Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 16:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-04_256c2dc80ccc4abf27b99293ee345d15_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_256c2dc80ccc4abf27b99293ee345d15_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-04_256c2dc80ccc4abf27b99293ee345d15_elex_mafia.exe
- Size 524KB
- Sample260504-t563aaby5j
- SHA256 11410b829199c222faf082f31fb6de357ffc1bc20bd31db61e47c04cef4684c3
- MD5 256c2dc80ccc4abf27b99293ee345d15
- SHA1 37147bf724d2d6f35adbc2e849411bfd10bee1b5
- SHA512 9b163861d31d743a66c37442a18108a55b881b7d82d02e975c2821eb4bd4866509e10f841d033706e55312a16c1e7123d884357b42b195d5e65a8c6ae8370ae5
- SSDEEP 12288:TRyZzqyL66TCvSfhY9aOOBbVtaT4MSXR4NZ:TRyQylTCIwajVtuSXR4N
- TLSH T147B4F125B588C036E6C206358A55EBA2593EBC719B27A1CB3BC9267D6FB03D0D374347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1084 DE4A.tmp 4984 DEA8.tmp 3124 DFD1.tmp 3748 E0CB.tmp 3532 E186.tmp 1764 E280.tmp 4776 E3A9.tmp 1756 E407.tmp 3636 E54F.tmp 3364 E639.tmp 1632 E743.tmp 1456 E81E.tmp 2464 E8F8.tmp 4864 E9E3.tmp 3732 EADD.tmp 4592 EBE6.tmp 3316 ECF0.tmp 4836 EDCB.tmp 4556 EEA6.tmp 4432 EFA0.tmp 3080 F09A.tmp 5088 F1B3.tmp 2944 F28E.tmp 1376 F368.tmp 3856 F443.tmp 4972 F51E.tmp 1488 F627.tmp 3040 F702.tmp 1060 F7DD.tmp 3884 F8D7.tmp 3612 F9C1.tmp 1252 FA9C.tmp 3104 FB86.tmp 484 FC13.tmp 2956 FCEE.tmp 4696 FD8A.tmp 1460 FE17.tmp 1708 FEB3.tmp 3904 FF6E.tmp 3092 2A.tmp 1604 C6.tmp 2492 172.tmp 964 21E.tmp 3900 2AB.tmp 2536 356.tmp 4400 412.tmp 2460 4CD.tmp 1284 55A.tmp 4168 5D7.tmp 4204 635.tmp 236 6A2.tmp 4056 6F0.tmp 4856 74E.tmp 748 7BB.tmp 324 838.tmp 2076 8B5.tmp 2688 913.tmp 2372 981.tmp 3936 9DE.tmp 2104 A4C.tmp 4564 AB9.tmp 4000 B26.tmp 3356 B94.tmp 4512 C11.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 676F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5261.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4296 wrote to memory of 1084 4296 2026-05-04_256c2dc80ccc4abf27b99293ee345d15_elex_mafia.exe 80 PID 1084 wrote to memory of 4984 1084 DE4A.tmp 81 PID 4984 wrote to memory of 3124 4984 DEA8.tmp 82 PID 3124 wrote to memory of 3748 3124 DFD1.tmp 83 PID 3748 wrote to memory of 3532 3748 E0CB.tmp 84 PID 3532 wrote to memory of 1764 3532 E186.tmp 85 PID 1764 wrote to memory of 4776 1764 E280.tmp 86 PID 4776 wrote to memory of 1756 4776 E3A9.tmp 87 PID 1756 wrote to memory of 3636 1756 E407.tmp 88 PID 3636 wrote to memory of 3364 3636 E54F.tmp 89 PID 3364 wrote to memory of 1632 3364 E639.tmp 90 PID 1632 wrote to memory of 1456 1632 E743.tmp 91 PID 1456 wrote to memory of 2464 1456 E81E.tmp 92 PID 2464 wrote to memory of 4864 2464 E8F8.tmp 93 PID 4864 wrote to memory of 3732 4864 E9E3.tmp 94 PID 3732 wrote to memory of 4592 3732 EADD.tmp 95 PID 4592 wrote to memory of 3316 4592 EBE6.tmp 96 PID 3316 wrote to memory of 4836 3316 ECF0.tmp 97 PID 4836 wrote to memory of 4556 4836 EDCB.tmp 98 PID 4556 wrote to memory of 4432 4556 EEA6.tmp 99 PID 4432 wrote to memory of 3080 4432 EFA0.tmp 100 PID 3080 wrote to memory of 5088 3080 F09A.tmp 101 PID 5088 wrote to memory of 2944 5088 F1B3.tmp 102 PID 2944 wrote to memory of 1376 2944 F28E.tmp 103 PID 1376 wrote to memory of 3856 1376 F368.tmp 104 PID 3856 wrote to memory of 4972 3856 F443.tmp 105 PID 4972 wrote to memory of 1488 4972 F51E.tmp 106 PID 1488 wrote to memory of 3040 1488 F627.tmp 107 PID 3040 wrote to memory of 1060 3040 F702.tmp 108 PID 1060 wrote to memory of 3884 1060 F7DD.tmp 109 PID 3884 wrote to memory of 3612 3884 F8D7.tmp 110 PID 3612 wrote to memory of 1252 3612 F9C1.tmp 111 PID 1252 wrote to memory of 3104 1252 FA9C.tmp 112 PID 3104 wrote to memory of 484 3104 FB86.tmp 113 PID 484 wrote to memory of 2956 484 FC13.tmp 114 PID 2956 wrote to memory of 4696 2956 FCEE.tmp 115 PID 4696 wrote to memory of 1460 4696 FD8A.tmp 116 PID 1460 wrote to memory of 1708 1460 FE17.tmp 117 PID 1708 wrote to memory of 3904 1708 FEB3.tmp 118 PID 3904 wrote to memory of 3092 3904 FF6E.tmp 119 PID 3092 wrote to memory of 1604 3092 2A.tmp 120 PID 1604 wrote to memory of 2492 1604 C6.tmp 121 PID 2492 wrote to memory of 964 2492 172.tmp 122 PID 964 wrote to memory of 3900 964 21E.tmp 123 PID 3900 wrote to memory of 2536 3900 2AB.tmp 124 PID 2536 wrote to memory of 4400 2536 356.tmp 125 PID 4400 wrote to memory of 2460 4400 412.tmp 126 PID 2460 wrote to memory of 1284 2460 4CD.tmp 127 PID 1284 wrote to memory of 4168 1284 55A.tmp 128 PID 4168 wrote to memory of 4204 4168 5D7.tmp 129 PID 4204 wrote to memory of 236 4204 635.tmp 130 PID 236 wrote to memory of 4056 236 6A2.tmp 131 PID 4056 wrote to memory of 4856 4056 6F0.tmp 132 PID 4856 wrote to memory of 748 4856 74E.tmp 133 PID 748 wrote to memory of 324 748 7BB.tmp 134 PID 324 wrote to memory of 2076 324 838.tmp 135 PID 2076 wrote to memory of 2688 2076 8B5.tmp 136 PID 2688 wrote to memory of 2372 2688 913.tmp 137 PID 2372 wrote to memory of 3936 2372 981.tmp 138 PID 3936 wrote to memory of 2104 3936 9DE.tmp 139 PID 2104 wrote to memory of 4564 2104 A4C.tmp 140 PID 4564 wrote to memory of 4000 4564 AB9.tmp 141 PID 4000 wrote to memory of 3356 4000 B26.tmp 142 PID 3356 wrote to memory of 4512 3356 B94.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_256c2dc80ccc4abf27b99293ee345d15_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_256c2dc80ccc4abf27b99293ee345d15_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"C:\Users\Admin\AppData\Local\Temp\FEB3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\2AB.tmp"C:\Users\Admin\AppData\Local\Temp\2AB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"66⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"67⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"68⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"69⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"70⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"71⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"72⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"73⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"74⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"75⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"76⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"77⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"78⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"79⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"80⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"81⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"82⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"83⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"84⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"85⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"86⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"88⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"89⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"90⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\1539.tmp"C:\Users\Admin\AppData\Local\Temp\1539.tmp"91⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"92⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"93⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"94⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"95⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"96⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"97⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"98⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"99⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"100⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"101⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"102⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"103⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"104⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"105⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"106⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"107⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"108⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"109⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"110⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"111⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"112⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"113⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"114⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"115⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"116⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"118⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"119⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"120⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"121⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"122⤵PID:4932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-