Analysis
- max time kernel
118s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_ee2f06541f4c60bea93ecb5e67a9797d_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_ee2f06541f4c60bea93ecb5e67a9797d_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-07_ee2f06541f4c60bea93ecb5e67a9797d_elex_mafia.exe
- Size 520KB
- Sample260807-b4d11add82
- SHA256 523b5f0bdc8a0781ffa028d5ab89d7e1d9920090400a207b29ddf81941d11990
- MD5 ee2f06541f4c60bea93ecb5e67a9797d
- SHA1 09ec15e40ac9d7e0b0d1140801c89e74939221d2
- SHA512 67f759214a9311a6c3ba5ff9d536c4e0430704605cfe86090ee339c863af2669b54adadbb25c068bfa1f8423deefaf5c569dfdab30d35232d59449b3cba784e3
- SSDEEP 12288:gj8fuxR21t5i8f5ZWlvtmSevLHsqEIPoxTU0NZ:gj8fuK1GYilvQxvLMqem0N
- TLSH T15EB4F112B945C032E5E606304A56DBA11BBE7C75977A94C73BC03AAD7EB52C1E73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 916 DA87.tmp 2356 DB43.tmp 5988 DC5C.tmp 1356 DD95.tmp 1224 DE50.tmp 2536 DEEC.tmp 4412 DFA8.tmp 4064 E035.tmp 1284 E100.tmp 3920 E18C.tmp 4056 E209.tmp 2756 E2D4.tmp 1572 E380.tmp 4864 E41D.tmp 5404 E4A9.tmp 5024 E565.tmp 3192 E611.tmp 1748 E6CC.tmp 1420 E749.tmp 4084 E7D6.tmp 2820 E862.tmp 2096 E8EF.tmp 1464 E9D9.tmp 6020 EA56.tmp 1820 EB12.tmp 1380 EBAE.tmp 2092 EC3B.tmp 5132 ECC7.tmp 5940 ED54.tmp 5168 EE2F.tmp 5388 EEDB.tmp 5448 EF58.tmp 4548 F003.tmp 248 F080.tmp 2132 F10D.tmp 2020 F19A.tmp 2540 F236.tmp 3756 F2D2.tmp 3564 F34F.tmp 3396 F3CC.tmp 1992 F459.tmp 5156 F4C6.tmp 6060 F543.tmp 1052 F5B1.tmp 5648 F64D.tmp 6128 F6D9.tmp 2468 F795.tmp 5100 F812.tmp 2900 F88F.tmp 1316 F91C.tmp 5780 F9A8.tmp 2040 FA35.tmp 4592 FAB2.tmp 5516 FB1F.tmp 5428 FB8D.tmp 956 FC19.tmp 2996 FCA6.tmp 5760 FD52.tmp 2508 FDEE.tmp 2492 FE7B.tmp 4964 FF26.tmp 4896 FFA3.tmp 4756 40.tmp 6116 AD.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 328B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 852A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9612.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 487F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 984A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 257B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60DE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4832 wrote to memory of 916 4832 2026-08-07_ee2f06541f4c60bea93ecb5e67a9797d_elex_mafia.exe 88 PID 916 wrote to memory of 2356 916 DA87.tmp 89 PID 2356 wrote to memory of 5988 2356 DB43.tmp 90 PID 5988 wrote to memory of 1356 5988 DC5C.tmp 91 PID 1356 wrote to memory of 1224 1356 DD95.tmp 92 PID 1224 wrote to memory of 2536 1224 DE50.tmp 93 PID 2536 wrote to memory of 4412 2536 DEEC.tmp 94 PID 4412 wrote to memory of 4064 4412 DFA8.tmp 95 PID 4064 wrote to memory of 1284 4064 E035.tmp 96 PID 1284 wrote to memory of 3920 1284 E100.tmp 97 PID 3920 wrote to memory of 4056 3920 E18C.tmp 98 PID 4056 wrote to memory of 2756 4056 E209.tmp 99 PID 2756 wrote to memory of 1572 2756 E2D4.tmp 100 PID 1572 wrote to memory of 4864 1572 E380.tmp 101 PID 4864 wrote to memory of 5404 4864 E41D.tmp 102 PID 5404 wrote to memory of 5024 5404 E4A9.tmp 103 PID 5024 wrote to memory of 3192 5024 E565.tmp 104 PID 3192 wrote to memory of 1748 3192 E611.tmp 105 PID 1748 wrote to memory of 1420 1748 E6CC.tmp 106 PID 1420 wrote to memory of 4084 1420 E749.tmp 107 PID 4084 wrote to memory of 2820 4084 E7D6.tmp 108 PID 2820 wrote to memory of 2096 2820 E862.tmp 109 PID 2096 wrote to memory of 1464 2096 E8EF.tmp 110 PID 1464 wrote to memory of 6020 1464 E9D9.tmp 111 PID 6020 wrote to memory of 1820 6020 EA56.tmp 112 PID 1820 wrote to memory of 1380 1820 EB12.tmp 113 PID 1380 wrote to memory of 2092 1380 EBAE.tmp 114 PID 2092 wrote to memory of 5132 2092 EC3B.tmp 115 PID 5132 wrote to memory of 5940 5132 ECC7.tmp 116 PID 5940 wrote to memory of 5168 5940 ED54.tmp 117 PID 5168 wrote to memory of 5388 5168 EE2F.tmp 118 PID 5388 wrote to memory of 5448 5388 EEDB.tmp 119 PID 5448 wrote to memory of 4548 5448 EF58.tmp 120 PID 4548 wrote to memory of 248 4548 F003.tmp 121 PID 248 wrote to memory of 2132 248 F080.tmp 122 PID 2132 wrote to memory of 2020 2132 F10D.tmp 123 PID 2020 wrote to memory of 2540 2020 F19A.tmp 124 PID 2540 wrote to memory of 3756 2540 F236.tmp 125 PID 3756 wrote to memory of 3564 3756 F2D2.tmp 126 PID 3564 wrote to memory of 3396 3564 F34F.tmp 127 PID 3396 wrote to memory of 1992 3396 F3CC.tmp 128 PID 1992 wrote to memory of 5156 1992 F459.tmp 129 PID 5156 wrote to memory of 6060 5156 F4C6.tmp 130 PID 6060 wrote to memory of 1052 6060 F543.tmp 131 PID 1052 wrote to memory of 5648 1052 F5B1.tmp 132 PID 5648 wrote to memory of 6128 5648 F64D.tmp 133 PID 6128 wrote to memory of 2468 6128 F6D9.tmp 134 PID 2468 wrote to memory of 5100 2468 F795.tmp 135 PID 5100 wrote to memory of 2900 5100 F812.tmp 136 PID 2900 wrote to memory of 1316 2900 F88F.tmp 137 PID 1316 wrote to memory of 5780 1316 F91C.tmp 138 PID 5780 wrote to memory of 2040 5780 F9A8.tmp 139 PID 2040 wrote to memory of 4592 2040 FA35.tmp 140 PID 4592 wrote to memory of 5516 4592 FAB2.tmp 141 PID 5516 wrote to memory of 5428 5516 FB1F.tmp 142 PID 5428 wrote to memory of 956 5428 FB8D.tmp 143 PID 956 wrote to memory of 2996 956 FC19.tmp 144 PID 2996 wrote to memory of 5760 2996 FCA6.tmp 145 PID 5760 wrote to memory of 2508 5760 FD52.tmp 146 PID 2508 wrote to memory of 2492 2508 FDEE.tmp 147 PID 2492 wrote to memory of 4964 2492 FE7B.tmp 148 PID 4964 wrote to memory of 4896 4964 FF26.tmp 149 PID 4896 wrote to memory of 4756 4896 FFA3.tmp 150 PID 4756 wrote to memory of 6116 4756 40.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ee2f06541f4c60bea93ecb5e67a9797d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ee2f06541f4c60bea93ecb5e67a9797d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"C:\Users\Admin\AppData\Local\Temp\DC5C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\DD95.tmp"C:\Users\Admin\AppData\Local\Temp\DD95.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\DE50.tmp"C:\Users\Admin\AppData\Local\Temp\DE50.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEEC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\E2D4.tmp"C:\Users\Admin\AppData\Local\Temp\E2D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\E41D.tmp"C:\Users\Admin\AppData\Local\Temp\E41D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"C:\Users\Admin\AppData\Local\Temp\E4A9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E749.tmp"C:\Users\Admin\AppData\Local\Temp\E749.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\EA56.tmp"C:\Users\Admin\AppData\Local\Temp\EA56.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\F10D.tmp"C:\Users\Admin\AppData\Local\Temp\F10D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\F34F.tmp"C:\Users\Admin\AppData\Local\Temp\F34F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\F459.tmp"C:\Users\Admin\AppData\Local\Temp\F459.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"C:\Users\Admin\AppData\Local\Temp\F4C6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\F64D.tmp"C:\Users\Admin\AppData\Local\Temp\F64D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"C:\Users\Admin\AppData\Local\Temp\F6D9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\F812.tmp"C:\Users\Admin\AppData\Local\Temp\F812.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"C:\Users\Admin\AppData\Local\Temp\F9A8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\FA35.tmp"C:\Users\Admin\AppData\Local\Temp\FA35.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"C:\Users\Admin\AppData\Local\Temp\FB8D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\FC19.tmp"C:\Users\Admin\AppData\Local\Temp\FC19.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\AD.tmp"C:\Users\Admin\AppData\Local\Temp\AD.tmp"65⤵
- Executes dropped EXE
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"68⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\2EF.tmp"C:\Users\Admin\AppData\Local\Temp\2EF.tmp"69⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\37C.tmp"C:\Users\Admin\AppData\Local\Temp\37C.tmp"70⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3F9.tmp"C:\Users\Admin\AppData\Local\Temp\3F9.tmp"71⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\495.tmp"C:\Users\Admin\AppData\Local\Temp\495.tmp"72⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"74⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"75⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6B8.tmp"C:\Users\Admin\AppData\Local\Temp\6B8.tmp"76⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\735.tmp"C:\Users\Admin\AppData\Local\Temp\735.tmp"77⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\7D1.tmp"C:\Users\Admin\AppData\Local\Temp\7D1.tmp"78⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\84E.tmp"C:\Users\Admin\AppData\Local\Temp\84E.tmp"79⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"80⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"81⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"82⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\ABF.tmp"C:\Users\Admin\AppData\Local\Temp\ABF.tmp"83⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\B3C.tmp"C:\Users\Admin\AppData\Local\Temp\B3C.tmp"84⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\BB9.tmp"C:\Users\Admin\AppData\Local\Temp\BB9.tmp"85⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\C55.tmp"C:\Users\Admin\AppData\Local\Temp\C55.tmp"86⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"87⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"88⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\E1B.tmp"C:\Users\Admin\AppData\Local\Temp\E1B.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"90⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"91⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"92⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"93⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\10E9.tmp"C:\Users\Admin\AppData\Local\Temp\10E9.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\1166.tmp"C:\Users\Admin\AppData\Local\Temp\1166.tmp"95⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\11E3.tmp"C:\Users\Admin\AppData\Local\Temp\11E3.tmp"96⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\1280.tmp"C:\Users\Admin\AppData\Local\Temp\1280.tmp"97⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\12ED.tmp"C:\Users\Admin\AppData\Local\Temp\12ED.tmp"98⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\137A.tmp"C:\Users\Admin\AppData\Local\Temp\137A.tmp"99⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\13E7.tmp"C:\Users\Admin\AppData\Local\Temp\13E7.tmp"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"101⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\1500.tmp"C:\Users\Admin\AppData\Local\Temp\1500.tmp"102⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"103⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"105⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"106⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\1781.tmp"C:\Users\Admin\AppData\Local\Temp\1781.tmp"107⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"108⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\188A.tmp"C:\Users\Admin\AppData\Local\Temp\188A.tmp"109⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\1927.tmp"C:\Users\Admin\AppData\Local\Temp\1927.tmp"110⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"111⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"112⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"113⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"114⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"115⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\1C44.tmp"C:\Users\Admin\AppData\Local\Temp\1C44.tmp"116⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"117⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"118⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"119⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\1E38.tmp"C:\Users\Admin\AppData\Local\Temp\1E38.tmp"120⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"121⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"122⤵PID:4744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-