Analysis
- max time kernel
129s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_eae7b2a9a3d08eb2ce0897b75f8f8ad2_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_eae7b2a9a3d08eb2ce0897b75f8f8ad2_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-10_eae7b2a9a3d08eb2ce0897b75f8f8ad2_elex_mafia.exe
- Size 561KB
- Sample260810-nkpplsfg25
- SHA256 8c1602db12db300c479f0f1e70cced996f21015129ac3a5fe22cd9398df7ebaf
- MD5 eae7b2a9a3d08eb2ce0897b75f8f8ad2
- SHA1 a79de1f4baecb25863622164954c510d96464aa3
- SHA512 29bfb38d626d59128a50f35acc9599287f7bb5ddc1b07b4ff4411e1b8d7795123cdfc2a1fa665d99816752dc589197078e0668f42551988a020b4dd168cd276d
- SSDEEP 6144:kPTkurf/m9KOzlMsPhYET0yhlwUH03TF7ewYFLOQnP/qZrE8yZ0UG8cs4kwwpSg5:VuelPWET0yhRITw/vKZrqC8njBORDZuL
- TLSH T17BC4DF21B2D4C435F5F31A345AF5D762097BBC219B35E9CB2788222E5EB12C0EA79713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5764 D618.tmp 2440 D6F2.tmp 1720 D7DD.tmp 5196 D898.tmp 1712 D934.tmp 4892 D9F0.tmp 1568 DACB.tmp 5788 DCBF.tmp 1108 DD7A.tmp 1956 DE36.tmp 2840 DEC2.tmp 4736 DF7E.tmp 3540 E02A.tmp 1416 E0C6.tmp 3036 E1A1.tmp 3784 E28B.tmp 4880 E366.tmp 5716 E431.tmp 1084 E4DD.tmp 124 E5E6.tmp 5828 E692.tmp 5836 E73E.tmp 2064 E7DA.tmp 1280 E896.tmp 2704 E951.tmp 3628 EA0D.tmp 5628 EAE8.tmp 3292 EBB3.tmp 4128 EC5F.tmp 1844 ED2A.tmp 5140 EDC6.tmp 5308 EE62.tmp 5944 EF0E.tmp 4940 EF7C.tmp 3904 F018.tmp 5900 F0B4.tmp 3932 F150.tmp 1824 F1DD.tmp 2436 F279.tmp 1260 F2F6.tmp 4168 F383.tmp 5768 F400.tmp 4236 F48C.tmp 2724 F509.tmp 4652 F596.tmp 5952 F613.tmp 4188 F6A0.tmp 6116 F71D.tmp 896 F79A.tmp 1864 F846.tmp 3676 F8B3.tmp 1732 F94F.tmp 5144 F9CC.tmp 5412 FA59.tmp 3796 FAF5.tmp 1312 FB82.tmp 2560 FC0E.tmp 1504 FCAB.tmp 3244 FD28.tmp 3248 FD95.tmp 3472 FE12.tmp 5732 FE7F.tmp 4740 FF1C.tmp 4464 FF99.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 579C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B58B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B685.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F94F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 785E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5589.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 134B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 138E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B27D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5819.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 5764 4232 2026-08-10_eae7b2a9a3d08eb2ce0897b75f8f8ad2_elex_mafia.exe 89 PID 5764 wrote to memory of 2440 5764 D618.tmp 90 PID 2440 wrote to memory of 1720 2440 D6F2.tmp 91 PID 1720 wrote to memory of 5196 1720 D7DD.tmp 92 PID 5196 wrote to memory of 1712 5196 D898.tmp 93 PID 1712 wrote to memory of 4892 1712 D934.tmp 94 PID 4892 wrote to memory of 1568 4892 D9F0.tmp 95 PID 1568 wrote to memory of 5788 1568 DACB.tmp 96 PID 5788 wrote to memory of 1108 5788 DCBF.tmp 97 PID 1108 wrote to memory of 1956 1108 DD7A.tmp 98 PID 1956 wrote to memory of 2840 1956 DE36.tmp 99 PID 2840 wrote to memory of 4736 2840 DEC2.tmp 100 PID 4736 wrote to memory of 3540 4736 DF7E.tmp 101 PID 3540 wrote to memory of 1416 3540 E02A.tmp 102 PID 1416 wrote to memory of 3036 1416 E0C6.tmp 103 PID 3036 wrote to memory of 3784 3036 E1A1.tmp 104 PID 3784 wrote to memory of 4880 3784 E28B.tmp 105 PID 4880 wrote to memory of 5716 4880 E366.tmp 106 PID 5716 wrote to memory of 1084 5716 E431.tmp 107 PID 1084 wrote to memory of 124 1084 E4DD.tmp 108 PID 124 wrote to memory of 5828 124 E5E6.tmp 109 PID 5828 wrote to memory of 5836 5828 E692.tmp 110 PID 5836 wrote to memory of 2064 5836 E73E.tmp 111 PID 2064 wrote to memory of 1280 2064 E7DA.tmp 112 PID 1280 wrote to memory of 2704 1280 E896.tmp 113 PID 2704 wrote to memory of 3628 2704 E951.tmp 114 PID 3628 wrote to memory of 5628 3628 EA0D.tmp 115 PID 5628 wrote to memory of 3292 5628 EAE8.tmp 116 PID 3292 wrote to memory of 4128 3292 EBB3.tmp 117 PID 4128 wrote to memory of 1844 4128 EC5F.tmp 118 PID 1844 wrote to memory of 5140 1844 ED2A.tmp 119 PID 5140 wrote to memory of 5308 5140 EDC6.tmp 120 PID 5308 wrote to memory of 5944 5308 EE62.tmp 121 PID 5944 wrote to memory of 4940 5944 EF0E.tmp 122 PID 4940 wrote to memory of 3904 4940 EF7C.tmp 123 PID 3904 wrote to memory of 5900 3904 F018.tmp 124 PID 5900 wrote to memory of 3932 5900 F0B4.tmp 125 PID 3932 wrote to memory of 1824 3932 F150.tmp 126 PID 1824 wrote to memory of 2436 1824 F1DD.tmp 127 PID 2436 wrote to memory of 1260 2436 F279.tmp 128 PID 1260 wrote to memory of 4168 1260 F2F6.tmp 129 PID 4168 wrote to memory of 5768 4168 F383.tmp 130 PID 5768 wrote to memory of 4236 5768 F400.tmp 131 PID 4236 wrote to memory of 2724 4236 F48C.tmp 132 PID 2724 wrote to memory of 4652 2724 F509.tmp 133 PID 4652 wrote to memory of 5952 4652 F596.tmp 134 PID 5952 wrote to memory of 4188 5952 F613.tmp 135 PID 4188 wrote to memory of 6116 4188 F6A0.tmp 136 PID 6116 wrote to memory of 896 6116 F71D.tmp 137 PID 896 wrote to memory of 1864 896 F79A.tmp 138 PID 1864 wrote to memory of 3676 1864 F846.tmp 139 PID 3676 wrote to memory of 1732 3676 F8B3.tmp 140 PID 1732 wrote to memory of 5144 1732 F94F.tmp 141 PID 5144 wrote to memory of 5412 5144 F9CC.tmp 142 PID 5412 wrote to memory of 3796 5412 FA59.tmp 143 PID 3796 wrote to memory of 1312 3796 FAF5.tmp 144 PID 1312 wrote to memory of 2560 1312 FB82.tmp 145 PID 2560 wrote to memory of 1504 2560 FC0E.tmp 146 PID 1504 wrote to memory of 3244 1504 FCAB.tmp 147 PID 3244 wrote to memory of 3248 3244 FD28.tmp 148 PID 3248 wrote to memory of 3472 3248 FD95.tmp 149 PID 3472 wrote to memory of 5732 3472 FE12.tmp 150 PID 5732 wrote to memory of 4740 5732 FE7F.tmp 151 PID 4740 wrote to memory of 4464 4740 FF1C.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_eae7b2a9a3d08eb2ce0897b75f8f8ad2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_eae7b2a9a3d08eb2ce0897b75f8f8ad2_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\D898.tmp"C:\Users\Admin\AppData\Local\Temp\D898.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DACB.tmp"C:\Users\Admin\AppData\Local\Temp\DACB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\E4DD.tmp"C:\Users\Admin\AppData\Local\Temp\E4DD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\E896.tmp"C:\Users\Admin\AppData\Local\Temp\E896.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\EAE8.tmp"C:\Users\Admin\AppData\Local\Temp\EAE8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\EC5F.tmp"C:\Users\Admin\AppData\Local\Temp\EC5F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"C:\Users\Admin\AppData\Local\Temp\ED2A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"C:\Users\Admin\AppData\Local\Temp\EDC6.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\EE62.tmp"C:\Users\Admin\AppData\Local\Temp\EE62.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\F018.tmp"C:\Users\Admin\AppData\Local\Temp\F018.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\F150.tmp"C:\Users\Admin\AppData\Local\Temp\F150.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\F279.tmp"C:\Users\Admin\AppData\Local\Temp\F279.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\F613.tmp"C:\Users\Admin\AppData\Local\Temp\F613.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"C:\Users\Admin\AppData\Local\Temp\F6A0.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\F79A.tmp"C:\Users\Admin\AppData\Local\Temp\F79A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\F846.tmp"C:\Users\Admin\AppData\Local\Temp\F846.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\F94F.tmp"C:\Users\Admin\AppData\Local\Temp\F94F.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"C:\Users\Admin\AppData\Local\Temp\F9CC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\FA59.tmp"C:\Users\Admin\AppData\Local\Temp\FA59.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\FB82.tmp"C:\Users\Admin\AppData\Local\Temp\FB82.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"65⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\16.tmp"C:\Users\Admin\AppData\Local\Temp\16.tmp"66⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"67⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"68⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"69⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"70⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2D5.tmp"C:\Users\Admin\AppData\Local\Temp\2D5.tmp"71⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"72⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\40D.tmp"C:\Users\Admin\AppData\Local\Temp\40D.tmp"73⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\4B9.tmp"C:\Users\Admin\AppData\Local\Temp\4B9.tmp"74⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"75⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5F2.tmp"C:\Users\Admin\AppData\Local\Temp\5F2.tmp"76⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\66F.tmp"C:\Users\Admin\AppData\Local\Temp\66F.tmp"77⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"78⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"79⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"80⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\891.tmp"C:\Users\Admin\AppData\Local\Temp\891.tmp"81⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\91E.tmp"C:\Users\Admin\AppData\Local\Temp\91E.tmp"82⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"83⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"84⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"85⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"86⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"87⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"88⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\D06.tmp"C:\Users\Admin\AppData\Local\Temp\D06.tmp"89⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\DB2.tmp"C:\Users\Admin\AppData\Local\Temp\DB2.tmp"90⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\E3F.tmp"C:\Users\Admin\AppData\Local\Temp\E3F.tmp"91⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"92⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\F67.tmp"C:\Users\Admin\AppData\Local\Temp\F67.tmp"93⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"94⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\1081.tmp"C:\Users\Admin\AppData\Local\Temp\1081.tmp"95⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"96⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"97⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\11E8.tmp"C:\Users\Admin\AppData\Local\Temp\11E8.tmp"98⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"99⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"100⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\138E.tmp"C:\Users\Admin\AppData\Local\Temp\138E.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\142A.tmp"C:\Users\Admin\AppData\Local\Temp\142A.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:620 -
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"103⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"106⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"107⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\1737.tmp"C:\Users\Admin\AppData\Local\Temp\1737.tmp"108⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\17B4.tmp"C:\Users\Admin\AppData\Local\Temp\17B4.tmp"109⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\1831.tmp"C:\Users\Admin\AppData\Local\Temp\1831.tmp"110⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"111⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"112⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"113⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"114⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"115⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"117⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"118⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\1C77.tmp"C:\Users\Admin\AppData\Local\Temp\1C77.tmp"119⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1D13.tmp"C:\Users\Admin\AppData\Local\Temp\1D13.tmp"120⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"121⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"C:\Users\Admin\AppData\Local\Temp\1E1D.tmp"122⤵PID:5132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-