Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_28e402d3182f823a1ec02c073afe1ed6_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_28e402d3182f823a1ec02c073afe1ed6_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-31_28e402d3182f823a1ec02c073afe1ed6_elex_mafia.exe
- Size 524KB
- Sample260531-sd31wacz7k
- SHA256 ccd03f3047bd0f2d72ff128609ac724fef54fd41ca7b4440a626bf4e5ea18ef4
- MD5 28e402d3182f823a1ec02c073afe1ed6
- SHA1 1bb6db29b2bbc0c84bc78e8abe350ace587c47ab
- SHA512 38edcf2635f62e4b7f2da6e4d349a17a0d534e3b96d2e6d93cf4451f92715f28cea7e358c83b1ece8366b513ac49033b5ee6ab1dd715057c93dcc1972a11593f
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf73QoLJk5ajZQ2a6o4Zh114PCrycefaslJ+LEP7f:TRyZzqyL66TLGYwS4FpyslpoaXhNZ
- TLSH T1E0B4E0157989C432E2D211368B66EB92593B7C71AB26A4CB3BC4367D6EF03D1D278207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3884 7FD9.tmp 1344 8066.tmp 5004 80F3.tmp 864 817F.tmp 1204 821C.tmp 4476 82A8.tmp 3640 8344.tmp 784 83C1.tmp 3192 844E.tmp 5084 84EA.tmp 4068 8596.tmp 4524 8632.tmp 3932 86CF.tmp 4532 876B.tmp 3908 87F8.tmp 2056 88B3.tmp 3668 894F.tmp 4988 89CC.tmp 1300 8A49.tmp 1980 8AE6.tmp 1008 8B63.tmp 128 8BFF.tmp 3812 8C9B.tmp 2540 8D18.tmp 1904 8DB4.tmp 388 8E31.tmp 648 8F1C.tmp 3468 8FB8.tmp 3588 9054.tmp 4480 90D1.tmp 2872 915E.tmp 4032 91FA.tmp 5056 9296.tmp 3536 9304.tmp 1228 9381.tmp 2468 93CF.tmp 3048 944C.tmp 764 94B9.tmp 2696 9536.tmp 4412 95A4.tmp 3036 9621.tmp 3972 969E.tmp 4356 970B.tmp 1076 9759.tmp 4064 97B7.tmp 3864 9824.tmp 4868 9892.tmp 1372 98FF.tmp 4844 995D.tmp 4560 99AB.tmp 4220 99E9.tmp 988 9A37.tmp 4648 9A86.tmp 2548 9AD4.tmp 2580 9B22.tmp 4552 9B70.tmp 912 9BBE.tmp 1404 9C0C.tmp 1588 9C4B.tmp 4168 9CA8.tmp 2116 9CF7.tmp 4048 9D45.tmp 1184 9D93.tmp 2896 9DE1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B82F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 995D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 458B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A275.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 970B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 3884 2332 2026-05-31_28e402d3182f823a1ec02c073afe1ed6_elex_mafia.exe 80 PID 3884 wrote to memory of 1344 3884 7FD9.tmp 81 PID 1344 wrote to memory of 5004 1344 8066.tmp 82 PID 5004 wrote to memory of 864 5004 80F3.tmp 83 PID 864 wrote to memory of 1204 864 817F.tmp 84 PID 1204 wrote to memory of 4476 1204 821C.tmp 85 PID 4476 wrote to memory of 3640 4476 82A8.tmp 86 PID 3640 wrote to memory of 784 3640 8344.tmp 87 PID 784 wrote to memory of 3192 784 83C1.tmp 88 PID 3192 wrote to memory of 5084 3192 844E.tmp 89 PID 5084 wrote to memory of 4068 5084 84EA.tmp 90 PID 4068 wrote to memory of 4524 4068 8596.tmp 91 PID 4524 wrote to memory of 3932 4524 8632.tmp 92 PID 3932 wrote to memory of 4532 3932 86CF.tmp 93 PID 4532 wrote to memory of 3908 4532 876B.tmp 94 PID 3908 wrote to memory of 2056 3908 87F8.tmp 95 PID 2056 wrote to memory of 3668 2056 88B3.tmp 96 PID 3668 wrote to memory of 4988 3668 894F.tmp 97 PID 4988 wrote to memory of 1300 4988 89CC.tmp 98 PID 1300 wrote to memory of 1980 1300 8A49.tmp 99 PID 1980 wrote to memory of 1008 1980 8AE6.tmp 100 PID 1008 wrote to memory of 128 1008 8B63.tmp 101 PID 128 wrote to memory of 3812 128 8BFF.tmp 102 PID 3812 wrote to memory of 2540 3812 8C9B.tmp 103 PID 2540 wrote to memory of 1904 2540 8D18.tmp 104 PID 1904 wrote to memory of 388 1904 8DB4.tmp 105 PID 388 wrote to memory of 648 388 8E31.tmp 106 PID 648 wrote to memory of 3468 648 8F1C.tmp 107 PID 3468 wrote to memory of 3588 3468 8FB8.tmp 108 PID 3588 wrote to memory of 4480 3588 9054.tmp 109 PID 4480 wrote to memory of 2872 4480 90D1.tmp 110 PID 2872 wrote to memory of 4032 2872 915E.tmp 111 PID 4032 wrote to memory of 5056 4032 91FA.tmp 112 PID 5056 wrote to memory of 3536 5056 9296.tmp 113 PID 3536 wrote to memory of 1228 3536 9304.tmp 114 PID 1228 wrote to memory of 2468 1228 9381.tmp 115 PID 2468 wrote to memory of 3048 2468 93CF.tmp 116 PID 3048 wrote to memory of 764 3048 944C.tmp 117 PID 764 wrote to memory of 2696 764 94B9.tmp 118 PID 2696 wrote to memory of 4412 2696 9536.tmp 119 PID 4412 wrote to memory of 3036 4412 95A4.tmp 120 PID 3036 wrote to memory of 3972 3036 9621.tmp 121 PID 3972 wrote to memory of 4356 3972 969E.tmp 122 PID 4356 wrote to memory of 1076 4356 970B.tmp 123 PID 1076 wrote to memory of 4064 1076 9759.tmp 124 PID 4064 wrote to memory of 3864 4064 97B7.tmp 125 PID 3864 wrote to memory of 4868 3864 9824.tmp 126 PID 4868 wrote to memory of 1372 4868 9892.tmp 127 PID 1372 wrote to memory of 4844 1372 98FF.tmp 128 PID 4844 wrote to memory of 4560 4844 995D.tmp 129 PID 4560 wrote to memory of 4220 4560 99AB.tmp 130 PID 4220 wrote to memory of 988 4220 99E9.tmp 131 PID 988 wrote to memory of 4648 988 9A37.tmp 132 PID 4648 wrote to memory of 2548 4648 9A86.tmp 133 PID 2548 wrote to memory of 2580 2548 9AD4.tmp 134 PID 2580 wrote to memory of 4552 2580 9B22.tmp 135 PID 4552 wrote to memory of 912 4552 9B70.tmp 136 PID 912 wrote to memory of 1404 912 9BBE.tmp 137 PID 1404 wrote to memory of 1588 1404 9C0C.tmp 138 PID 1588 wrote to memory of 4168 1588 9C4B.tmp 139 PID 4168 wrote to memory of 2116 4168 9CA8.tmp 140 PID 2116 wrote to memory of 4048 2116 9CF7.tmp 141 PID 4048 wrote to memory of 1184 4048 9D45.tmp 142 PID 1184 wrote to memory of 2896 1184 9D93.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_28e402d3182f823a1ec02c073afe1ed6_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_28e402d3182f823a1ec02c073afe1ed6_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8344.tmp"C:\Users\Admin\AppData\Local\Temp\8344.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\84EA.tmp"C:\Users\Admin\AppData\Local\Temp\84EA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\876B.tmp"C:\Users\Admin\AppData\Local\Temp\876B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\89CC.tmp"C:\Users\Admin\AppData\Local\Temp\89CC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:128 -
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\90D1.tmp"C:\Users\Admin\AppData\Local\Temp\90D1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\9381.tmp"C:\Users\Admin\AppData\Local\Temp\9381.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\93CF.tmp"C:\Users\Admin\AppData\Local\Temp\93CF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\944C.tmp"C:\Users\Admin\AppData\Local\Temp\944C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\9536.tmp"C:\Users\Admin\AppData\Local\Temp\9536.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\95A4.tmp"C:\Users\Admin\AppData\Local\Temp\95A4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\97B7.tmp"C:\Users\Admin\AppData\Local\Temp\97B7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\9824.tmp"C:\Users\Admin\AppData\Local\Temp\9824.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\98FF.tmp"C:\Users\Admin\AppData\Local\Temp\98FF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\995D.tmp"C:\Users\Admin\AppData\Local\Temp\995D.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\99AB.tmp"C:\Users\Admin\AppData\Local\Temp\99AB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\9A86.tmp"C:\Users\Admin\AppData\Local\Temp\9A86.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"C:\Users\Admin\AppData\Local\Temp\9AD4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9B22.tmp"C:\Users\Admin\AppData\Local\Temp\9B22.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9B70.tmp"C:\Users\Admin\AppData\Local\Temp\9B70.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\9D45.tmp"C:\Users\Admin\AppData\Local\Temp\9D45.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"C:\Users\Admin\AppData\Local\Temp\9DE1.tmp"65⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"66⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"67⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"68⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"69⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"70⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9F96.tmp"C:\Users\Admin\AppData\Local\Temp\9F96.tmp"71⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"72⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\A033.tmp"C:\Users\Admin\AppData\Local\Temp\A033.tmp"73⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\A081.tmp"C:\Users\Admin\AppData\Local\Temp\A081.tmp"74⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"75⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"76⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A17B.tmp"C:\Users\Admin\AppData\Local\Temp\A17B.tmp"77⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"78⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A227.tmp"C:\Users\Admin\AppData\Local\Temp\A227.tmp"79⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"81⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"82⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\A340.tmp"C:\Users\Admin\AppData\Local\Temp\A340.tmp"83⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"84⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\A3DC.tmp"C:\Users\Admin\AppData\Local\Temp\A3DC.tmp"85⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\A42A.tmp"C:\Users\Admin\AppData\Local\Temp\A42A.tmp"86⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\A478.tmp"C:\Users\Admin\AppData\Local\Temp\A478.tmp"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"88⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\A553.tmp"C:\Users\Admin\AppData\Local\Temp\A553.tmp"90⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"91⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"92⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"93⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\A66C.tmp"C:\Users\Admin\AppData\Local\Temp\A66C.tmp"94⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"95⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"96⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"97⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\A786.tmp"C:\Users\Admin\AppData\Local\Temp\A786.tmp"98⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"C:\Users\Admin\AppData\Local\Temp\A7D4.tmp"99⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"100⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A870.tmp"C:\Users\Admin\AppData\Local\Temp\A870.tmp"101⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"102⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"103⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\A94B.tmp"C:\Users\Admin\AppData\Local\Temp\A94B.tmp"104⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\A999.tmp"C:\Users\Admin\AppData\Local\Temp\A999.tmp"105⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"106⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\AA26.tmp"C:\Users\Admin\AppData\Local\Temp\AA26.tmp"107⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"108⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"C:\Users\Admin\AppData\Local\Temp\AAB2.tmp"109⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\AB00.tmp"C:\Users\Admin\AppData\Local\Temp\AB00.tmp"110⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"111⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"112⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"113⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"C:\Users\Admin\AppData\Local\Temp\AC1A.tmp"114⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\AC68.tmp"C:\Users\Admin\AppData\Local\Temp\AC68.tmp"115⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"116⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\AD04.tmp"C:\Users\Admin\AppData\Local\Temp\AD04.tmp"117⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"118⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"119⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"120⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"121⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"122⤵PID:3160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-