608 4264 BA4D.tmp 121 PID 2608 wrote to memory of 3184 2608 BAEA.tmp 122 PID 3184 wrote to memory of 2280 3184 BB67.tmp 123 PID 2280 wrote to memory of 2372 2280 BBF3.tmp 124 PID 2372 wrote to memory of 2476 2372 BC70.tmp 125 PID 2476 wrote to memory of 3676 2476 BCED.tmp 126 PID 3676 wrote to memory of 4680 3676 BD6A.tmp 127 PID 4680 wrote to memory of 2576 4680 BE07.tmp 128 PID 2576 wrote to memory of 1380 2576 BE84.tmp 129 PID 1380 wrote to memory of 3196 1380 BF01.tmp 130 PID 3196 wrote to memory of 1204 3196 BF7E.tmp 131 PID 1204 wrote to memory of 5968 1204 BFEB.tmp 132 PID 5968 wrote to memory of 3380 5968 C068.tmp 133 PID 3380 wrote to memory of 6088 3380 C0F5.tmp 134 PID 6088 wrote to memory of 4796 6088 C172.tmp 135 PID 4796 wrote to memory of 3348 4796 C1EF.tmp 136 PID 3348 wrote to memory of 5092 3348 C27B.tmp 137 PID 5092 wrote to memory of 5844 5092 C317.tmp 138 PID 5844 wrote to memory of 4664 5844 C3A4.tmp 139 PID 4664 wrote to memory of 200 4664 C431.tmp 140 PID 200 wrote to memory of 5764 200 C4AE.tmp 141 PID 5764 wrote to memory of 4740 5764 C52B.tmp 142 PID 4740 wrote to memory of 1712 4740 C5D7.tmp 143 PID 1712 wrote to memory of 5832 1712 C654.tmp 144 PID 5832 wrote to memory of 5308 5832 C6E0.tmp 145 PID 5308 wrote to memory of 3016 5308 C78C.tmp 146 PID 3016 wrote to memory of 1860 3016 C828.tmp 147 PID 1860 wrote to memory of 3872 1860 C8C5.tmp 148 PID 3872 wrote to memory of 5200 3872 C970.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_f923e8aa230b1172278f6c7ef3ed54a8_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_f923e8aa230b1172278f6c7ef3ed54a8_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\A493.tmp"C:\Users\Admin\AppData\Local\Temp\A493.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A57D.tmp"C:\Users\Admin\AppData\Local\Temp\A57D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\A629.tmp"C:\Users\Admin\AppData\Local\Temp\A629.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\A781.tmp"C:\Users\Admin\AppData\Local\Temp\A781.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\A908.tmp"C:\Users\Admin\AppData\Local\Temp\A908.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\A975.tmp"C:\Users\Admin\AppData\Local\Temp\A975.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\AA11.tmp"C:\Users\Admin\AppData\Local\Temp\AA11.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"C:\Users\Admin\AppData\Local\Temp\ABB7.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"C:\Users\Admin\AppData\Local\Temp\AD9B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\B397.tmp"C:\Users\Admin\AppData\Local\Temp\B397.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\B50E.tmp"C:\Users\Admin\AppData\Local\Temp\B50E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\B731.tmp"C:\Users\Admin\AppData\Local\Temp\B731.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\B973.tmp"C:\Users\Admin\AppData\Local\Temp\B973.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"C:\Users\Admin\AppData\Local\Temp\BF7E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"C:\Users\Admin\AppData\Local\Temp\C1EF.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\C317.tmp"C:\Users\Admin\AppData\Local\Temp\C317.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"C:\Users\Admin\AppData\Local\Temp\C3A4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\C431.tmp"C:\Users\Admin\AppData\Local\Temp\C431.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\C4AE.tmp"C:\Users\Admin\AppData\Local\Temp\C4AE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\C52B.tmp"C:\Users\Admin\AppData\Local\Temp\C52B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\C654.tmp"C:\Users\Admin\AppData\Local\Temp\C654.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\C970.tmp"C:\Users\Admin\AppData\Local\Temp\C970.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"C:\Users\Admin\AppData\Local\Temp\C9ED.tmp"65⤵
- Executes dropped EXE
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"C:\Users\Admin\AppData\Local\Temp\CA6A.tmp"66⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"C:\Users\Admin\AppData\Local\Temp\CAC8.tmp"67⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"68⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"69⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"70⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"71⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"72⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\CE14.tmp"C:\Users\Admin\AppData\Local\Temp\CE14.tmp"73⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"74⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"75⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"76⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:464 -
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"78⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"79⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"81⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"82⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"83⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"C:\Users\Admin\AppData\Local\Temp\D3E0.tmp"84⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"85⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"86⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\D557.tmp"C:\Users\Admin\AppData\Local\Temp\D557.tmp"87⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"88⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"89⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"90⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"91⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\D816.tmp"C:\Users\Admin\AppData\Local\Temp\D816.tmp"92⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"93⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"94⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"95⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"96⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"97⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\DB72.tmp"C:\Users\Admin\AppData\Local\Temp\DB72.tmp"98⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"99⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"100⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"101⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\DD75.tmp"C:\Users\Admin\AppData\Local\Temp\DD75.tmp"102⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"103⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"104⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"105⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"106⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\E006.tmp"C:\Users\Admin\AppData\Local\Temp\E006.tmp"107⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\E083.tmp"C:\Users\Admin\AppData\Local\Temp\E083.tmp"108⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"109⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"110⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"111⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"112⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"113⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"114⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"115⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"116⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"117⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"118⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"119⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"120⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"121⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"122⤵PID:4244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-