Analysis
- max time kernel
130s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 13:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_fdd3ceca3846638f8370919853d92198_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_fdd3ceca3846638f8370919853d92198_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_fdd3ceca3846638f8370919853d92198_elex_mafia.exe
- Size 524KB
- Sample260809-qlel5sae77
- SHA256 f72e04b3f38f1e48147174b9363f04f9f67756a7036a4e619e5f088e96ae1557
- MD5 fdd3ceca3846638f8370919853d92198
- SHA1 a7dc8914059499d3defa832c90508b1c215bfe10
- SHA512 900b7e7d62760f13d4dcbc5f8529d6bb26ab06e42788a2218a596dd8354826b84e008da17649f7f2139ca5f2f52ccae9c23c0dbf19a4e3a61559a294fa1b3a47
- SSDEEP 12288:TRyZzqyL66TMl1YmO6M2/deDVhq4ZT8qNZ:TRyQylTkI2/dahq4+qN
- TLSH T1BCB4F0157944C032E5A201358F26EB62997B7C71AB27A4C73BD0366E6FF13D1A6B8307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3992 4632.tmp 2696 475B.tmp 1748 48F1.tmp 2860 4A2A.tmp 4156 4A97.tmp 4388 4BCF.tmp 4752 4D18.tmp 5172 4DD3.tmp 5712 4EAE.tmp 1348 4F79.tmp 1576 50A2.tmp 5968 517D.tmp 5764 5277.tmp 4036 539F.tmp 3820 547A.tmp 3592 5574.tmp 2312 565F.tmp 4208 5787.tmp 6036 5862.tmp 3060 59BA.tmp 5964 5AC4.tmp 3884 5BCD.tmp 4452 5CF6.tmp 5088 5DE0.tmp 676 5EEA.tmp 2700 5FC5.tmp 4708 60EE.tmp 4084 61B9.tmp 4604 6274.tmp 4948 635F.tmp 4296 6468.tmp 4964 6572.tmp 5028 664D.tmp 2936 66F9.tmp 2780 6795.tmp 1268 6821.tmp 980 68BE.tmp 1436 6979.tmp 3248 6A25.tmp 6080 6AF0.tmp 1104 6B9C.tmp 620 6C58.tmp 2896 6D23.tmp 2888 6DEE.tmp 5408 6EB9.tmp 2472 6F55.tmp 5056 6FD2.tmp 3476 705F.tmp 5820 70DC.tmp 5308 7149.tmp 4852 71C6.tmp 5024 7243.tmp 2564 72B1.tmp 6064 732E.tmp 4072 73BA.tmp 5316 7428.tmp 5900 7495.tmp 832 7512.tmp 8 758F.tmp 5952 760C.tmp 4176 7689.tmp 4476 76F6.tmp 5844 7783.tmp 2872 7800.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D58C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D39D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1266.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E78E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2032.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 404C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A68D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 437E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 851B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F28A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1CF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 3992 3412 2026-08-09_fdd3ceca3846638f8370919853d92198_elex_mafia.exe 90 PID 3992 wrote to memory of 2696 3992 4632.tmp 91 PID 2696 wrote to memory of 1748 2696 475B.tmp 92 PID 1748 wrote to memory of 2860 1748 48F1.tmp 93 PID 2860 wrote to memory of 4156 2860 4A2A.tmp 94 PID 4156 wrote to memory of 4388 4156 4A97.tmp 95 PID 4388 wrote to memory of 4752 4388 4BCF.tmp 96 PID 4752 wrote to memory of 5172 4752 4D18.tmp 97 PID 5172 wrote to memory of 5712 5172 4DD3.tmp 98 PID 5712 wrote to memory of 1348 5712 4EAE.tmp 99 PID 1348 wrote to memory of 1576 1348 4F79.tmp 100 PID 1576 wrote to memory of 5968 1576 50A2.tmp 101 PID 5968 wrote to memory of 5764 5968 517D.tmp 102 PID 5764 wrote to memory of 4036 5764 5277.tmp 103 PID 4036 wrote to memory of 3820 4036 539F.tmp 104 PID 3820 wrote to memory of 3592 3820 547A.tmp 105 PID 3592 wrote to memory of 2312 3592 5574.tmp 106 PID 2312 wrote to memory of 4208 2312 565F.tmp 107 PID 4208 wrote to memory of 6036 4208 5787.tmp 108 PID 6036 wrote to memory of 3060 6036 5862.tmp 109 PID 3060 wrote to memory of 5964 3060 59BA.tmp 110 PID 5964 wrote to memory of 3884 5964 5AC4.tmp 111 PID 3884 wrote to memory of 4452 3884 5BCD.tmp 112 PID 4452 wrote to memory of 5088 4452 5CF6.tmp 113 PID 5088 wrote to memory of 676 5088 5DE0.tmp 114 PID 676 wrote to memory of 2700 676 5EEA.tmp 115 PID 2700 wrote to memory of 4708 2700 5FC5.tmp 116 PID 4708 wrote to memory of 4084 4708 60EE.tmp 117 PID 4084 wrote to memory of 4604 4084 61B9.tmp 118 PID 4604 wrote to memory of 4948 4604 6274.tmp 119 PID 4948 wrote to memory of 4296 4948 635F.tmp 120 PID 4296 wrote to memory of 4964 4296 6468.tmp 121 PID 4964 wrote to memory of 5028 4964 6572.tmp 122 PID 5028 wrote to memory of 2936 5028 664D.tmp 123 PID 2936 wrote to memory of 2780 2936 66F9.tmp 124 PID 2780 wrote to memory of 1268 2780 6795.tmp 125 PID 1268 wrote to memory of 980 1268 6821.tmp 126 PID 980 wrote to memory of 1436 980 68BE.tmp 127 PID 1436 wrote to memory of 3248 1436 6979.tmp 128 PID 3248 wrote to memory of 6080 3248 6A25.tmp 129 PID 6080 wrote to memory of 1104 6080 6AF0.tmp 130 PID 1104 wrote to memory of 620 1104 6B9C.tmp 131 PID 620 wrote to memory of 2896 620 6C58.tmp 132 PID 2896 wrote to memory of 2888 2896 6D23.tmp 133 PID 2888 wrote to memory of 5408 2888 6DEE.tmp 134 PID 5408 wrote to memory of 2472 5408 6EB9.tmp 135 PID 2472 wrote to memory of 5056 2472 6F55.tmp 136 PID 5056 wrote to memory of 3476 5056 6FD2.tmp 137 PID 3476 wrote to memory of 5820 3476 705F.tmp 138 PID 5820 wrote to memory of 5308 5820 70DC.tmp 139 PID 5308 wrote to memory of 4852 5308 7149.tmp 140 PID 4852 wrote to memory of 5024 4852 71C6.tmp 141 PID 5024 wrote to memory of 2564 5024 7243.tmp 142 PID 2564 wrote to memory of 6064 2564 72B1.tmp 143 PID 6064 wrote to memory of 4072 6064 732E.tmp 144 PID 4072 wrote to memory of 5316 4072 73BA.tmp 145 PID 5316 wrote to memory of 5900 5316 7428.tmp 146 PID 5900 wrote to memory of 832 5900 7495.tmp 147 PID 832 wrote to memory of 8 832 7512.tmp 148 PID 8 wrote to memory of 5952 8 758F.tmp 149 PID 5952 wrote to memory of 4176 5952 760C.tmp 150 PID 4176 wrote to memory of 4476 4176 7689.tmp 151 PID 4476 wrote to memory of 5844 4476 76F6.tmp 152 PID 5844 wrote to memory of 2872 5844 7783.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_fdd3ceca3846638f8370919853d92198_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_fdd3ceca3846638f8370919853d92198_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\4632.tmp"C:\Users\Admin\AppData\Local\Temp\4632.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\475B.tmp"C:\Users\Admin\AppData\Local\Temp\475B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\48F1.tmp"C:\Users\Admin\AppData\Local\Temp\48F1.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4A97.tmp"C:\Users\Admin\AppData\Local\Temp\4A97.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4D18.tmp"C:\Users\Admin\AppData\Local\Temp\4D18.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"C:\Users\Admin\AppData\Local\Temp\4DD3.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"C:\Users\Admin\AppData\Local\Temp\4EAE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\4F79.tmp"C:\Users\Admin\AppData\Local\Temp\4F79.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\50A2.tmp"C:\Users\Admin\AppData\Local\Temp\50A2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\517D.tmp"C:\Users\Admin\AppData\Local\Temp\517D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\5277.tmp"C:\Users\Admin\AppData\Local\Temp\5277.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\539F.tmp"C:\Users\Admin\AppData\Local\Temp\539F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\547A.tmp"C:\Users\Admin\AppData\Local\Temp\547A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\5574.tmp"C:\Users\Admin\AppData\Local\Temp\5574.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\565F.tmp"C:\Users\Admin\AppData\Local\Temp\565F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\5787.tmp"C:\Users\Admin\AppData\Local\Temp\5787.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\5862.tmp"C:\Users\Admin\AppData\Local\Temp\5862.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\59BA.tmp"C:\Users\Admin\AppData\Local\Temp\59BA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5AC4.tmp"C:\Users\Admin\AppData\Local\Temp\5AC4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\5BCD.tmp"C:\Users\Admin\AppData\Local\Temp\5BCD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5DE0.tmp"C:\Users\Admin\AppData\Local\Temp\5DE0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\60EE.tmp"C:\Users\Admin\AppData\Local\Temp\60EE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\61B9.tmp"C:\Users\Admin\AppData\Local\Temp\61B9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\6274.tmp"C:\Users\Admin\AppData\Local\Temp\6274.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\635F.tmp"C:\Users\Admin\AppData\Local\Temp\635F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6468.tmp"C:\Users\Admin\AppData\Local\Temp\6468.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\6572.tmp"C:\Users\Admin\AppData\Local\Temp\6572.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\664D.tmp"C:\Users\Admin\AppData\Local\Temp\664D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\66F9.tmp"C:\Users\Admin\AppData\Local\Temp\66F9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\6795.tmp"C:\Users\Admin\AppData\Local\Temp\6795.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\68BE.tmp"C:\Users\Admin\AppData\Local\Temp\68BE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\6979.tmp"C:\Users\Admin\AppData\Local\Temp\6979.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\6A25.tmp"C:\Users\Admin\AppData\Local\Temp\6A25.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"C:\Users\Admin\AppData\Local\Temp\6AF0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"C:\Users\Admin\AppData\Local\Temp\6B9C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\6C58.tmp"C:\Users\Admin\AppData\Local\Temp\6C58.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\6D23.tmp"C:\Users\Admin\AppData\Local\Temp\6D23.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\6F55.tmp"C:\Users\Admin\AppData\Local\Temp\6F55.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\72B1.tmp"C:\Users\Admin\AppData\Local\Temp\72B1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\732E.tmp"C:\Users\Admin\AppData\Local\Temp\732E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\73BA.tmp"C:\Users\Admin\AppData\Local\Temp\73BA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\7428.tmp"C:\Users\Admin\AppData\Local\Temp\7428.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\7495.tmp"C:\Users\Admin\AppData\Local\Temp\7495.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\758F.tmp"C:\Users\Admin\AppData\Local\Temp\758F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\760C.tmp"C:\Users\Admin\AppData\Local\Temp\760C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\7689.tmp"C:\Users\Admin\AppData\Local\Temp\7689.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\76F6.tmp"C:\Users\Admin\AppData\Local\Temp\76F6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\7800.tmp"C:\Users\Admin\AppData\Local\Temp\7800.tmp"65⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\787D.tmp"C:\Users\Admin\AppData\Local\Temp\787D.tmp"66⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\790A.tmp"C:\Users\Admin\AppData\Local\Temp\790A.tmp"67⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\7987.tmp"C:\Users\Admin\AppData\Local\Temp\7987.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7A04.tmp"C:\Users\Admin\AppData\Local\Temp\7A04.tmp"69⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"70⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"71⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\7B7B.tmp"C:\Users\Admin\AppData\Local\Temp\7B7B.tmp"72⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\7BF8.tmp"C:\Users\Admin\AppData\Local\Temp\7BF8.tmp"73⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7C65.tmp"C:\Users\Admin\AppData\Local\Temp\7C65.tmp"74⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"C:\Users\Admin\AppData\Local\Temp\7CE2.tmp"75⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\7D40.tmp"C:\Users\Admin\AppData\Local\Temp\7D40.tmp"76⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"77⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\7E49.tmp"C:\Users\Admin\AppData\Local\Temp\7E49.tmp"78⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"79⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\7F34.tmp"C:\Users\Admin\AppData\Local\Temp\7F34.tmp"80⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"C:\Users\Admin\AppData\Local\Temp\7FC0.tmp"81⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\803D.tmp"C:\Users\Admin\AppData\Local\Temp\803D.tmp"82⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\80AB.tmp"C:\Users\Admin\AppData\Local\Temp\80AB.tmp"83⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\8128.tmp"C:\Users\Admin\AppData\Local\Temp\8128.tmp"84⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\81A5.tmp"C:\Users\Admin\AppData\Local\Temp\81A5.tmp"85⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"86⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\82AE.tmp"C:\Users\Admin\AppData\Local\Temp\82AE.tmp"87⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\831C.tmp"C:\Users\Admin\AppData\Local\Temp\831C.tmp"88⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\8399.tmp"C:\Users\Admin\AppData\Local\Temp\8399.tmp"89⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\8406.tmp"C:\Users\Admin\AppData\Local\Temp\8406.tmp"90⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8483.tmp"C:\Users\Admin\AppData\Local\Temp\8483.tmp"91⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\8510.tmp"C:\Users\Admin\AppData\Local\Temp\8510.tmp"92⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\858D.tmp"C:\Users\Admin\AppData\Local\Temp\858D.tmp"93⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\8619.tmp"C:\Users\Admin\AppData\Local\Temp\8619.tmp"94⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\8687.tmp"C:\Users\Admin\AppData\Local\Temp\8687.tmp"95⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"96⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\87A0.tmp"C:\Users\Admin\AppData\Local\Temp\87A0.tmp"97⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\884C.tmp"C:\Users\Admin\AppData\Local\Temp\884C.tmp"98⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\88F8.tmp"C:\Users\Admin\AppData\Local\Temp\88F8.tmp"99⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\8984.tmp"C:\Users\Admin\AppData\Local\Temp\8984.tmp"100⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\8A01.tmp"C:\Users\Admin\AppData\Local\Temp\8A01.tmp"101⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"102⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"C:\Users\Admin\AppData\Local\Temp\8B2A.tmp"103⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"C:\Users\Admin\AppData\Local\Temp\8BB7.tmp"104⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\8C34.tmp"C:\Users\Admin\AppData\Local\Temp\8C34.tmp"105⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"C:\Users\Admin\AppData\Local\Temp\8CB1.tmp"106⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"107⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\8DCA.tmp"C:\Users\Admin\AppData\Local\Temp\8DCA.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\8E57.tmp"C:\Users\Admin\AppData\Local\Temp\8E57.tmp"109⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"C:\Users\Admin\AppData\Local\Temp\8EE3.tmp"110⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\8F70.tmp"C:\Users\Admin\AppData\Local\Temp\8F70.tmp"111⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\8FED.tmp"C:\Users\Admin\AppData\Local\Temp\8FED.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\907A.tmp"C:\Users\Admin\AppData\Local\Temp\907A.tmp"113⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\90F7.tmp"C:\Users\Admin\AppData\Local\Temp\90F7.tmp"114⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\9183.tmp"C:\Users\Admin\AppData\Local\Temp\9183.tmp"115⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\921F.tmp"C:\Users\Admin\AppData\Local\Temp\921F.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:480 -
C:\Users\Admin\AppData\Local\Temp\929C.tmp"C:\Users\Admin\AppData\Local\Temp\929C.tmp"117⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\9319.tmp"C:\Users\Admin\AppData\Local\Temp\9319.tmp"118⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\9387.tmp"C:\Users\Admin\AppData\Local\Temp\9387.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\9404.tmp"C:\Users\Admin\AppData\Local\Temp\9404.tmp"120⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\9471.tmp"C:\Users\Admin\AppData\Local\Temp\9471.tmp"121⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\94EE.tmp"C:\Users\Admin\AppData\Local\Temp\94EE.tmp"122⤵PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-