Analysis
- max time kernel
131s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_a3960e54beb9e4538da8536e8e75341b_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_a3960e54beb9e4538da8536e8e75341b_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-12_a3960e54beb9e4538da8536e8e75341b_elex_mafia.exe
- Size 524KB
- Sample260712-txc48se15s
- SHA256 94362d44f151d96cb3d80137891387a3e23863aa62a461da161a0b3b856709aa
- MD5 a3960e54beb9e4538da8536e8e75341b
- SHA1 7c35a6f5c564e994c6a19dff8a4524a95c6611c3
- SHA512 575bc08bb82a1f579d405cfb1d4e501c300deabb460379268e3b7cf43f0f1339ddac4c5e1e33ac8cb3ef8ed1bfdd6d713da5f96dd239d3779b8de0b0e0586741
- SSDEEP 12288:TRyZzqyL66TMo/GxI8jg7ZZpdRUIVDuNZ:TRyQylTTGx5QZfbuN
- TLSH T17BB4F112B648C032E68201758F26EBA2597A7D71A72765C77B8436AE6FF03D1E374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1028 A6D5.tmp 6024 A762.tmp 5456 A8B9.tmp 1528 AA40.tmp 2092 AB0B.tmp 1092 AC05.tmp 3040 AC82.tmp 5444 ADBB.tmp 3436 AEA5.tmp 4716 AF80.tmp 756 B089.tmp 4844 B1B2.tmp 1848 B2AC.tmp 2276 B387.tmp 552 B4B0.tmp 1120 B5BA.tmp 6028 B6A4.tmp 4280 B7AE.tmp 5000 B898.tmp 6080 B963.tmp 4804 BA7C.tmp 3820 BB67.tmp 4504 BC22.tmp 5988 BD1C.tmp 1036 BE55.tmp 2864 BF6E.tmp 3832 C087.tmp 4236 C1A0.tmp 2576 C2D9.tmp 3076 C3C3.tmp 4528 C49E.tmp 4596 C5B7.tmp 484 C6F0.tmp 2980 C79C.tmp 3276 C857.tmp 2240 C903.tmp 3116 C99F.tmp 5228 CA3C.tmp 1340 CB07.tmp 3548 CB93.tmp 3000 CC30.tmp 3060 CCEB.tmp 2900 CDD5.tmp 5300 CEB0.tmp 1816 CF6C.tmp 5472 D037.tmp 4260 D0A4.tmp 3696 D16F.tmp 2444 D1EC.tmp 2428 D269.tmp 2500 D2F6.tmp 5256 D373.tmp 4592 D400.tmp 3312 D48C.tmp 2388 D509.tmp 1968 D586.tmp 5820 D613.tmp 1720 D690.tmp 3136 D72C.tmp 2404 D799.tmp 2580 D826.tmp 4400 D8A3.tmp 1032 D920.tmp 2008 D9AD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1578.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3535.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 587D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 439D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 592D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 762B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E89C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 221B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 690C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 777E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 1028 3948 2026-07-12_a3960e54beb9e4538da8536e8e75341b_elex_mafia.exe 86 PID 1028 wrote to memory of 6024 1028 A6D5.tmp 87 PID 6024 wrote to memory of 5456 6024 A762.tmp 88 PID 5456 wrote to memory of 1528 5456 A8B9.tmp 89 PID 1528 wrote to memory of 2092 1528 AA40.tmp 90 PID 2092 wrote to memory of 1092 2092 AB0B.tmp 91 PID 1092 wrote to memory of 3040 1092 AC05.tmp 92 PID 3040 wrote to memory of 5444 3040 AC82.tmp 93 PID 5444 wrote to memory of 3436 5444 ADBB.tmp 94 PID 3436 wrote to memory of 4716 3436 AEA5.tmp 95 PID 4716 wrote to memory of 756 4716 AF80.tmp 96 PID 756 wrote to memory of 4844 756 B089.tmp 97 PID 4844 wrote to memory of 1848 4844 B1B2.tmp 98 PID 1848 wrote to memory of 2276 1848 B2AC.tmp 99 PID 2276 wrote to memory of 552 2276 B387.tmp 100 PID 552 wrote to memory of 1120 552 B4B0.tmp 101 PID 1120 wrote to memory of 6028 1120 B5BA.tmp 102 PID 6028 wrote to memory of 4280 6028 B6A4.tmp 103 PID 4280 wrote to memory of 5000 4280 B7AE.tmp 104 PID 5000 wrote to memory of 6080 5000 B898.tmp 105 PID 6080 wrote to memory of 4804 6080 B963.tmp 106 PID 4804 wrote to memory of 3820 4804 BA7C.tmp 107 PID 3820 wrote to memory of 4504 3820 BB67.tmp 108 PID 4504 wrote to memory of 5988 4504 BC22.tmp 109 PID 5988 wrote to memory of 1036 5988 BD1C.tmp 110 PID 1036 wrote to memory of 2864 1036 BE55.tmp 111 PID 2864 wrote to memory of 3832 2864 BF6E.tmp 112 PID 3832 wrote to memory of 4236 3832 C087.tmp 113 PID 4236 wrote to memory of 2576 4236 C1A0.tmp 114 PID 2576 wrote to memory of 3076 2576 C2D9.tmp 115 PID 3076 wrote to memory of 4528 3076 C3C3.tmp 116 PID 4528 wrote to memory of 4596 4528 C49E.tmp 117 PID 4596 wrote to memory of 484 4596 C5B7.tmp 118 PID 484 wrote to memory of 2980 484 C6F0.tmp 119 PID 2980 wrote to memory of 3276 2980 C79C.tmp 120 PID 3276 wrote to memory of 2240 3276 C857.tmp 121 PID 2240 wrote to memory of 3116 2240 C903.tmp 122 PID 3116 wrote to memory of 5228 3116 C99F.tmp 123 PID 5228 wrote to memory of 1340 5228 CA3C.tmp 124 PID 1340 wrote to memory of 3548 1340 CB07.tmp 125 PID 3548 wrote to memory of 3000 3548 CB93.tmp 126 PID 3000 wrote to memory of 3060 3000 CC30.tmp 127 PID 3060 wrote to memory of 2900 3060 CCEB.tmp 128 PID 2900 wrote to memory of 5300 2900 CDD5.tmp 129 PID 5300 wrote to memory of 1816 5300 CEB0.tmp 130 PID 1816 wrote to memory of 5472 1816 CF6C.tmp 131 PID 5472 wrote to memory of 4260 5472 D037.tmp 132 PID 4260 wrote to memory of 3696 4260 D0A4.tmp 133 PID 3696 wrote to memory of 2444 3696 D16F.tmp 134 PID 2444 wrote to memory of 2428 2444 D1EC.tmp 135 PID 2428 wrote to memory of 2500 2428 D269.tmp 136 PID 2500 wrote to memory of 5256 2500 D2F6.tmp 137 PID 5256 wrote to memory of 4592 5256 D373.tmp 138 PID 4592 wrote to memory of 3312 4592 D400.tmp 139 PID 3312 wrote to memory of 2388 3312 D48C.tmp 140 PID 2388 wrote to memory of 1968 2388 D509.tmp 141 PID 1968 wrote to memory of 5820 1968 D586.tmp 142 PID 5820 wrote to memory of 1720 5820 D613.tmp 143 PID 1720 wrote to memory of 3136 1720 D690.tmp 144 PID 3136 wrote to memory of 2404 3136 D72C.tmp 145 PID 2404 wrote to memory of 2580 2404 D799.tmp 146 PID 2580 wrote to memory of 4400 2580 D826.tmp 147 PID 4400 wrote to memory of 1032 4400 D8A3.tmp 148 PID 1032 wrote to memory of 2008 1032 D920.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_a3960e54beb9e4538da8536e8e75341b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_a3960e54beb9e4538da8536e8e75341b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"C:\Users\Admin\AppData\Local\Temp\A6D5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A762.tmp"C:\Users\Admin\AppData\Local\Temp\A762.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"C:\Users\Admin\AppData\Local\Temp\A8B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\AA40.tmp"C:\Users\Admin\AppData\Local\Temp\AA40.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"C:\Users\Admin\AppData\Local\Temp\AB0B.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"C:\Users\Admin\AppData\Local\Temp\ADBB.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\BB67.tmp"C:\Users\Admin\AppData\Local\Temp\BB67.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\BC22.tmp"C:\Users\Admin\AppData\Local\Temp\BC22.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\BE55.tmp"C:\Users\Admin\AppData\Local\Temp\BE55.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"C:\Users\Admin\AppData\Local\Temp\C1A0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"C:\Users\Admin\AppData\Local\Temp\C2D9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"C:\Users\Admin\AppData\Local\Temp\C5B7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\C79C.tmp"C:\Users\Admin\AppData\Local\Temp\C79C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C857.tmp"C:\Users\Admin\AppData\Local\Temp\C857.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C903.tmp"C:\Users\Admin\AppData\Local\Temp\C903.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\CB07.tmp"C:\Users\Admin\AppData\Local\Temp\CB07.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"C:\Users\Admin\AppData\Local\Temp\CCEB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"C:\Users\Admin\AppData\Local\Temp\CEB0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"C:\Users\Admin\AppData\Local\Temp\CF6C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\D037.tmp"C:\Users\Admin\AppData\Local\Temp\D037.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"C:\Users\Admin\AppData\Local\Temp\D0A4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\D16F.tmp"C:\Users\Admin\AppData\Local\Temp\D16F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"C:\Users\Admin\AppData\Local\Temp\D2F6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\D373.tmp"C:\Users\Admin\AppData\Local\Temp\D373.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\D400.tmp"C:\Users\Admin\AppData\Local\Temp\D400.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\D48C.tmp"C:\Users\Admin\AppData\Local\Temp\D48C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\D509.tmp"C:\Users\Admin\AppData\Local\Temp\D509.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\D586.tmp"C:\Users\Admin\AppData\Local\Temp\D586.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\D690.tmp"C:\Users\Admin\AppData\Local\Temp\D690.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\D72C.tmp"C:\Users\Admin\AppData\Local\Temp\D72C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\D799.tmp"C:\Users\Admin\AppData\Local\Temp\D799.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"65⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"66⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"C:\Users\Admin\AppData\Local\Temp\DAC6.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"68⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"C:\Users\Admin\AppData\Local\Temp\DBD0.tmp"69⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"70⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"71⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\DD85.tmp"C:\Users\Admin\AppData\Local\Temp\DD85.tmp"72⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\DE12.tmp"C:\Users\Admin\AppData\Local\Temp\DE12.tmp"73⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"C:\Users\Admin\AppData\Local\Temp\DEAE.tmp"74⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"75⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"76⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"77⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"78⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"79⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"80⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"81⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"82⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"83⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\E47A.tmp"C:\Users\Admin\AppData\Local\Temp\E47A.tmp"84⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"85⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\E584.tmp"C:\Users\Admin\AppData\Local\Temp\E584.tmp"86⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\E620.tmp"C:\Users\Admin\AppData\Local\Temp\E620.tmp"87⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"88⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\E70B.tmp"C:\Users\Admin\AppData\Local\Temp\E70B.tmp"89⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"90⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"91⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"92⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"93⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"94⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\EA85.tmp"C:\Users\Admin\AppData\Local\Temp\EA85.tmp"95⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"96⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"97⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"99⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\ED44.tmp"C:\Users\Admin\AppData\Local\Temp\ED44.tmp"100⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"101⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"102⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\EECB.tmp"C:\Users\Admin\AppData\Local\Temp\EECB.tmp"103⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\EF48.tmp"C:\Users\Admin\AppData\Local\Temp\EF48.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"105⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\F061.tmp"C:\Users\Admin\AppData\Local\Temp\F061.tmp"106⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"107⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\F16B.tmp"C:\Users\Admin\AppData\Local\Temp\F16B.tmp"108⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\F274.tmp"C:\Users\Admin\AppData\Local\Temp\F274.tmp"110⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"111⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"112⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\F43A.tmp"C:\Users\Admin\AppData\Local\Temp\F43A.tmp"113⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\F562.tmp"C:\Users\Admin\AppData\Local\Temp\F562.tmp"115⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"116⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"117⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"118⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"C:\Users\Admin\AppData\Local\Temp\F7A5.tmp"119⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\F850.tmp"C:\Users\Admin\AppData\Local\Temp\F850.tmp"120⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"121⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-