Analysis
- max time kernel
126s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_1ac73b95778c1b34c55d1c2ca244b72c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_1ac73b95778c1b34c55d1c2ca244b72c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_1ac73b95778c1b34c55d1c2ca244b72c_elex_mafia.exe
- Size 520KB
- Sample260801-bhny3styft
- SHA256 78647de090792adfaf50d366df57fc9513eea6ea2878d6b98b61347c693acda0
- MD5 1ac73b95778c1b34c55d1c2ca244b72c
- SHA1 cdd0091c875665541d54a63c7940f3aa777b8f03
- SHA512 4ee379e87d1d9398f1b22c2678221c37fe281644c30e34bc58a5330b2c62144f2264496188324ed6b8116a20cbd53e82b7d9dd0e1cfb08a6138d317432b4c416
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLceGWYOJTjO7urpzDhWU9cOq7ZaxKy7666KLLT:roRXOQjmOyxYsTZVMGq7AF37L7L7NZ
- TLSH T1B2B4F022B184C032E5D666304B26DF614B7EBD774B2696C73B803A6D6FF12D1E634346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3364 E565.tmp 1512 E64F.tmp 1356 E6FB.tmp 3684 E7D6.tmp 3500 E8B0.tmp 3396 E93D.tmp 4012 E9E9.tmp 5660 EA95.tmp 4116 EB8F.tmp 4564 EC5A.tmp 124 ECD7.tmp 1532 ED73.tmp 3512 EE1F.tmp 6048 EEEA.tmp 3044 EF86.tmp 5100 F032.tmp 5468 F0FD.tmp 5096 F1C9.tmp 2524 F274.tmp 2092 F301.tmp 1144 F39D.tmp 6056 F449.tmp 4272 F4E5.tmp 3456 F591.tmp 3320 F61E.tmp 2836 F6D9.tmp 2388 F7C4.tmp 4976 F89F.tmp 5700 F93B.tmp 1188 F9C7.tmp 2932 FA64.tmp 3132 FB2F.tmp 5340 FBBB.tmp 3008 FC48.tmp 4168 FCC5.tmp 5040 FD42.tmp 5572 FDAF.tmp 3544 FE2C.tmp 4780 FE9A.tmp 6008 FEF8.tmp 4240 FF75.tmp 1332 FFE2.tmp 5372 7E.tmp 6088 11A.tmp 5852 1B7.tmp 1816 234.tmp 5896 2C0.tmp 4916 32E.tmp 4856 3DA.tmp 1156 457.tmp 1704 4B4.tmp 2768 541.tmp 6016 5AE.tmp 1824 63B.tmp 2424 6C8.tmp 3276 754.tmp 5368 7F0.tmp 1152 85E.tmp 2812 90A.tmp 2952 996.tmp 4200 A13.tmp 4620 AB0.tmp 792 B1D.tmp 4188 BAA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 572A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B046.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 411C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B794.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4216.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C86D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B74B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 182D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C370.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 920B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B94F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B32F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3758.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5088 wrote to memory of 3364 5088 2026-08-01_1ac73b95778c1b34c55d1c2ca244b72c_elex_mafia.exe 88 PID 3364 wrote to memory of 1512 3364 E565.tmp 89 PID 1512 wrote to memory of 1356 1512 E64F.tmp 90 PID 1356 wrote to memory of 3684 1356 E6FB.tmp 91 PID 3684 wrote to memory of 3500 3684 E7D6.tmp 92 PID 3500 wrote to memory of 3396 3500 E8B0.tmp 93 PID 3396 wrote to memory of 4012 3396 E93D.tmp 94 PID 4012 wrote to memory of 5660 4012 E9E9.tmp 95 PID 5660 wrote to memory of 4116 5660 EA95.tmp 96 PID 4116 wrote to memory of 4564 4116 EB8F.tmp 97 PID 4564 wrote to memory of 124 4564 EC5A.tmp 98 PID 124 wrote to memory of 1532 124 ECD7.tmp 99 PID 1532 wrote to memory of 3512 1532 ED73.tmp 100 PID 3512 wrote to memory of 6048 3512 EE1F.tmp 101 PID 6048 wrote to memory of 3044 6048 EEEA.tmp 102 PID 3044 wrote to memory of 5100 3044 EF86.tmp 103 PID 5100 wrote to memory of 5468 5100 F032.tmp 104 PID 5468 wrote to memory of 5096 5468 F0FD.tmp 105 PID 5096 wrote to memory of 2524 5096 F1C9.tmp 106 PID 2524 wrote to memory of 2092 2524 F274.tmp 107 PID 2092 wrote to memory of 1144 2092 F301.tmp 108 PID 1144 wrote to memory of 6056 1144 F39D.tmp 109 PID 6056 wrote to memory of 4272 6056 F449.tmp 110 PID 4272 wrote to memory of 3456 4272 F4E5.tmp 111 PID 3456 wrote to memory of 3320 3456 F591.tmp 112 PID 3320 wrote to memory of 2836 3320 F61E.tmp 113 PID 2836 wrote to memory of 2388 2836 F6D9.tmp 114 PID 2388 wrote to memory of 4976 2388 F7C4.tmp 115 PID 4976 wrote to memory of 5700 4976 F89F.tmp 116 PID 5700 wrote to memory of 1188 5700 F93B.tmp 117 PID 1188 wrote to memory of 2932 1188 F9C7.tmp 118 PID 2932 wrote to memory of 3132 2932 FA64.tmp 119 PID 3132 wrote to memory of 5340 3132 FB2F.tmp 120 PID 5340 wrote to memory of 3008 5340 FBBB.tmp 121 PID 3008 wrote to memory of 4168 3008 FC48.tmp 122 PID 4168 wrote to memory of 5040 4168 FCC5.tmp 123 PID 5040 wrote to memory of 5572 5040 FD42.tmp 124 PID 5572 wrote to memory of 3544 5572 FDAF.tmp 125 PID 3544 wrote to memory of 4780 3544 FE2C.tmp 126 PID 4780 wrote to memory of 6008 4780 FE9A.tmp 127 PID 6008 wrote to memory of 4240 6008 FEF8.tmp 128 PID 4240 wrote to memory of 1332 4240 FF75.tmp 129 PID 1332 wrote to memory of 5372 1332 FFE2.tmp 130 PID 5372 wrote to memory of 6088 5372 7E.tmp 131 PID 6088 wrote to memory of 5852 6088 11A.tmp 132 PID 5852 wrote to memory of 1816 5852 1B7.tmp 133 PID 1816 wrote to memory of 5896 1816 234.tmp 134 PID 5896 wrote to memory of 4916 5896 2C0.tmp 135 PID 4916 wrote to memory of 4856 4916 32E.tmp 136 PID 4856 wrote to memory of 1156 4856 3DA.tmp 137 PID 1156 wrote to memory of 1704 1156 457.tmp 138 PID 1704 wrote to memory of 2768 1704 4B4.tmp 139 PID 2768 wrote to memory of 6016 2768 541.tmp 140 PID 6016 wrote to memory of 1824 6016 5AE.tmp 141 PID 1824 wrote to memory of 2424 1824 63B.tmp 142 PID 2424 wrote to memory of 3276 2424 6C8.tmp 143 PID 3276 wrote to memory of 5368 3276 754.tmp 144 PID 5368 wrote to memory of 1152 5368 7F0.tmp 145 PID 1152 wrote to memory of 2812 1152 85E.tmp 146 PID 2812 wrote to memory of 2952 2812 90A.tmp 147 PID 2952 wrote to memory of 4200 2952 996.tmp 148 PID 4200 wrote to memory of 4620 4200 A13.tmp 149 PID 4620 wrote to memory of 792 4620 AB0.tmp 150 PID 792 wrote to memory of 4188 792 B1D.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_1ac73b95778c1b34c55d1c2ca244b72c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_1ac73b95778c1b34c55d1c2ca244b72c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"C:\Users\Admin\AppData\Local\Temp\E8B0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F032.tmp"C:\Users\Admin\AppData\Local\Temp\F032.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"C:\Users\Admin\AppData\Local\Temp\F0FD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\F1C9.tmp"C:\Users\Admin\AppData\Local\Temp\F1C9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\F274.tmp"C:\Users\Admin\AppData\Local\Temp\F274.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\F39D.tmp"C:\Users\Admin\AppData\Local\Temp\F39D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\F591.tmp"C:\Users\Admin\AppData\Local\Temp\F591.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\F61E.tmp"C:\Users\Admin\AppData\Local\Temp\F61E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\F89F.tmp"C:\Users\Admin\AppData\Local\Temp\F89F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\FA64.tmp"C:\Users\Admin\AppData\Local\Temp\FA64.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\FF75.tmp"C:\Users\Admin\AppData\Local\Temp\FF75.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\1B7.tmp"C:\Users\Admin\AppData\Local\Temp\1B7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\234.tmp"C:\Users\Admin\AppData\Local\Temp\234.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\2C0.tmp"C:\Users\Admin\AppData\Local\Temp\2C0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\32E.tmp"C:\Users\Admin\AppData\Local\Temp\32E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3DA.tmp"C:\Users\Admin\AppData\Local\Temp\3DA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\457.tmp"C:\Users\Admin\AppData\Local\Temp\457.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\541.tmp"C:\Users\Admin\AppData\Local\Temp\541.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\63B.tmp"C:\Users\Admin\AppData\Local\Temp\63B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\6C8.tmp"C:\Users\Admin\AppData\Local\Temp\6C8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\7F0.tmp"C:\Users\Admin\AppData\Local\Temp\7F0.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\996.tmp"C:\Users\Admin\AppData\Local\Temp\996.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"65⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"66⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"67⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"68⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"69⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"70⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\EF5.tmp"C:\Users\Admin\AppData\Local\Temp\EF5.tmp"71⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"72⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"73⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"74⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"75⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"76⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\11F3.tmp"C:\Users\Admin\AppData\Local\Temp\11F3.tmp"77⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"78⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"79⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\136A.tmp"C:\Users\Admin\AppData\Local\Temp\136A.tmp"80⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\13D7.tmp"C:\Users\Admin\AppData\Local\Temp\13D7.tmp"81⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"82⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\14C2.tmp"C:\Users\Admin\AppData\Local\Temp\14C2.tmp"83⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\153F.tmp"C:\Users\Admin\AppData\Local\Temp\153F.tmp"84⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\15AC.tmp"C:\Users\Admin\AppData\Local\Temp\15AC.tmp"85⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1639.tmp"C:\Users\Admin\AppData\Local\Temp\1639.tmp"86⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\16A6.tmp"C:\Users\Admin\AppData\Local\Temp\16A6.tmp"87⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\1733.tmp"C:\Users\Admin\AppData\Local\Temp\1733.tmp"88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\17B0.tmp"C:\Users\Admin\AppData\Local\Temp\17B0.tmp"89⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\18AA.tmp"C:\Users\Admin\AppData\Local\Temp\18AA.tmp"91⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1927.tmp"C:\Users\Admin\AppData\Local\Temp\1927.tmp"92⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\19D3.tmp"C:\Users\Admin\AppData\Local\Temp\19D3.tmp"93⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"94⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"95⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"96⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"97⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1C44.tmp"C:\Users\Admin\AppData\Local\Temp\1C44.tmp"98⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"99⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"100⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"101⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"103⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"104⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"105⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\207A.tmp"C:\Users\Admin\AppData\Local\Temp\207A.tmp"106⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"107⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"109⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\227D.tmp"C:\Users\Admin\AppData\Local\Temp\227D.tmp"110⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\22FA.tmp"C:\Users\Admin\AppData\Local\Temp\22FA.tmp"111⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"112⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"113⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"114⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"115⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"116⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\2675.tmp"C:\Users\Admin\AppData\Local\Temp\2675.tmp"117⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"118⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"119⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\280B.tmp"C:\Users\Admin\AppData\Local\Temp\280B.tmp"120⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\28C7.tmp"C:\Users\Admin\AppData\Local\Temp\28C7.tmp"121⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"122⤵PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-