Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-17_ddc501ec448c5f4646ba9d5ce287dfed_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_ddc501ec448c5f4646ba9d5ce287dfed_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-17_ddc501ec448c5f4646ba9d5ce287dfed_elex_mafia.exe
- Size 520KB
- Sample260517-regzcsds2m
- SHA256 0aa5313ea08af85896f894d12c119ee110d4ab20c7a7df68a9ae311fb1a82156
- MD5 ddc501ec448c5f4646ba9d5ce287dfed
- SHA1 fc5bfd962c22f320507c000bbbea3cbc0baa728f
- SHA512 02b82d975879475a6cc2cb96f74149bf24df0094f29361fdea7c12f5dc241d42fecd7ee5912c16f9ede987aacd71ef80f02ae18031773cc13fccb86acc34c14c
- SSDEEP 12288:gj8fuxR21t5i8fKqqwfANW2iFVz6WpNZ:gj8fuK1GYD9fuvieWpN
- TLSH T106B4F012B944C032E9E705354B66DBA01BBABC799B2592C73784327E6FB52D1D73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5600 5242.tmp 3636 52BF.tmp 2144 531C.tmp 1060 5399.tmp 5480 53F7.tmp 2964 5464.tmp 4044 54E1.tmp 5368 553F.tmp 5848 560A.tmp 3448 5697.tmp 3232 56F5.tmp 3328 5772.tmp 4724 57CF.tmp 2932 584C.tmp 784 589B.tmp 1168 5918.tmp 3984 5985.tmp 5936 5A21.tmp 2424 5AAE.tmp 2204 5B0C.tmp 5300 5B5A.tmp 2220 5BA8.tmp 3252 5C44.tmp 484 5CD1.tmp 388 5D4E.tmp 2224 5D9C.tmp 2752 5E09.tmp 5904 5E96.tmp 4416 5EE4.tmp 4100 5F61.tmp 4016 5FBF.tmp 2124 605B.tmp 4512 60B9.tmp 912 6107.tmp 4908 6165.tmp 5692 61C2.tmp 2968 6230.tmp 2540 628D.tmp 2880 62FB.tmp 3044 6368.tmp 5828 63B6.tmp 2236 6414.tmp 1736 6481.tmp 5620 64EF.tmp 3148 654D.tmp 1136 65AA.tmp 540 6608.tmp 1436 6675.tmp 956 66E3.tmp 804 6741.tmp 2008 678F.tmp 2372 67EC.tmp 5252 683B.tmp 3376 6889.tmp 5148 68E6.tmp 3548 6935.tmp 1396 6983.tmp 5132 69D1.tmp 3472 6A1F.tmp 4220 6A6D.tmp 3180 6ABB.tmp 5060 6B09.tmp 1688 6B57.tmp 2436 6BA6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B263.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B35D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F141.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 572E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A10D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 479E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 850A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 289D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 747A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6140 wrote to memory of 5600 6140 2026-05-17_ddc501ec448c5f4646ba9d5ce287dfed_elex_mafia.exe 80 PID 5600 wrote to memory of 3636 5600 5242.tmp 81 PID 3636 wrote to memory of 2144 3636 52BF.tmp 82 PID 2144 wrote to memory of 1060 2144 531C.tmp 83 PID 1060 wrote to memory of 5480 1060 5399.tmp 84 PID 5480 wrote to memory of 2964 5480 53F7.tmp 85 PID 2964 wrote to memory of 4044 2964 5464.tmp 86 PID 4044 wrote to memory of 5368 4044 54E1.tmp 87 PID 5368 wrote to memory of 5848 5368 553F.tmp 88 PID 5848 wrote to memory of 3448 5848 560A.tmp 89 PID 3448 wrote to memory of 3232 3448 5697.tmp 90 PID 3232 wrote to memory of 3328 3232 56F5.tmp 91 PID 3328 wrote to memory of 4724 3328 5772.tmp 92 PID 4724 wrote to memory of 2932 4724 57CF.tmp 93 PID 2932 wrote to memory of 784 2932 584C.tmp 94 PID 784 wrote to memory of 1168 784 589B.tmp 95 PID 1168 wrote to memory of 3984 1168 5918.tmp 96 PID 3984 wrote to memory of 5936 3984 5985.tmp 97 PID 5936 wrote to memory of 2424 5936 5A21.tmp 98 PID 2424 wrote to memory of 2204 2424 5AAE.tmp 99 PID 2204 wrote to memory of 5300 2204 5B0C.tmp 100 PID 5300 wrote to memory of 2220 5300 5B5A.tmp 101 PID 2220 wrote to memory of 3252 2220 5BA8.tmp 102 PID 3252 wrote to memory of 484 3252 5C44.tmp 103 PID 484 wrote to memory of 388 484 5CD1.tmp 104 PID 388 wrote to memory of 2224 388 5D4E.tmp 105 PID 2224 wrote to memory of 2752 2224 5D9C.tmp 106 PID 2752 wrote to memory of 5904 2752 5E09.tmp 107 PID 5904 wrote to memory of 4416 5904 5E96.tmp 108 PID 4416 wrote to memory of 4100 4416 5EE4.tmp 109 PID 4100 wrote to memory of 4016 4100 5F61.tmp 110 PID 4016 wrote to memory of 2124 4016 5FBF.tmp 111 PID 2124 wrote to memory of 4512 2124 605B.tmp 112 PID 4512 wrote to memory of 912 4512 60B9.tmp 113 PID 912 wrote to memory of 4908 912 6107.tmp 114 PID 4908 wrote to memory of 5692 4908 6165.tmp 115 PID 5692 wrote to memory of 2968 5692 61C2.tmp 116 PID 2968 wrote to memory of 2540 2968 6230.tmp 117 PID 2540 wrote to memory of 2880 2540 628D.tmp 118 PID 2880 wrote to memory of 3044 2880 62FB.tmp 119 PID 3044 wrote to memory of 5828 3044 6368.tmp 120 PID 5828 wrote to memory of 2236 5828 63B6.tmp 121 PID 2236 wrote to memory of 1736 2236 6414.tmp 122 PID 1736 wrote to memory of 5620 1736 6481.tmp 123 PID 5620 wrote to memory of 3148 5620 64EF.tmp 124 PID 3148 wrote to memory of 1136 3148 654D.tmp 125 PID 1136 wrote to memory of 540 1136 65AA.tmp 126 PID 540 wrote to memory of 1436 540 6608.tmp 127 PID 1436 wrote to memory of 956 1436 6675.tmp 128 PID 956 wrote to memory of 804 956 66E3.tmp 129 PID 804 wrote to memory of 2008 804 6741.tmp 130 PID 2008 wrote to memory of 2372 2008 678F.tmp 131 PID 2372 wrote to memory of 5252 2372 67EC.tmp 132 PID 5252 wrote to memory of 3376 5252 683B.tmp 133 PID 3376 wrote to memory of 5148 3376 6889.tmp 134 PID 5148 wrote to memory of 3548 5148 68E6.tmp 135 PID 3548 wrote to memory of 1396 3548 6935.tmp 136 PID 1396 wrote to memory of 5132 1396 6983.tmp 137 PID 5132 wrote to memory of 3472 5132 69D1.tmp 138 PID 3472 wrote to memory of 4220 3472 6A1F.tmp 139 PID 4220 wrote to memory of 3180 4220 6A6D.tmp 140 PID 3180 wrote to memory of 5060 3180 6ABB.tmp 141 PID 5060 wrote to memory of 1688 5060 6B09.tmp 142 PID 1688 wrote to memory of 2436 1688 6B57.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_ddc501ec448c5f4646ba9d5ce287dfed_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_ddc501ec448c5f4646ba9d5ce287dfed_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\560A.tmp"C:\Users\Admin\AppData\Local\Temp\560A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\6165.tmp"C:\Users\Admin\AppData\Local\Temp\6165.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"65⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"66⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"67⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"68⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"69⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"70⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"71⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"72⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\6E74.tmp"C:\Users\Admin\AppData\Local\Temp\6E74.tmp"73⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"74⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"75⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"76⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"77⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"78⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"79⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"80⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\7133.tmp"C:\Users\Admin\AppData\Local\Temp\7133.tmp"81⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\7182.tmp"C:\Users\Admin\AppData\Local\Temp\7182.tmp"82⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\71D0.tmp"C:\Users\Admin\AppData\Local\Temp\71D0.tmp"83⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\722D.tmp"C:\Users\Admin\AppData\Local\Temp\722D.tmp"84⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"85⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"86⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7337.tmp"C:\Users\Admin\AppData\Local\Temp\7337.tmp"87⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"88⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"89⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"90⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\74CD.tmp"C:\Users\Admin\AppData\Local\Temp\74CD.tmp"91⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"92⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"93⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"94⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\7625.tmp"C:\Users\Admin\AppData\Local\Temp\7625.tmp"95⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"96⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"97⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\771F.tmp"C:\Users\Admin\AppData\Local\Temp\771F.tmp"98⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"99⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\77CB.tmp"C:\Users\Admin\AppData\Local\Temp\77CB.tmp"100⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"101⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"102⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"103⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"104⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"105⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"106⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"107⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"108⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"109⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"110⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\7B94.tmp"C:\Users\Admin\AppData\Local\Temp\7B94.tmp"111⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"112⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"C:\Users\Admin\AppData\Local\Temp\7C4F.tmp"113⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"114⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"115⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"116⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"117⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"118⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\7E62.tmp"C:\Users\Admin\AppData\Local\Temp\7E62.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"120⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"121⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"122⤵PID:6112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-