Analysis
- max time kernel
150s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-23_97b81e3afc3912b18f6c4b12e7881a83_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_97b81e3afc3912b18f6c4b12e7881a83_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-23_97b81e3afc3912b18f6c4b12e7881a83_elex_mafia.exe
- Size 520KB
- Sample260423-fsaawsbw4x
- SHA256 2085c2675f64704440c6e9d8e7a715193247ba57b38b08dc6795674868ddbd5f
- MD5 97b81e3afc3912b18f6c4b12e7881a83
- SHA1 41725dc785abe14db09493ec91df685254d2a5fa
- SHA512 9c8e7ed64626d0d8449876b95150a4cc54032a18b6341d86dd0ad03e87c9771ace1f4d979122a66a9ede10054e424aeeb646bec2be5cc5ab37b2c29d032dca4d
- SSDEEP 12288:roRXOQjmOyXydg+OTM6Dt27jym8b/mdU975NZ:rogQ9yXH+g3hGjym8Cd8N
- TLSH T167B4E0227585C036E4E265358B26CBA15B3E7D72973692C73BC43A6CAFB02D1E274347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4496 FEA3.tmp 4600 FF01.tmp 4324 FF7E.tmp 4816 B.tmp 3916 68.tmp 1072 D6.tmp 1048 134.tmp 2520 1B1.tmp 2112 21E.tmp 3524 28B.tmp 3772 308.tmp 4108 376.tmp 1868 3F3.tmp 4388 441.tmp 2568 49F.tmp 3544 4FC.tmp 4428 56A.tmp 2024 606.tmp 1448 664.tmp 8 6F0.tmp 2768 75E.tmp 4796 7AC.tmp 5064 829.tmp 2220 887.tmp 960 913.tmp 4764 9A0.tmp 2944 9FE.tmp 212 A4C.tmp 4772 AB9.tmp 1648 B26.tmp 1608 BA3.tmp 3156 C11.tmp 3112 C6F.tmp 2008 CBD.tmp 3552 D0B.tmp 4704 D59.tmp 3364 DB7.tmp 4244 E05.tmp 1948 E53.tmp 2592 EB1.tmp 4852 EFF.tmp 1640 F4D.tmp 3248 F8B.tmp 904 FDA.tmp 4048 1028.tmp 1184 1076.tmp 1768 10C4.tmp 4504 1112.tmp 4712 1160.tmp 1916 11AE.tmp 1732 11FC.tmp 1864 124B.tmp 1388 12A8.tmp 4452 1306.tmp 768 1354.tmp 2620 13B2.tmp 2084 1410.tmp 2512 145E.tmp 4696 14BC.tmp 4596 150A.tmp 4248 1558.tmp 4336 15A6.tmp 3648 15F4.tmp 3272 1642.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 150A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 441.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 296C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 588B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 994D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5196.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ED7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A18A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A42.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 4496 2044 2026-04-23_97b81e3afc3912b18f6c4b12e7881a83_elex_mafia.exe 85 PID 4496 wrote to memory of 4600 4496 FEA3.tmp 86 PID 4600 wrote to memory of 4324 4600 FF01.tmp 87 PID 4324 wrote to memory of 4816 4324 FF7E.tmp 88 PID 4816 wrote to memory of 3916 4816 B.tmp 89 PID 3916 wrote to memory of 1072 3916 68.tmp 90 PID 1072 wrote to memory of 1048 1072 D6.tmp 91 PID 1048 wrote to memory of 2520 1048 134.tmp 92 PID 2520 wrote to memory of 2112 2520 1B1.tmp 93 PID 2112 wrote to memory of 3524 2112 21E.tmp 94 PID 3524 wrote to memory of 3772 3524 28B.tmp 95 PID 3772 wrote to memory of 4108 3772 308.tmp 96 PID 4108 wrote to memory of 1868 4108 376.tmp 97 PID 1868 wrote to memory of 4388 1868 3F3.tmp 98 PID 4388 wrote to memory of 2568 4388 441.tmp 99 PID 2568 wrote to memory of 3544 2568 49F.tmp 100 PID 3544 wrote to memory of 4428 3544 4FC.tmp 101 PID 4428 wrote to memory of 2024 4428 56A.tmp 102 PID 2024 wrote to memory of 1448 2024 606.tmp 103 PID 1448 wrote to memory of 8 1448 664.tmp 104 PID 8 wrote to memory of 2768 8 6F0.tmp 105 PID 2768 wrote to memory of 4796 2768 75E.tmp 106 PID 4796 wrote to memory of 5064 4796 7AC.tmp 107 PID 5064 wrote to memory of 2220 5064 829.tmp 108 PID 2220 wrote to memory of 960 2220 887.tmp 109 PID 960 wrote to memory of 4764 960 913.tmp 110 PID 4764 wrote to memory of 2944 4764 9A0.tmp 111 PID 2944 wrote to memory of 212 2944 9FE.tmp 112 PID 212 wrote to memory of 4772 212 A4C.tmp 113 PID 4772 wrote to memory of 1648 4772 AB9.tmp 114 PID 1648 wrote to memory of 1608 1648 B26.tmp 115 PID 1608 wrote to memory of 3156 1608 BA3.tmp 116 PID 3156 wrote to memory of 3112 3156 C11.tmp 117 PID 3112 wrote to memory of 2008 3112 C6F.tmp 118 PID 2008 wrote to memory of 3552 2008 CBD.tmp 119 PID 3552 wrote to memory of 4704 3552 D0B.tmp 120 PID 4704 wrote to memory of 3364 4704 D59.tmp 121 PID 3364 wrote to memory of 4244 3364 DB7.tmp 122 PID 4244 wrote to memory of 1948 4244 E05.tmp 123 PID 1948 wrote to memory of 2592 1948 E53.tmp 124 PID 2592 wrote to memory of 4852 2592 EB1.tmp 125 PID 4852 wrote to memory of 1640 4852 EFF.tmp 126 PID 1640 wrote to memory of 3248 1640 F4D.tmp 127 PID 3248 wrote to memory of 904 3248 F8B.tmp 128 PID 904 wrote to memory of 4048 904 FDA.tmp 129 PID 4048 wrote to memory of 1184 4048 1028.tmp 130 PID 1184 wrote to memory of 1768 1184 1076.tmp 131 PID 1768 wrote to memory of 4504 1768 10C4.tmp 132 PID 4504 wrote to memory of 4712 4504 1112.tmp 133 PID 4712 wrote to memory of 1916 4712 1160.tmp 134 PID 1916 wrote to memory of 1732 1916 11AE.tmp 135 PID 1732 wrote to memory of 1864 1732 11FC.tmp 136 PID 1864 wrote to memory of 1388 1864 124B.tmp 137 PID 1388 wrote to memory of 4452 1388 12A8.tmp 138 PID 4452 wrote to memory of 768 4452 1306.tmp 139 PID 768 wrote to memory of 2620 768 1354.tmp 140 PID 2620 wrote to memory of 2084 2620 13B2.tmp 141 PID 2084 wrote to memory of 2512 2084 1410.tmp 142 PID 2512 wrote to memory of 4696 2512 145E.tmp 143 PID 4696 wrote to memory of 4596 4696 14BC.tmp 144 PID 4596 wrote to memory of 4248 4596 150A.tmp 145 PID 4248 wrote to memory of 4336 4248 1558.tmp 146 PID 4336 wrote to memory of 3648 4336 15A6.tmp 147 PID 3648 wrote to memory of 3272 3648 15F4.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_97b81e3afc3912b18f6c4b12e7881a83_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_97b81e3afc3912b18f6c4b12e7881a83_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\14BC.tmp"C:\Users\Admin\AppData\Local\Temp\14BC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"65⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"66⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"67⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"68⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"69⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"70⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"71⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"72⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"73⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"74⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"75⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"76⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"77⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1A78.tmp"C:\Users\Admin\AppData\Local\Temp\1A78.tmp"78⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"79⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"80⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"81⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"82⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"83⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"84⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"85⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"86⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"87⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"88⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"89⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"90⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"91⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"93⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"94⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"95⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"96⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"97⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"99⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\217D.tmp"C:\Users\Admin\AppData\Local\Temp\217D.tmp"100⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"101⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"102⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"103⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"104⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"105⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"106⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"107⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"108⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"109⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"110⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"111⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"112⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"113⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"114⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"115⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"116⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:372 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"118⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"119⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"120⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"121⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"122⤵PID:3084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-