Analysis
- max time kernel
122s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe
- Size 524KB
- Sample260809-tfp3gahn7s
- SHA256 a6b1026a68f0e29c2d1a4bb341d0b819016ca1ab4cec848cd0ffc58aba662265
- MD5 c6a39b9833828b5cf9fe8b7b3ee43ec0
- SHA1 2af13f95f488a6dffb0789780ec2ab01b83fc88f
- SHA512 258036a6fabad6d2532041e2860f25e46cc2fccc723808c6c1d6f00fca04abe8270c305c34fd619b7f07063f94734c15ee3a44d80dbf347b61f4924ef0dee4f4
- SSDEEP 12288:TRyZzqyL66TcsdWqrShBCVl49ACQ782vNoF59NZ:TRyQylTcZqraCVluAP7BmN
- TLSH T178B4F015B185C032E29212768F6ADBA1597BBD71AB27A4C73B94363D2FF13D1D238306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4264 BD11.tmp 2960 BE69.tmp 4512 BF25.tmp 5676 C04D.tmp 1784 C138.tmp 1580 C1B5.tmp 4340 C33B.tmp 4844 C455.tmp 2588 C5CC.tmp 1836 C6C6.tmp 476 C7FE.tmp 2276 C927.tmp 4824 CA02.tmp 5080 CAEC.tmp 368 CC15.tmp 5400 CD0F.tmp 1164 CDF9.tmp 4560 CF13.tmp 4220 CFFD.tmp 4088 D116.tmp 1536 D1E1.tmp 5496 D2CC.tmp 5808 D3B6.tmp 5004 D4CF.tmp 6072 D5F8.tmp 1424 D731.tmp 2272 D80C.tmp 5784 D954.tmp 5924 DA3E.tmp 1352 DB19.tmp 1420 DC42.tmp 4300 DD1C.tmp 4660 DE36.tmp 4248 DF20.tmp 4940 DFAD.tmp 5248 E078.tmp 3144 E114.tmp 4572 E1EF.tmp 2252 E2CA.tmp 1656 E3B4.tmp 3416 E431.tmp 4384 E4CD.tmp 3140 E589.tmp 5064 E673.tmp 3956 E72F.tmp 3208 E7EA.tmp 1448 E8D4.tmp 4840 E9AF.tmp 3660 EA5B.tmp 4864 EAC8.tmp 2940 EB36.tmp 3696 EBA3.tmp 5360 EC30.tmp 5520 ECAD.tmp 5604 ED1A.tmp 1740 ED88.tmp 3780 EE05.tmp 1524 EE82.tmp 5464 EF1E.tmp 5260 EFBA.tmp 2788 F037.tmp 2476 F0B4.tmp 1488 F121.tmp 1216 F18F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 324C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 612C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 283F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 513E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F14C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8311.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4264 4316 2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe 89 PID 4264 wrote to memory of 2960 4264 BD11.tmp 90 PID 2960 wrote to memory of 4512 2960 BE69.tmp 91 PID 4512 wrote to memory of 5676 4512 BF25.tmp 92 PID 5676 wrote to memory of 1784 5676 C04D.tmp 93 PID 1784 wrote to memory of 1580 1784 C138.tmp 94 PID 1580 wrote to memory of 4340 1580 C1B5.tmp 95 PID 4340 wrote to memory of 4844 4340 C33B.tmp 96 PID 4844 wrote to memory of 2588 4844 C455.tmp 97 PID 2588 wrote to memory of 1836 2588 C5CC.tmp 98 PID 1836 wrote to memory of 476 1836 C6C6.tmp 99 PID 476 wrote to memory of 2276 476 C7FE.tmp 100 PID 2276 wrote to memory of 4824 2276 C927.tmp 101 PID 4824 wrote to memory of 5080 4824 CA02.tmp 102 PID 5080 wrote to memory of 368 5080 CAEC.tmp 103 PID 368 wrote to memory of 5400 368 CC15.tmp 104 PID 5400 wrote to memory of 1164 5400 CD0F.tmp 105 PID 1164 wrote to memory of 4560 1164 CDF9.tmp 106 PID 4560 wrote to memory of 4220 4560 CF13.tmp 107 PID 4220 wrote to memory of 4088 4220 CFFD.tmp 108 PID 4088 wrote to memory of 1536 4088 D116.tmp 109 PID 1536 wrote to memory of 5496 1536 D1E1.tmp 110 PID 5496 wrote to memory of 5808 5496 D2CC.tmp 111 PID 5808 wrote to memory of 5004 5808 D3B6.tmp 112 PID 5004 wrote to memory of 6072 5004 D4CF.tmp 113 PID 6072 wrote to memory of 1424 6072 D5F8.tmp 114 PID 1424 wrote to memory of 2272 1424 D731.tmp 115 PID 2272 wrote to memory of 5784 2272 D80C.tmp 116 PID 5784 wrote to memory of 5924 5784 D954.tmp 117 PID 5924 wrote to memory of 1352 5924 DA3E.tmp 118 PID 1352 wrote to memory of 1420 1352 DB19.tmp 119 PID 1420 wrote to memory of 4300 1420 DC42.tmp 120 PID 4300 wrote to memory of 4660 4300 DD1C.tmp 121 PID 4660 wrote to memory of 4248 4660 DE36.tmp 122 PID 4248 wrote to memory of 4940 4248 DF20.tmp 123 PID 4940 wrote to memory of 5248 4940 DFAD.tmp 124 PID 5248 wrote to memory of 3144 5248 E078.tmp 125 PID 3144 wrote to memory of 4572 3144 E114.tmp 126 PID 4572 wrote to memory of 2252 4572 E1EF.tmp 127 PID 2252 wrote to memory of 1656 2252 E2CA.tmp 128 PID 1656 wrote to memory of 3416 1656 E3B4.tmp 129 PID 3416 wrote to memory of 4384 3416 E431.tmp 130 PID 4384 wrote to memory of 3140 4384 E4CD.tmp 131 PID 3140 wrote to memory of 5064 3140 E589.tmp 132 PID 5064 wrote to memory of 3956 5064 E673.tmp 133 PID 3956 wrote to memory of 3208 3956 E72F.tmp 134 PID 3208 wrote to memory of 1448 3208 E7EA.tmp 135 PID 1448 wrote to memory of 4840 1448 E8D4.tmp 136 PID 4840 wrote to memory of 3660 4840 E9AF.tmp 137 PID 3660 wrote to memory of 4864 3660 EA5B.tmp 138 PID 4864 wrote to memory of 2940 4864 EAC8.tmp 139 PID 2940 wrote to memory of 3696 2940 EB36.tmp 140 PID 3696 wrote to memory of 5360 3696 EBA3.tmp 141 PID 5360 wrote to memory of 5520 5360 EC30.tmp 142 PID 5520 wrote to memory of 5604 5520 ECAD.tmp 143 PID 5604 wrote to memory of 1740 5604 ED1A.tmp 144 PID 1740 wrote to memory of 3780 1740 ED88.tmp 145 PID 3780 wrote to memory of 1524 3780 EE05.tmp 146 PID 1524 wrote to memory of 5464 1524 EE82.tmp 147 PID 5464 wrote to memory of 5260 5464 EF1E.tmp 148 PID 5260 wrote to memory of 2788 5260 EFBA.tmp 149 PID 2788 wrote to memory of 2476 2788 F037.tmp 150 PID 2476 wrote to memory of 1488 2476 F0B4.tmp 151 PID 1488 wrote to memory of 1216 1488 F121.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c6a39b9833828b5cf9fe8b7b3ee43ec0_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\BE69.tmp"C:\Users\Admin\AppData\Local\Temp\BE69.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\BF25.tmp"C:\Users\Admin\AppData\Local\Temp\BF25.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\C138.tmp"C:\Users\Admin\AppData\Local\Temp\C138.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"C:\Users\Admin\AppData\Local\Temp\C1B5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\C33B.tmp"C:\Users\Admin\AppData\Local\Temp\C33B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\C455.tmp"C:\Users\Admin\AppData\Local\Temp\C455.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\CA02.tmp"C:\Users\Admin\AppData\Local\Temp\CA02.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\CF13.tmp"C:\Users\Admin\AppData\Local\Temp\CF13.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\D731.tmp"C:\Users\Admin\AppData\Local\Temp\D731.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\DC42.tmp"C:\Users\Admin\AppData\Local\Temp\DC42.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\DF20.tmp"C:\Users\Admin\AppData\Local\Temp\DF20.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\E078.tmp"C:\Users\Admin\AppData\Local\Temp\E078.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\E673.tmp"C:\Users\Admin\AppData\Local\Temp\E673.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\EB36.tmp"C:\Users\Admin\AppData\Local\Temp\EB36.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\EBA3.tmp"C:\Users\Admin\AppData\Local\Temp\EBA3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\EC30.tmp"C:\Users\Admin\AppData\Local\Temp\EC30.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\EE05.tmp"C:\Users\Admin\AppData\Local\Temp\EE05.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\EFBA.tmp"C:\Users\Admin\AppData\Local\Temp\EFBA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\F037.tmp"C:\Users\Admin\AppData\Local\Temp\F037.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\F18F.tmp"C:\Users\Admin\AppData\Local\Temp\F18F.tmp"65⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"66⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"67⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\F306.tmp"C:\Users\Admin\AppData\Local\Temp\F306.tmp"68⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"70⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"71⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"72⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"73⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"74⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"75⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"C:\Users\Admin\AppData\Local\Temp\F6FD.tmp"76⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"77⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\F807.tmp"C:\Users\Admin\AppData\Local\Temp\F807.tmp"78⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"79⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\F911.tmp"C:\Users\Admin\AppData\Local\Temp\F911.tmp"80⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\F96E.tmp"C:\Users\Admin\AppData\Local\Temp\F96E.tmp"81⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"82⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"83⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\FB05.tmp"C:\Users\Admin\AppData\Local\Temp\FB05.tmp"84⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\FB91.tmp"C:\Users\Admin\AppData\Local\Temp\FB91.tmp"85⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"87⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\FD37.tmp"C:\Users\Admin\AppData\Local\Temp\FD37.tmp"88⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"89⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\FE50.tmp"C:\Users\Admin\AppData\Local\Temp\FE50.tmp"90⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"91⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\FF4A.tmp"C:\Users\Admin\AppData\Local\Temp\FF4A.tmp"92⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\FFC7.tmp"C:\Users\Admin\AppData\Local\Temp\FFC7.tmp"93⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\54.tmp"C:\Users\Admin\AppData\Local\Temp\54.tmp"94⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"95⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\13E.tmp"C:\Users\Admin\AppData\Local\Temp\13E.tmp"96⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\1BB.tmp"C:\Users\Admin\AppData\Local\Temp\1BB.tmp"97⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"98⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"99⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"100⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"101⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"102⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"103⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"104⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"105⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\640.tmp"C:\Users\Admin\AppData\Local\Temp\640.tmp"106⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\6BD.tmp"C:\Users\Admin\AppData\Local\Temp\6BD.tmp"107⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"108⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"109⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"110⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\891.tmp"C:\Users\Admin\AppData\Local\Temp\891.tmp"111⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"112⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\97C.tmp"C:\Users\Admin\AppData\Local\Temp\97C.tmp"113⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\A08.tmp"C:\Users\Admin\AppData\Local\Temp\A08.tmp"114⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"115⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"116⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\B8F.tmp"C:\Users\Admin\AppData\Local\Temp\B8F.tmp"117⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"118⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\C89.tmp"C:\Users\Admin\AppData\Local\Temp\C89.tmp"119⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\D16.tmp"C:\Users\Admin\AppData\Local\Temp\D16.tmp"120⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"121⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"122⤵PID:4880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-