Analysis
- max time kernel
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_d9452a8765acab56fedfe7ec791a53f5_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_d9452a8765acab56fedfe7ec791a53f5_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-09-07_d9452a8765acab56fedfe7ec791a53f5_elex_mafia.exe
- Size 560KB
- Sample260908-e2z28szyc1
- SHA256 5e722820253ff504bf770566bb0847cc35ea66dd80fa783f69a4764e857b66a0
- MD5 d9452a8765acab56fedfe7ec791a53f5
- SHA1 42b3c3d8171ff8843347c70aa761f14f3439ee72
- SHA512 85db4671845649e2cca9783356ccb2b9eb258e1b8fae67dfe1b8170f6025a6653628484d4bb2748dfcf25b999175e61d60aca1af78026f14ebfc0ef9709de526
- SSDEEP 12288:MlFXOQUDmrC8Sj6j04uyCgAuWkXoIZxV:MlUQbC8SjKuOXoIR
- TLSH T13CC4F1123648C073E1D201350A12DB626B7F7C769B2AA5C73B94266DAFB53D1EB3434B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4884 41CD.tmp 4224 42E6.tmp 1472 445D.tmp 1492 4596.tmp 5924 46DE.tmp 3148 4799.tmp 2072 4826.tmp 4180 4893.tmp 1140 4A39.tmp 1188 4B33.tmp 5776 4C5C.tmp 3336 4D66.tmp 3836 4EBD.tmp 4392 5025.tmp 1788 510F.tmp 2840 5248.tmp 4044 5361.tmp 1072 5499.tmp 1740 55D2.tmp 4992 56CC.tmp 1284 57C6.tmp 2936 58D0.tmp 5632 59D9.tmp 4924 5B41.tmp 2488 5C0C.tmp 5028 5D06.tmp 5040 5E00.tmp 2084 5F19.tmp 6068 5FF4.tmp 6132 610D.tmp 2180 61F7.tmp 5840 6320.tmp 4552 642A.tmp 4560 6505.tmp 2872 6591.tmp 5888 664D.tmp 3980 6708.tmp 3804 67E3.tmp 3140 68ED.tmp 5396 69B8.tmp 3256 6A64.tmp 4000 6F07.tmp 1668 6FE2.tmp 2720 70DC.tmp 1016 7197.tmp 3480 7262.tmp 4864 731E.tmp 4540 73E9.tmp 4508 7476.tmp 4460 759F.tmp 1264 763B.tmp 4428 76D7.tmp 256 7764.tmp 252 77E1.tmp 1712 785E.tmp 1064 78DB.tmp 5652 7958.tmp 2796 79D5.tmp 5220 7A71.tmp 5228 7AFE.tmp 4632 7B8A.tmp 4912 7C36.tmp 1080 7CC3.tmp 936 7D4F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2794.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 215B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C97B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 510F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B20B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A535.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F75D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D771.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4884 4568 2026-09-07_d9452a8765acab56fedfe7ec791a53f5_elex_mafia.exe 89 PID 4884 wrote to memory of 4224 4884 41CD.tmp 90 PID 4224 wrote to memory of 1472 4224 42E6.tmp 91 PID 1472 wrote to memory of 1492 1472 445D.tmp 92 PID 1492 wrote to memory of 5924 1492 4596.tmp 93 PID 5924 wrote to memory of 3148 5924 46DE.tmp 94 PID 3148 wrote to memory of 2072 3148 4799.tmp 95 PID 2072 wrote to memory of 4180 2072 4826.tmp 96 PID 4180 wrote to memory of 1140 4180 4893.tmp 97 PID 1140 wrote to memory of 1188 1140 4A39.tmp 98 PID 1188 wrote to memory of 5776 1188 4B33.tmp 99 PID 5776 wrote to memory of 3336 5776 4C5C.tmp 100 PID 3336 wrote to memory of 3836 3336 4D66.tmp 101 PID 3836 wrote to memory of 4392 3836 4EBD.tmp 102 PID 4392 wrote to memory of 1788 4392 5025.tmp 103 PID 1788 wrote to memory of 2840 1788 510F.tmp 104 PID 2840 wrote to memory of 4044 2840 5248.tmp 105 PID 4044 wrote to memory of 1072 4044 5361.tmp 106 PID 1072 wrote to memory of 1740 1072 5499.tmp 107 PID 1740 wrote to memory of 4992 1740 55D2.tmp 108 PID 4992 wrote to memory of 1284 4992 56CC.tmp 109 PID 1284 wrote to memory of 2936 1284 57C6.tmp 110 PID 2936 wrote to memory of 5632 2936 58D0.tmp 111 PID 5632 wrote to memory of 4924 5632 59D9.tmp 112 PID 4924 wrote to memory of 2488 4924 5B41.tmp 113 PID 2488 wrote to memory of 5028 2488 5C0C.tmp 114 PID 5028 wrote to memory of 5040 5028 5D06.tmp 115 PID 5040 wrote to memory of 2084 5040 5E00.tmp 116 PID 2084 wrote to memory of 6068 2084 5F19.tmp 117 PID 6068 wrote to memory of 6132 6068 5FF4.tmp 118 PID 6132 wrote to memory of 2180 6132 610D.tmp 119 PID 2180 wrote to memory of 5840 2180 61F7.tmp 120 PID 5840 wrote to memory of 4552 5840 6320.tmp 121 PID 4552 wrote to memory of 4560 4552 642A.tmp 122 PID 4560 wrote to memory of 2872 4560 6505.tmp 123 PID 2872 wrote to memory of 5888 2872 6591.tmp 124 PID 5888 wrote to memory of 3980 5888 664D.tmp 125 PID 3980 wrote to memory of 3804 3980 6708.tmp 126 PID 3804 wrote to memory of 3140 3804 67E3.tmp 127 PID 3140 wrote to memory of 5396 3140 68ED.tmp 128 PID 5396 wrote to memory of 3256 5396 69B8.tmp 129 PID 3256 wrote to memory of 4000 3256 6A64.tmp 130 PID 4000 wrote to memory of 1668 4000 6F07.tmp 131 PID 1668 wrote to memory of 2720 1668 6FE2.tmp 132 PID 2720 wrote to memory of 1016 2720 70DC.tmp 133 PID 1016 wrote to memory of 3480 1016 7197.tmp 134 PID 3480 wrote to memory of 4864 3480 7262.tmp 135 PID 4864 wrote to memory of 4540 4864 731E.tmp 136 PID 4540 wrote to memory of 4508 4540 73E9.tmp 137 PID 5460 wrote to memory of 4460 5460 7502.tmp 139 PID 4460 wrote to memory of 1264 4460 759F.tmp 140 PID 1264 wrote to memory of 4428 1264 763B.tmp 141 PID 4428 wrote to memory of 256 4428 76D7.tmp 142 PID 256 wrote to memory of 252 256 7764.tmp 143 PID 252 wrote to memory of 1712 252 77E1.tmp 144 PID 1712 wrote to memory of 1064 1712 785E.tmp 145 PID 1064 wrote to memory of 5652 1064 78DB.tmp 146 PID 5652 wrote to memory of 2796 5652 7958.tmp 147 PID 2796 wrote to memory of 5220 2796 79D5.tmp 148 PID 5220 wrote to memory of 5228 5220 7A71.tmp 149 PID 5228 wrote to memory of 4632 5228 7AFE.tmp 150 PID 4632 wrote to memory of 4912 4632 7B8A.tmp 151 PID 4912 wrote to memory of 1080 4912 7C36.tmp 152 PID 1080 wrote to memory of 936 1080 7CC3.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_d9452a8765acab56fedfe7ec791a53f5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d9452a8765acab56fedfe7ec791a53f5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\41CD.tmp"C:\Users\Admin\AppData\Local\Temp\41CD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\445D.tmp"C:\Users\Admin\AppData\Local\Temp\445D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\4596.tmp"C:\Users\Admin\AppData\Local\Temp\4596.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\46DE.tmp"C:\Users\Admin\AppData\Local\Temp\46DE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\4799.tmp"C:\Users\Admin\AppData\Local\Temp\4799.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4826.tmp"C:\Users\Admin\AppData\Local\Temp\4826.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4893.tmp"C:\Users\Admin\AppData\Local\Temp\4893.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4A39.tmp"C:\Users\Admin\AppData\Local\Temp\4A39.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4EBD.tmp"C:\Users\Admin\AppData\Local\Temp\4EBD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\5025.tmp"C:\Users\Admin\AppData\Local\Temp\5025.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\510F.tmp"C:\Users\Admin\AppData\Local\Temp\510F.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\5248.tmp"C:\Users\Admin\AppData\Local\Temp\5248.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\5361.tmp"C:\Users\Admin\AppData\Local\Temp\5361.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5499.tmp"C:\Users\Admin\AppData\Local\Temp\5499.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\55D2.tmp"C:\Users\Admin\AppData\Local\Temp\55D2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\56CC.tmp"C:\Users\Admin\AppData\Local\Temp\56CC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\57C6.tmp"C:\Users\Admin\AppData\Local\Temp\57C6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\58D0.tmp"C:\Users\Admin\AppData\Local\Temp\58D0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\59D9.tmp"C:\Users\Admin\AppData\Local\Temp\59D9.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5D06.tmp"C:\Users\Admin\AppData\Local\Temp\5D06.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5E00.tmp"C:\Users\Admin\AppData\Local\Temp\5E00.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\5F19.tmp"C:\Users\Admin\AppData\Local\Temp\5F19.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\610D.tmp"C:\Users\Admin\AppData\Local\Temp\610D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\61F7.tmp"C:\Users\Admin\AppData\Local\Temp\61F7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6320.tmp"C:\Users\Admin\AppData\Local\Temp\6320.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\642A.tmp"C:\Users\Admin\AppData\Local\Temp\642A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\6505.tmp"C:\Users\Admin\AppData\Local\Temp\6505.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\6591.tmp"C:\Users\Admin\AppData\Local\Temp\6591.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\664D.tmp"C:\Users\Admin\AppData\Local\Temp\664D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\6708.tmp"C:\Users\Admin\AppData\Local\Temp\6708.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\67E3.tmp"C:\Users\Admin\AppData\Local\Temp\67E3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\68ED.tmp"C:\Users\Admin\AppData\Local\Temp\68ED.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\69B8.tmp"C:\Users\Admin\AppData\Local\Temp\69B8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\6A64.tmp"C:\Users\Admin\AppData\Local\Temp\6A64.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\6F07.tmp"C:\Users\Admin\AppData\Local\Temp\6F07.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\731E.tmp"C:\Users\Admin\AppData\Local\Temp\731E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\73E9.tmp"C:\Users\Admin\AppData\Local\Temp\73E9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\7476.tmp"C:\Users\Admin\AppData\Local\Temp\7476.tmp"50⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\7502.tmp"C:\Users\Admin\AppData\Local\Temp\7502.tmp"51⤵
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\759F.tmp"C:\Users\Admin\AppData\Local\Temp\759F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\763B.tmp"C:\Users\Admin\AppData\Local\Temp\763B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\76D7.tmp"C:\Users\Admin\AppData\Local\Temp\76D7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\7764.tmp"C:\Users\Admin\AppData\Local\Temp\7764.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\77E1.tmp"C:\Users\Admin\AppData\Local\Temp\77E1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\785E.tmp"C:\Users\Admin\AppData\Local\Temp\785E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\78DB.tmp"C:\Users\Admin\AppData\Local\Temp\78DB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7958.tmp"C:\Users\Admin\AppData\Local\Temp\7958.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\7A71.tmp"C:\Users\Admin\AppData\Local\Temp\7A71.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7C36.tmp"C:\Users\Admin\AppData\Local\Temp\7C36.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\7CC3.tmp"C:\Users\Admin\AppData\Local\Temp\7CC3.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"C:\Users\Admin\AppData\Local\Temp\7D4F.tmp"66⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"C:\Users\Admin\AppData\Local\Temp\7DFB.tmp"67⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\7E78.tmp"C:\Users\Admin\AppData\Local\Temp\7E78.tmp"68⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"C:\Users\Admin\AppData\Local\Temp\7EF5.tmp"69⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7F72.tmp"C:\Users\Admin\AppData\Local\Temp\7F72.tmp"70⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"C:\Users\Admin\AppData\Local\Temp\7FFF.tmp"71⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\808B.tmp"C:\Users\Admin\AppData\Local\Temp\808B.tmp"72⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\80F9.tmp"C:\Users\Admin\AppData\Local\Temp\80F9.tmp"73⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\8176.tmp"C:\Users\Admin\AppData\Local\Temp\8176.tmp"74⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\81F3.tmp"C:\Users\Admin\AppData\Local\Temp\81F3.tmp"75⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\8260.tmp"C:\Users\Admin\AppData\Local\Temp\8260.tmp"76⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\82ED.tmp"C:\Users\Admin\AppData\Local\Temp\82ED.tmp"77⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\836A.tmp"C:\Users\Admin\AppData\Local\Temp\836A.tmp"78⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\83F6.tmp"C:\Users\Admin\AppData\Local\Temp\83F6.tmp"79⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\8473.tmp"C:\Users\Admin\AppData\Local\Temp\8473.tmp"80⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\8500.tmp"C:\Users\Admin\AppData\Local\Temp\8500.tmp"81⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\85BC.tmp"C:\Users\Admin\AppData\Local\Temp\85BC.tmp"82⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\8667.tmp"C:\Users\Admin\AppData\Local\Temp\8667.tmp"83⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\86F4.tmp"C:\Users\Admin\AppData\Local\Temp\86F4.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8771.tmp"C:\Users\Admin\AppData\Local\Temp\8771.tmp"85⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\880D.tmp"C:\Users\Admin\AppData\Local\Temp\880D.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\88AA.tmp"C:\Users\Admin\AppData\Local\Temp\88AA.tmp"87⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8927.tmp"C:\Users\Admin\AppData\Local\Temp\8927.tmp"88⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8994.tmp"C:\Users\Admin\AppData\Local\Temp\8994.tmp"89⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\8A21.tmp"C:\Users\Admin\AppData\Local\Temp\8A21.tmp"90⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"C:\Users\Admin\AppData\Local\Temp\8A9E.tmp"91⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"C:\Users\Admin\AppData\Local\Temp\8B0B.tmp"92⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"93⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\8C15.tmp"C:\Users\Admin\AppData\Local\Temp\8C15.tmp"94⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"95⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"96⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"97⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\8E37.tmp"C:\Users\Admin\AppData\Local\Temp\8E37.tmp"98⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"C:\Users\Admin\AppData\Local\Temp\8EC4.tmp"99⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"100⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"C:\Users\Admin\AppData\Local\Temp\8FFD.tmp"101⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\907A.tmp"C:\Users\Admin\AppData\Local\Temp\907A.tmp"102⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\9106.tmp"C:\Users\Admin\AppData\Local\Temp\9106.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\9193.tmp"C:\Users\Admin\AppData\Local\Temp\9193.tmp"104⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\9210.tmp"C:\Users\Admin\AppData\Local\Temp\9210.tmp"105⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\928D.tmp"C:\Users\Admin\AppData\Local\Temp\928D.tmp"106⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\9319.tmp"C:\Users\Admin\AppData\Local\Temp\9319.tmp"107⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\9396.tmp"C:\Users\Admin\AppData\Local\Temp\9396.tmp"108⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\9423.tmp"C:\Users\Admin\AppData\Local\Temp\9423.tmp"109⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\9490.tmp"C:\Users\Admin\AppData\Local\Temp\9490.tmp"110⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\94FE.tmp"C:\Users\Admin\AppData\Local\Temp\94FE.tmp"111⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\958A.tmp"C:\Users\Admin\AppData\Local\Temp\958A.tmp"112⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9607.tmp"C:\Users\Admin\AppData\Local\Temp\9607.tmp"113⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\9684.tmp"C:\Users\Admin\AppData\Local\Temp\9684.tmp"114⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"115⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"116⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"117⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"118⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\9944.tmp"C:\Users\Admin\AppData\Local\Temp\9944.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\99C1.tmp"C:\Users\Admin\AppData\Local\Temp\99C1.tmp"120⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"121⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\9AE9.tmp"C:\Users\Admin\AppData\Local\Temp\9AE9.tmp"122⤵PID:920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-