Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-21_9fc265b30fcb3c938ec7e5f32f598f4b_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-21_9fc265b30fcb3c938ec7e5f32f598f4b_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-21_9fc265b30fcb3c938ec7e5f32f598f4b_elex_mafia.exe
- Size 520KB
- Sample260421-e1cwbabw4s
- SHA256 2f86d27dfa13739bcb6d132d8cd35f35d7960c453603fbefcf15689fd6dd7065
- MD5 9fc265b30fcb3c938ec7e5f32f598f4b
- SHA1 8065f2b7ff7d455b5ea3007b4995f31e08796134
- SHA512 4eb8140542496a0d63f12c9d9be4fdace9b0f5fe3831cb8d0072eb57884cf2665b0fa4b62426c91e2f3948f2e4f81761180507661f923ee62ba11704a1341370
- SSDEEP 12288:roRXOQjmOyC5Awlai04jQaRc/qC16ZztMCt8cwiflLNZ:rogQ9ynoj04j/c/qC16ZBNtuSLN
- TLSH T123B4F0227584C032E9D215345B26DBA21B3B7D37972A92CB3BC0266D6FB42D1E778347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1564 E7B0.tmp 5068 E80E.tmp 2012 E88B.tmp 2412 E8F8.tmp 3224 E956.tmp 5036 E9A4.tmp 3052 EA12.tmp 464 EA7F.tmp 4364 EAEC.tmp 1284 EB69.tmp 3720 EBE6.tmp 4680 EC63.tmp 484 ECD1.tmp 4020 ED4E.tmp 3644 EDBB.tmp 416 EE29.tmp 2232 EEC5.tmp 1216 EF51.tmp 3408 EFDE.tmp 4324 F02C.tmp 2600 F09A.tmp 1692 F117.tmp 3920 F184.tmp 3788 F1C2.tmp 2456 F23F.tmp 4004 F2BC.tmp 3520 F339.tmp 2672 F3B6.tmp 4340 F405.tmp 3772 F482.tmp 5044 F4DF.tmp 2060 F54D.tmp 480 F5BA.tmp 1000 F608.tmp 4060 F656.tmp 2504 F6A4.tmp 232 F6F3.tmp 760 F750.tmp 2692 F7AE.tmp 3916 F7ED.tmp 2156 F82B.tmp 2484 F86A.tmp 1592 F8A8.tmp 2416 F8F6.tmp 2972 F954.tmp 3344 F9B2.tmp 3476 FA0F.tmp 2160 FA6D.tmp 2660 FAAC.tmp 2988 FAFA.tmp 4744 FB58.tmp 980 FBB5.tmp 4264 FC13.tmp 2240 FC61.tmp 3696 FCBF.tmp 2284 FD1D.tmp 3680 FD7A.tmp 3196 FDD8.tmp 3180 FE26.tmp 2580 FE65.tmp 3232 FEB3.tmp 1944 FF01.tmp 2104 FF5F.tmp 1604 FFAD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 406F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 366D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 119F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3822.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 997C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 946B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E75D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1564 3048 2026-04-21_9fc265b30fcb3c938ec7e5f32f598f4b_elex_mafia.exe 79 PID 1564 wrote to memory of 5068 1564 E7B0.tmp 80 PID 5068 wrote to memory of 2012 5068 E80E.tmp 81 PID 2012 wrote to memory of 2412 2012 E88B.tmp 82 PID 2412 wrote to memory of 3224 2412 E8F8.tmp 83 PID 3224 wrote to memory of 5036 3224 E956.tmp 84 PID 5036 wrote to memory of 3052 5036 E9A4.tmp 85 PID 3052 wrote to memory of 464 3052 EA12.tmp 86 PID 464 wrote to memory of 4364 464 EA7F.tmp 87 PID 4364 wrote to memory of 1284 4364 EAEC.tmp 88 PID 1284 wrote to memory of 3720 1284 EB69.tmp 89 PID 3720 wrote to memory of 4680 3720 EBE6.tmp 90 PID 4680 wrote to memory of 484 4680 EC63.tmp 91 PID 484 wrote to memory of 4020 484 ECD1.tmp 92 PID 4020 wrote to memory of 3644 4020 ED4E.tmp 93 PID 3644 wrote to memory of 416 3644 EDBB.tmp 94 PID 416 wrote to memory of 2232 416 EE29.tmp 95 PID 2232 wrote to memory of 1216 2232 EEC5.tmp 96 PID 1216 wrote to memory of 3408 1216 EF51.tmp 97 PID 3408 wrote to memory of 4324 3408 EFDE.tmp 98 PID 4324 wrote to memory of 2600 4324 F02C.tmp 99 PID 2600 wrote to memory of 1692 2600 F09A.tmp 100 PID 1692 wrote to memory of 3920 1692 F117.tmp 101 PID 3920 wrote to memory of 3788 3920 F184.tmp 102 PID 3788 wrote to memory of 2456 3788 F1C2.tmp 103 PID 2456 wrote to memory of 4004 2456 F23F.tmp 104 PID 4004 wrote to memory of 3520 4004 F2BC.tmp 105 PID 3520 wrote to memory of 2672 3520 F339.tmp 106 PID 2672 wrote to memory of 4340 2672 F3B6.tmp 107 PID 4340 wrote to memory of 3772 4340 F405.tmp 108 PID 3772 wrote to memory of 5044 3772 F482.tmp 109 PID 5044 wrote to memory of 2060 5044 F4DF.tmp 110 PID 2060 wrote to memory of 480 2060 F54D.tmp 111 PID 480 wrote to memory of 1000 480 F5BA.tmp 112 PID 1000 wrote to memory of 4060 1000 F608.tmp 113 PID 4060 wrote to memory of 2504 4060 F656.tmp 114 PID 2504 wrote to memory of 232 2504 F6A4.tmp 115 PID 232 wrote to memory of 760 232 F6F3.tmp 116 PID 760 wrote to memory of 2692 760 F750.tmp 117 PID 2692 wrote to memory of 3916 2692 F7AE.tmp 118 PID 3916 wrote to memory of 2156 3916 F7ED.tmp 119 PID 2156 wrote to memory of 2484 2156 F82B.tmp 120 PID 2484 wrote to memory of 1592 2484 F86A.tmp 121 PID 1592 wrote to memory of 2416 1592 F8A8.tmp 122 PID 2416 wrote to memory of 2972 2416 F8F6.tmp 123 PID 2972 wrote to memory of 3344 2972 F954.tmp 124 PID 3344 wrote to memory of 3476 3344 F9B2.tmp 125 PID 3476 wrote to memory of 2160 3476 FA0F.tmp 126 PID 2160 wrote to memory of 2660 2160 FA6D.tmp 127 PID 2660 wrote to memory of 2988 2660 FAAC.tmp 128 PID 2988 wrote to memory of 4744 2988 FAFA.tmp 129 PID 4744 wrote to memory of 980 4744 FB58.tmp 130 PID 980 wrote to memory of 4264 980 FBB5.tmp 131 PID 4264 wrote to memory of 2240 4264 FC13.tmp 132 PID 2240 wrote to memory of 3696 2240 FC61.tmp 133 PID 3696 wrote to memory of 2284 3696 FCBF.tmp 134 PID 2284 wrote to memory of 3680 2284 FD1D.tmp 135 PID 3680 wrote to memory of 3196 3680 FD7A.tmp 136 PID 3196 wrote to memory of 3180 3196 FDD8.tmp 137 PID 3180 wrote to memory of 2580 3180 FE26.tmp 138 PID 2580 wrote to memory of 3232 2580 FE65.tmp 139 PID 3232 wrote to memory of 1944 3232 FEB3.tmp 140 PID 1944 wrote to memory of 2104 1944 FF01.tmp 141 PID 2104 wrote to memory of 1604 2104 FF5F.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_9fc265b30fcb3c938ec7e5f32f598f4b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_9fc265b30fcb3c938ec7e5f32f598f4b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"C:\Users\Admin\AppData\Local\Temp\FD7A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"65⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"66⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"67⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"68⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\105.tmp"C:\Users\Admin\AppData\Local\Temp\105.tmp"69⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"70⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"71⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"72⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"73⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:552 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"75⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"76⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"77⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"78⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"79⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"80⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"81⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"82⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"83⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"84⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"85⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"86⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"87⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"88⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"89⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"90⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"91⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"92⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"93⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"94⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"95⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"96⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"97⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"98⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"99⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"100⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"101⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"102⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"103⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"104⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"105⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"106⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"107⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"108⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"109⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"110⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"112⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"113⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"114⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"115⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"116⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"117⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"118⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"119⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"120⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-