Analysis
- max time kernel
111s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_d3b4a3f1932723a74b1602c2fc14dc08_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_d3b4a3f1932723a74b1602c2fc14dc08_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_d3b4a3f1932723a74b1602c2fc14dc08_elex_mafia.exe
- Size 561KB
- Sample260810-lkb3eazzax
- SHA256 e992732eabbef8a75ba0cc6258534d3109f53ae063d275dec0a711c8de0f5257
- MD5 d3b4a3f1932723a74b1602c2fc14dc08
- SHA1 c0fe5058e9809941bc026a6429d92e00ce5b8d42
- SHA512 6a9d7d08dbbb9f33e6f8942a9be6d7aacda72fa233114f8f789d36fee7395b58b56530627fbb12158c3c705cc98be2214c356a25c31d7009b87e85eb8ec7732e
- SSDEEP 12288:VuelPWET0yhnQrFzgYtDSkNWoDZLwTvLXDZuL:8eEEvhGvXNFBwDLXDoL
- TLSH T14AC4DF11B6C8C832F1F31A385AF49B62097B7C219B71D9CF2784225E2EB52D1E679713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4296 DDE3.tmp 1940 DE9E.tmp 2432 E025.tmp 240 E092.tmp 4880 E17D.tmp 4752 E209.tmp 4248 E277.tmp 4588 E361.tmp 3480 E45B.tmp 3256 E545.tmp 4780 E5D2.tmp 3680 E69D.tmp 3084 E778.tmp 2908 E824.tmp 5360 E8FF.tmp 3476 E97C.tmp 5968 EA08.tmp 3552 EAB4.tmp 3816 EB70.tmp 1152 EBFC.tmp 5232 ECC7.tmp 4612 ED54.tmp 1704 EDE1.tmp 4520 EE5E.tmp 5160 EF19.tmp 4364 EFC5.tmp 2440 F0A0.tmp 4864 F15B.tmp 2976 F217.tmp 5024 F2C3.tmp 6088 F3BD.tmp 1780 F468.tmp 5800 F582.tmp 5732 F5FF.tmp 5716 F67C.tmp 1520 F708.tmp 5156 F785.tmp 5408 F812.tmp 1920 F8BE.tmp 5528 F989.tmp 4020 FA16.tmp 5744 FAA2.tmp 716 FB1F.tmp 2356 FBBB.tmp 4760 FC38.tmp 4876 FCB5.tmp 2808 FD42.tmp 1364 FDCF.tmp 1428 FE3C.tmp 4740 FEE8.tmp 5504 FF84.tmp 1204 1.tmp 1488 BD.tmp 5112 169.tmp 2564 1F5.tmp 4556 272.tmp 1880 2FF.tmp 4932 38B.tmp 3948 408.tmp 1556 4A5.tmp 3792 512.tmp 2936 57F.tmp 5780 5FC.tmp 3664 689.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 228D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C94C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 916 wrote to memory of 4296 916 2026-08-10_d3b4a3f1932723a74b1602c2fc14dc08_elex_mafia.exe 88 PID 4296 wrote to memory of 1940 4296 DDE3.tmp 89 PID 1940 wrote to memory of 2432 1940 DE9E.tmp 90 PID 2432 wrote to memory of 240 2432 E025.tmp 91 PID 240 wrote to memory of 4880 240 E092.tmp 92 PID 4880 wrote to memory of 4752 4880 E17D.tmp 93 PID 4752 wrote to memory of 4248 4752 E209.tmp 94 PID 4248 wrote to memory of 4588 4248 E277.tmp 95 PID 4588 wrote to memory of 3480 4588 E361.tmp 96 PID 3480 wrote to memory of 3256 3480 E45B.tmp 97 PID 3256 wrote to memory of 4780 3256 E545.tmp 98 PID 4780 wrote to memory of 3680 4780 E5D2.tmp 99 PID 3680 wrote to memory of 3084 3680 E69D.tmp 100 PID 3084 wrote to memory of 2908 3084 E778.tmp 101 PID 2908 wrote to memory of 5360 2908 E824.tmp 102 PID 5360 wrote to memory of 3476 5360 E8FF.tmp 103 PID 3476 wrote to memory of 5968 3476 E97C.tmp 104 PID 5968 wrote to memory of 3552 5968 EA08.tmp 105 PID 3552 wrote to memory of 3816 3552 EAB4.tmp 106 PID 3816 wrote to memory of 1152 3816 EB70.tmp 107 PID 1152 wrote to memory of 5232 1152 EBFC.tmp 108 PID 5232 wrote to memory of 4612 5232 ECC7.tmp 109 PID 4612 wrote to memory of 1704 4612 ED54.tmp 110 PID 1704 wrote to memory of 4520 1704 EDE1.tmp 111 PID 4520 wrote to memory of 5160 4520 EE5E.tmp 112 PID 5160 wrote to memory of 4364 5160 EF19.tmp 113 PID 4364 wrote to memory of 2440 4364 EFC5.tmp 114 PID 2440 wrote to memory of 4864 2440 F0A0.tmp 115 PID 4864 wrote to memory of 2976 4864 F15B.tmp 116 PID 2976 wrote to memory of 5024 2976 F217.tmp 117 PID 5024 wrote to memory of 6088 5024 F2C3.tmp 118 PID 6088 wrote to memory of 1780 6088 F3BD.tmp 119 PID 1780 wrote to memory of 5800 1780 F468.tmp 120 PID 5800 wrote to memory of 5732 5800 F582.tmp 121 PID 5732 wrote to memory of 5716 5732 F5FF.tmp 122 PID 5716 wrote to memory of 1520 5716 F67C.tmp 123 PID 1520 wrote to memory of 5156 1520 F708.tmp 124 PID 5156 wrote to memory of 5408 5156 F785.tmp 125 PID 5408 wrote to memory of 1920 5408 F812.tmp 126 PID 1920 wrote to memory of 5528 1920 F8BE.tmp 127 PID 5528 wrote to memory of 4020 5528 F989.tmp 128 PID 4020 wrote to memory of 5744 4020 FA16.tmp 129 PID 5744 wrote to memory of 716 5744 FAA2.tmp 130 PID 716 wrote to memory of 2356 716 FB1F.tmp 131 PID 2356 wrote to memory of 4760 2356 FBBB.tmp 132 PID 4760 wrote to memory of 4876 4760 FC38.tmp 133 PID 4876 wrote to memory of 2808 4876 FCB5.tmp 134 PID 2808 wrote to memory of 1364 2808 FD42.tmp 135 PID 1364 wrote to memory of 1428 1364 FDCF.tmp 136 PID 1428 wrote to memory of 4740 1428 FE3C.tmp 137 PID 4740 wrote to memory of 5504 4740 FEE8.tmp 138 PID 5504 wrote to memory of 1204 5504 FF84.tmp 139 PID 1204 wrote to memory of 1488 1204 1.tmp 140 PID 1488 wrote to memory of 5112 1488 BD.tmp 141 PID 5112 wrote to memory of 2564 5112 169.tmp 142 PID 2564 wrote to memory of 4556 2564 1F5.tmp 143 PID 4556 wrote to memory of 1880 4556 272.tmp 144 PID 1880 wrote to memory of 4932 1880 2FF.tmp 145 PID 4932 wrote to memory of 3948 4932 38B.tmp 146 PID 3948 wrote to memory of 1556 3948 408.tmp 147 PID 1556 wrote to memory of 3792 1556 4A5.tmp 148 PID 3792 wrote to memory of 2936 3792 512.tmp 149 PID 2936 wrote to memory of 5780 2936 57F.tmp 150 PID 5780 wrote to memory of 3664 5780 5FC.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_d3b4a3f1932723a74b1602c2fc14dc08_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d3b4a3f1932723a74b1602c2fc14dc08_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\E092.tmp"C:\Users\Admin\AppData\Local\Temp\E092.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\E17D.tmp"C:\Users\Admin\AppData\Local\Temp\E17D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\E361.tmp"C:\Users\Admin\AppData\Local\Temp\E361.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\E545.tmp"C:\Users\Admin\AppData\Local\Temp\E545.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\E69D.tmp"C:\Users\Admin\AppData\Local\Temp\E69D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\E824.tmp"C:\Users\Admin\AppData\Local\Temp\E824.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\EA08.tmp"C:\Users\Admin\AppData\Local\Temp\EA08.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\EB70.tmp"C:\Users\Admin\AppData\Local\Temp\EB70.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F217.tmp"C:\Users\Admin\AppData\Local\Temp\F217.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\F468.tmp"C:\Users\Admin\AppData\Local\Temp\F468.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\F582.tmp"C:\Users\Admin\AppData\Local\Temp\F582.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\F67C.tmp"C:\Users\Admin\AppData\Local\Temp\F67C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\F812.tmp"C:\Users\Admin\AppData\Local\Temp\F812.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\F989.tmp"C:\Users\Admin\AppData\Local\Temp\F989.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\BD.tmp"C:\Users\Admin\AppData\Local\Temp\BD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\169.tmp"C:\Users\Admin\AppData\Local\Temp\169.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2FF.tmp"C:\Users\Admin\AppData\Local\Temp\2FF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\408.tmp"C:\Users\Admin\AppData\Local\Temp\408.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\512.tmp"C:\Users\Admin\AppData\Local\Temp\512.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"65⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\716.tmp"C:\Users\Admin\AppData\Local\Temp\716.tmp"66⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"67⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"68⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\87D.tmp"C:\Users\Admin\AppData\Local\Temp\87D.tmp"69⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"70⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\996.tmp"C:\Users\Admin\AppData\Local\Temp\996.tmp"71⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\9F4.tmp"C:\Users\Admin\AppData\Local\Temp\9F4.tmp"72⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\A61.tmp"C:\Users\Admin\AppData\Local\Temp\A61.tmp"73⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\AEE.tmp"C:\Users\Admin\AppData\Local\Temp\AEE.tmp"74⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\B7B.tmp"C:\Users\Admin\AppData\Local\Temp\B7B.tmp"75⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\C84.tmp"C:\Users\Admin\AppData\Local\Temp\C84.tmp"77⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"78⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"79⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\E49.tmp"C:\Users\Admin\AppData\Local\Temp\E49.tmp"80⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\ED6.tmp"C:\Users\Admin\AppData\Local\Temp\ED6.tmp"81⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\F53.tmp"C:\Users\Admin\AppData\Local\Temp\F53.tmp"82⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\FC0.tmp"C:\Users\Admin\AppData\Local\Temp\FC0.tmp"83⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\107C.tmp"C:\Users\Admin\AppData\Local\Temp\107C.tmp"84⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"85⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"86⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"88⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"89⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\1406.tmp"C:\Users\Admin\AppData\Local\Temp\1406.tmp"90⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1493.tmp"C:\Users\Admin\AppData\Local\Temp\1493.tmp"91⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"92⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\158D.tmp"C:\Users\Admin\AppData\Local\Temp\158D.tmp"93⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\1619.tmp"C:\Users\Admin\AppData\Local\Temp\1619.tmp"94⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\1696.tmp"C:\Users\Admin\AppData\Local\Temp\1696.tmp"95⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"96⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"97⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"98⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"99⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\1917.tmp"C:\Users\Admin\AppData\Local\Temp\1917.tmp"100⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"101⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"102⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"103⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"104⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\1BD6.tmp"C:\Users\Admin\AppData\Local\Temp\1BD6.tmp"105⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\1C63.tmp"C:\Users\Admin\AppData\Local\Temp\1C63.tmp"106⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"107⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"108⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"C:\Users\Admin\AppData\Local\Temp\1DF9.tmp"109⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"110⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"111⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"112⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\1FED.tmp"C:\Users\Admin\AppData\Local\Temp\1FED.tmp"113⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"114⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\20F7.tmp"C:\Users\Admin\AppData\Local\Temp\20F7.tmp"115⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"116⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"117⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"119⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2423.tmp"C:\Users\Admin\AppData\Local\Temp\2423.tmp"121⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"122⤵PID:3704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-