Analysis
- max time kernel
121s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_96e0137984155f09d57f2dbd7c3c83f6_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_96e0137984155f09d57f2dbd7c3c83f6_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-10_96e0137984155f09d57f2dbd7c3c83f6_elex_mafia.exe
- Size 524KB
- Sample260710-v6ceqsgs2x
- SHA256 92b35ae91483ed9ff46428a87e4077456814e7b2a58ecfea7857e061d5f7b968
- MD5 96e0137984155f09d57f2dbd7c3c83f6
- SHA1 e610aeb255106bf4ffef23517f66aa6b37754870
- SHA512 0dc3c99910c7aafde7bf1bdc00585f2fd563e1962abe68146cbd4f97c5e86bd34e11c10911f14917c8e0214810538c99664606b2fe7f70f021facef48d232710
- SSDEEP 12288:TRyZzqyL66T1y7Ypb5KEyqW7MRJe/nNZ:TRyQylTqYpNPyqW7KiN
- TLSH T108B4F116B584C032F6D215768E69EB625C3A7C756B2AA4C73BC426AD2FF13C1D27430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4184 4B38.tmp 4156 4C03.tmp 5840 4D4B.tmp 4708 4E84.tmp 3248 4F6E.tmp 5004 5087.tmp 3212 51B0.tmp 2372 528B.tmp 3524 5356.tmp 4584 5440.tmp 1220 554A.tmp 4336 5654.tmp 1600 575D.tmp 1792 5877.tmp 5828 5951.tmp 1480 5A2C.tmp 5820 5B16.tmp 6100 5BE2.tmp 3276 5CAD.tmp 4888 5D87.tmp 5904 5E91.tmp 6040 5F7B.tmp 3440 6085.tmp 1736 616F.tmp 4256 623B.tmp 4304 6335.tmp 4244 642F.tmp 2960 6557.tmp 3508 6671.tmp 2760 676B.tmp 1748 6845.tmp 3236 697E.tmp 3776 6A88.tmp 5288 6B14.tmp 2596 6BDF.tmp 1760 6C9B.tmp 1948 6D85.tmp 4432 6E70.tmp 3164 6F5A.tmp 1708 7025.tmp 3144 712F.tmp 2388 71DB.tmp 1868 72B5.tmp 3728 73A0.tmp 6108 746B.tmp 3840 7555.tmp 1368 7640.tmp 2448 771A.tmp 5400 77A7.tmp 5408 7843.tmp 928 78DF.tmp 1588 795C.tmp 4380 79E9.tmp 5116 7A76.tmp 5324 7B02.tmp 3804 7B7F.tmp 1856 7C0C.tmp 3332 7C99.tmp 2772 7D44.tmp 4660 7DE1.tmp 2568 7E6D.tmp 1152 7F0A.tmp 4224 7F96.tmp 5664 8032.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B00C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 697E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 498D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C55A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F74.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 4184 4948 2026-07-10_96e0137984155f09d57f2dbd7c3c83f6_elex_mafia.exe 89 PID 4184 wrote to memory of 4156 4184 4B38.tmp 90 PID 4156 wrote to memory of 5840 4156 4C03.tmp 91 PID 5840 wrote to memory of 4708 5840 4D4B.tmp 92 PID 4708 wrote to memory of 3248 4708 4E84.tmp 93 PID 3248 wrote to memory of 5004 3248 4F6E.tmp 94 PID 5004 wrote to memory of 3212 5004 5087.tmp 95 PID 3212 wrote to memory of 2372 3212 51B0.tmp 96 PID 2372 wrote to memory of 3524 2372 528B.tmp 97 PID 3524 wrote to memory of 4584 3524 5356.tmp 98 PID 4584 wrote to memory of 1220 4584 5440.tmp 99 PID 1220 wrote to memory of 4336 1220 554A.tmp 100 PID 4336 wrote to memory of 1600 4336 5654.tmp 101 PID 1600 wrote to memory of 1792 1600 575D.tmp 102 PID 1792 wrote to memory of 5828 1792 5877.tmp 103 PID 5828 wrote to memory of 1480 5828 5951.tmp 104 PID 1480 wrote to memory of 5820 1480 5A2C.tmp 105 PID 5820 wrote to memory of 6100 5820 5B16.tmp 106 PID 6100 wrote to memory of 3276 6100 5BE2.tmp 107 PID 3276 wrote to memory of 4888 3276 5CAD.tmp 108 PID 4888 wrote to memory of 5904 4888 5D87.tmp 109 PID 5904 wrote to memory of 6040 5904 5E91.tmp 110 PID 6040 wrote to memory of 3440 6040 5F7B.tmp 111 PID 3440 wrote to memory of 1736 3440 6085.tmp 112 PID 1736 wrote to memory of 4256 1736 616F.tmp 113 PID 4256 wrote to memory of 4304 4256 623B.tmp 114 PID 4304 wrote to memory of 4244 4304 6335.tmp 115 PID 4244 wrote to memory of 2960 4244 642F.tmp 116 PID 2960 wrote to memory of 3508 2960 6557.tmp 117 PID 3508 wrote to memory of 2760 3508 6671.tmp 118 PID 2760 wrote to memory of 1748 2760 676B.tmp 119 PID 1748 wrote to memory of 3236 1748 6845.tmp 120 PID 3236 wrote to memory of 3776 3236 697E.tmp 121 PID 3776 wrote to memory of 5288 3776 6A88.tmp 122 PID 5288 wrote to memory of 2596 5288 6B14.tmp 123 PID 2596 wrote to memory of 1760 2596 6BDF.tmp 124 PID 1760 wrote to memory of 1948 1760 6C9B.tmp 125 PID 1948 wrote to memory of 4432 1948 6D85.tmp 126 PID 4432 wrote to memory of 3164 4432 6E70.tmp 127 PID 3164 wrote to memory of 1708 3164 6F5A.tmp 128 PID 1708 wrote to memory of 3144 1708 7025.tmp 129 PID 3144 wrote to memory of 2388 3144 712F.tmp 130 PID 2388 wrote to memory of 1868 2388 71DB.tmp 131 PID 1868 wrote to memory of 3728 1868 72B5.tmp 132 PID 3728 wrote to memory of 6108 3728 73A0.tmp 133 PID 6108 wrote to memory of 3840 6108 746B.tmp 134 PID 3840 wrote to memory of 1368 3840 7555.tmp 135 PID 1368 wrote to memory of 2448 1368 7640.tmp 136 PID 2448 wrote to memory of 5400 2448 771A.tmp 137 PID 5400 wrote to memory of 5408 5400 77A7.tmp 138 PID 5408 wrote to memory of 928 5408 7843.tmp 139 PID 928 wrote to memory of 1588 928 78DF.tmp 140 PID 1588 wrote to memory of 4380 1588 795C.tmp 141 PID 4380 wrote to memory of 5116 4380 79E9.tmp 142 PID 5116 wrote to memory of 5324 5116 7A76.tmp 143 PID 5324 wrote to memory of 3804 5324 7B02.tmp 144 PID 3804 wrote to memory of 1856 3804 7B7F.tmp 145 PID 1856 wrote to memory of 3332 1856 7C0C.tmp 146 PID 3332 wrote to memory of 2772 3332 7C99.tmp 147 PID 2772 wrote to memory of 4660 2772 7D44.tmp 148 PID 4660 wrote to memory of 2568 4660 7DE1.tmp 149 PID 2568 wrote to memory of 1152 2568 7E6D.tmp 150 PID 1152 wrote to memory of 4224 1152 7F0A.tmp 151 PID 4224 wrote to memory of 5664 4224 7F96.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_96e0137984155f09d57f2dbd7c3c83f6_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_96e0137984155f09d57f2dbd7c3c83f6_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\4E84.tmp"C:\Users\Admin\AppData\Local\Temp\4E84.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\51B0.tmp"C:\Users\Admin\AppData\Local\Temp\51B0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\528B.tmp"C:\Users\Admin\AppData\Local\Temp\528B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5356.tmp"C:\Users\Admin\AppData\Local\Temp\5356.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\575D.tmp"C:\Users\Admin\AppData\Local\Temp\575D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\5A2C.tmp"C:\Users\Admin\AppData\Local\Temp\5A2C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\5D87.tmp"C:\Users\Admin\AppData\Local\Temp\5D87.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\5E91.tmp"C:\Users\Admin\AppData\Local\Temp\5E91.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6335.tmp"C:\Users\Admin\AppData\Local\Temp\6335.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6D85.tmp"C:\Users\Admin\AppData\Local\Temp\6D85.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\72B5.tmp"C:\Users\Admin\AppData\Local\Temp\72B5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\795C.tmp"C:\Users\Admin\AppData\Local\Temp\795C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\79E9.tmp"C:\Users\Admin\AppData\Local\Temp\79E9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\7B02.tmp"C:\Users\Admin\AppData\Local\Temp\7B02.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\7D44.tmp"C:\Users\Admin\AppData\Local\Temp\7D44.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"C:\Users\Admin\AppData\Local\Temp\7DE1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\7F96.tmp"C:\Users\Admin\AppData\Local\Temp\7F96.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\8032.tmp"C:\Users\Admin\AppData\Local\Temp\8032.tmp"65⤵
- Executes dropped EXE
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\80DE.tmp"C:\Users\Admin\AppData\Local\Temp\80DE.tmp"66⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\816B.tmp"C:\Users\Admin\AppData\Local\Temp\816B.tmp"67⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\81E8.tmp"C:\Users\Admin\AppData\Local\Temp\81E8.tmp"68⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"69⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"70⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"71⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8449.tmp"C:\Users\Admin\AppData\Local\Temp\8449.tmp"73⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"74⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"75⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"76⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"77⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"78⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"79⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"80⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\888F.tmp"C:\Users\Admin\AppData\Local\Temp\888F.tmp"81⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"82⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"84⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"85⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"86⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"87⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"88⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"89⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"90⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"91⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"92⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\8ED8.tmp"C:\Users\Admin\AppData\Local\Temp\8ED8.tmp"93⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"94⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"95⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\906F.tmp"C:\Users\Admin\AppData\Local\Temp\906F.tmp"96⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\90EC.tmp"C:\Users\Admin\AppData\Local\Temp\90EC.tmp"97⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\9178.tmp"C:\Users\Admin\AppData\Local\Temp\9178.tmp"98⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"99⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"100⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"101⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"102⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"103⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\94C4.tmp"C:\Users\Admin\AppData\Local\Temp\94C4.tmp"104⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"105⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\965A.tmp"C:\Users\Admin\AppData\Local\Temp\965A.tmp"107⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"108⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"109⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"110⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"111⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"112⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\9987.tmp"C:\Users\Admin\AppData\Local\Temp\9987.tmp"113⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"114⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"115⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"116⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"117⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\9C17.tmp"C:\Users\Admin\AppData\Local\Temp\9C17.tmp"118⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"119⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"120⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"C:\Users\Admin\AppData\Local\Temp\9DAD.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"C:\Users\Admin\AppData\Local\Temp\9E3A.tmp"122⤵PID:5456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-