Analysis
- max time kernel
139s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 14:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_126733c93d8f3eb9d128bc0acddc14c7_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_126733c93d8f3eb9d128bc0acddc14c7_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-12_126733c93d8f3eb9d128bc0acddc14c7_elex_mafia.exe
- Size 816KB
- Sample260812-r87rwadd52
- SHA256 0755c717051954ccea3e19048e3dc72a5dcdeda481af7889b7af8955941b0459
- MD5 126733c93d8f3eb9d128bc0acddc14c7
- SHA1 e50b67cbffffe74b5a7af94f4b269f67a7b29c6a
- SHA512 3bc2686911c56347decec0e15dad4e2277abb6552d6862f7630cebd459532ed8f746107de2ec9b9f6a9ade0484c13316c153f7c3cef4470c144eee05c2053f08
- SSDEEP 6144:2fzZD/P+lZs2rdEkyc54b8DsanxRl9DHDoA5WyoQfD77uhRf9a7DupfY7WpccHxq:+mF/W8Dsy3dd5LYR2DupfY7XcRkh3Z
- TLSH T1F305F116B648C033E29211344EAAEB62497A7C61572768C7BBD4367E2FB03D1DB71347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1168 75D2.tmp 5172 769D.tmp 2360 77E5.tmp 5160 7891.tmp 4252 797C.tmp 264 7A08.tmp 1968 7AC4.tmp 4612 7B9F.tmp 420 7C6A.tmp 5976 7D93.tmp 6024 7E8D.tmp 2680 7F87.tmp 2872 8042.tmp 4172 815B.tmp 2172 8217.tmp 5508 8330.tmp 4408 83EC.tmp 5824 84C6.tmp 5680 85D0.tmp 5052 86F9.tmp 2844 87C4.tmp 5932 889F.tmp 5652 8979.tmp 3864 8A35.tmp 1480 8B00.tmp 364 8BEA.tmp 3172 8C96.tmp 5376 8D61.tmp 1904 8E2D.tmp 1888 8F27.tmp 4228 9021.tmp 568 90FB.tmp 2720 91B7.tmp 5656 9243.tmp 3012 92D0.tmp 5240 934D.tmp 3220 93BA.tmp 4504 9457.tmp 6116 94D4.tmp 5104 9570.tmp 4232 95FD.tmp 3368 967A.tmp 1184 9706.tmp 5896 9793.tmp 1548 982F.tmp 1976 98AC.tmp 2008 9939.tmp 2392 99E5.tmp 4840 9A81.tmp 668 9B1D.tmp 4888 9BB9.tmp 2612 9C46.tmp 3540 9CD3.tmp 5324 9D50.tmp 3260 9DEC.tmp 2228 9E59.tmp 4852 9EE6.tmp 5032 9F72.tmp 3992 9FFF.tmp 6132 A07C.tmp 4384 A0F9.tmp 3868 A203.tmp 5528 A29F.tmp 1916 A35A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 436E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 580F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2130.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5010.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 750D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D998.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 393D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 702B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2036.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D32.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 1168 2804 2026-08-12_126733c93d8f3eb9d128bc0acddc14c7_elex_mafia.exe 89 PID 1168 wrote to memory of 5172 1168 75D2.tmp 90 PID 5172 wrote to memory of 2360 5172 769D.tmp 91 PID 2360 wrote to memory of 5160 2360 77E5.tmp 92 PID 5160 wrote to memory of 4252 5160 7891.tmp 93 PID 4252 wrote to memory of 264 4252 797C.tmp 94 PID 264 wrote to memory of 1968 264 7A08.tmp 95 PID 1968 wrote to memory of 4612 1968 7AC4.tmp 96 PID 4612 wrote to memory of 420 4612 7B9F.tmp 97 PID 420 wrote to memory of 5976 420 7C6A.tmp 98 PID 5976 wrote to memory of 6024 5976 7D93.tmp 99 PID 6024 wrote to memory of 2680 6024 7E8D.tmp 100 PID 2680 wrote to memory of 2872 2680 7F87.tmp 101 PID 2872 wrote to memory of 4172 2872 8042.tmp 102 PID 4172 wrote to memory of 2172 4172 815B.tmp 103 PID 2172 wrote to memory of 5508 2172 8217.tmp 104 PID 5508 wrote to memory of 4408 5508 8330.tmp 105 PID 4408 wrote to memory of 5824 4408 83EC.tmp 106 PID 5824 wrote to memory of 5680 5824 84C6.tmp 107 PID 5680 wrote to memory of 5052 5680 85D0.tmp 108 PID 5052 wrote to memory of 2844 5052 86F9.tmp 109 PID 2844 wrote to memory of 5932 2844 87C4.tmp 110 PID 5932 wrote to memory of 5652 5932 889F.tmp 111 PID 5652 wrote to memory of 3864 5652 8979.tmp 112 PID 3864 wrote to memory of 1480 3864 8A35.tmp 113 PID 1480 wrote to memory of 364 1480 8B00.tmp 114 PID 364 wrote to memory of 3172 364 8BEA.tmp 115 PID 3172 wrote to memory of 5376 3172 8C96.tmp 116 PID 5376 wrote to memory of 1904 5376 8D61.tmp 117 PID 1904 wrote to memory of 1888 1904 8E2D.tmp 118 PID 1888 wrote to memory of 4228 1888 8F27.tmp 119 PID 4228 wrote to memory of 568 4228 9021.tmp 120 PID 568 wrote to memory of 2720 568 90FB.tmp 121 PID 2720 wrote to memory of 5656 2720 91B7.tmp 122 PID 5656 wrote to memory of 3012 5656 9243.tmp 123 PID 3012 wrote to memory of 5240 3012 92D0.tmp 124 PID 5240 wrote to memory of 3220 5240 934D.tmp 125 PID 3220 wrote to memory of 4504 3220 93BA.tmp 126 PID 4504 wrote to memory of 6116 4504 9457.tmp 127 PID 6116 wrote to memory of 5104 6116 94D4.tmp 128 PID 5104 wrote to memory of 4232 5104 9570.tmp 129 PID 4232 wrote to memory of 3368 4232 95FD.tmp 130 PID 3368 wrote to memory of 1184 3368 967A.tmp 131 PID 1184 wrote to memory of 5896 1184 9706.tmp 132 PID 5896 wrote to memory of 1548 5896 9793.tmp 133 PID 1548 wrote to memory of 1976 1548 982F.tmp 134 PID 1976 wrote to memory of 2008 1976 98AC.tmp 135 PID 2008 wrote to memory of 2392 2008 9939.tmp 136 PID 2392 wrote to memory of 4840 2392 99E5.tmp 137 PID 4840 wrote to memory of 668 4840 9A81.tmp 138 PID 668 wrote to memory of 4888 668 9B1D.tmp 139 PID 4888 wrote to memory of 2612 4888 9BB9.tmp 140 PID 2612 wrote to memory of 3540 2612 9C46.tmp 141 PID 3540 wrote to memory of 5324 3540 9CD3.tmp 142 PID 5324 wrote to memory of 3260 5324 9D50.tmp 143 PID 3260 wrote to memory of 2228 3260 9DEC.tmp 144 PID 2228 wrote to memory of 4852 2228 9E59.tmp 145 PID 4852 wrote to memory of 5032 4852 9EE6.tmp 146 PID 5032 wrote to memory of 3992 5032 9F72.tmp 147 PID 3992 wrote to memory of 6132 3992 9FFF.tmp 148 PID 6132 wrote to memory of 4384 6132 A07C.tmp 149 PID 5520 wrote to memory of 3868 5520 A186.tmp 151 PID 3868 wrote to memory of 5528 3868 A203.tmp 152 PID 5528 wrote to memory of 1916 5528 A29F.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_126733c93d8f3eb9d128bc0acddc14c7_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_126733c93d8f3eb9d128bc0acddc14c7_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\769D.tmp"C:\Users\Admin\AppData\Local\Temp\769D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\7891.tmp"C:\Users\Admin\AppData\Local\Temp\7891.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7A08.tmp"C:\Users\Admin\AppData\Local\Temp\7A08.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\815B.tmp"C:\Users\Admin\AppData\Local\Temp\815B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8330.tmp"C:\Users\Admin\AppData\Local\Temp\8330.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\84C6.tmp"C:\Users\Admin\AppData\Local\Temp\84C6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\8979.tmp"C:\Users\Admin\AppData\Local\Temp\8979.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\8A35.tmp"C:\Users\Admin\AppData\Local\Temp\8A35.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\9021.tmp"C:\Users\Admin\AppData\Local\Temp\9021.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9243.tmp"C:\Users\Admin\AppData\Local\Temp\9243.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\92D0.tmp"C:\Users\Admin\AppData\Local\Temp\92D0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\9570.tmp"C:\Users\Admin\AppData\Local\Temp\9570.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\95FD.tmp"C:\Users\Admin\AppData\Local\Temp\95FD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\982F.tmp"C:\Users\Admin\AppData\Local\Temp\982F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\99E5.tmp"C:\Users\Admin\AppData\Local\Temp\99E5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"C:\Users\Admin\AppData\Local\Temp\9CD3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\9F72.tmp"C:\Users\Admin\AppData\Local\Temp\9F72.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\A07C.tmp"C:\Users\Admin\AppData\Local\Temp\A07C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"C:\Users\Admin\AppData\Local\Temp\A0F9.tmp"62⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\A186.tmp"C:\Users\Admin\AppData\Local\Temp\A186.tmp"63⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\A203.tmp"C:\Users\Admin\AppData\Local\Temp\A203.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\A35A.tmp"C:\Users\Admin\AppData\Local\Temp\A35A.tmp"66⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"67⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"68⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\A54E.tmp"C:\Users\Admin\AppData\Local\Temp\A54E.tmp"69⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"71⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"72⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\A771.tmp"C:\Users\Admin\AppData\Local\Temp\A771.tmp"73⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"74⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"75⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\A917.tmp"C:\Users\Admin\AppData\Local\Temp\A917.tmp"76⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"77⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"78⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"79⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\AB98.tmp"C:\Users\Admin\AppData\Local\Temp\AB98.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"81⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"82⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"83⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"C:\Users\Admin\AppData\Local\Temp\ADCA.tmp"84⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\AE76.tmp"C:\Users\Admin\AppData\Local\Temp\AE76.tmp"85⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"86⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"87⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"88⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\B089.tmp"C:\Users\Admin\AppData\Local\Temp\B089.tmp"89⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"90⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\B183.tmp"C:\Users\Admin\AppData\Local\Temp\B183.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\B200.tmp"C:\Users\Admin\AppData\Local\Temp\B200.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"93⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\B31A.tmp"C:\Users\Admin\AppData\Local\Temp\B31A.tmp"94⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"95⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\B443.tmp"C:\Users\Admin\AppData\Local\Temp\B443.tmp"96⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"97⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"98⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"99⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"100⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B77F.tmp"C:\Users\Admin\AppData\Local\Temp\B77F.tmp"102⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"103⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\B888.tmp"C:\Users\Admin\AppData\Local\Temp\B888.tmp"104⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B915.tmp"C:\Users\Admin\AppData\Local\Temp\B915.tmp"105⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"106⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"C:\Users\Admin\AppData\Local\Temp\BA6D.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"108⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\BB86.tmp"C:\Users\Admin\AppData\Local\Temp\BB86.tmp"109⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"110⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"111⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"112⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\BE16.tmp"C:\Users\Admin\AppData\Local\Temp\BE16.tmp"113⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"114⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"115⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"116⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"117⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"118⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"120⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"121⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-