Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 15:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_c3abb46d023d065edae235e02d05a76f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_c3abb46d023d065edae235e02d05a76f_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-17_c3abb46d023d065edae235e02d05a76f_elex_mafia.exe
- Size 520KB
- Sample260817-shqw4sshjf
- SHA256 1085482c3920e83f7df5a00eb15a705625a2b36af22f293d8bfe08e6f9326045
- MD5 c3abb46d023d065edae235e02d05a76f
- SHA1 06db1a6360870d46bf9c24130a24686747dac414
- SHA512 4552c402354598648fd32353d3b425edc0159d65d0c00d805d4d66a5a10c7e7348cc41ea6d339da5e1c8cf58fb66529eb68e4318da2f63cc3ca6997cc26368fe
- SSDEEP 12288:roRXOQjmOyZZRkSZwuIWRTGeQjIgWXqYGNZ:rogQ9yLRk+FFgoPGN
- TLSH T1BAB4F1227545C036E5C212308B26DFA14B3E3D765B7A86C73BC43A6DAEB42C1E679347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3684 5455.tmp 3816 5520.tmp 2144 55BC.tmp 3720 5697.tmp 5068 5743.tmp 672 57C0.tmp 2304 586C.tmp 3632 58F8.tmp 4796 59A4.tmp 4660 5A60.tmp 4512 5B2B.tmp 4200 5BC7.tmp 4876 5C83.tmp 4776 5D00.tmp 3404 5DAB.tmp 2584 5E28.tmp 1916 5ED4.tmp 2684 5F71.tmp 4112 5FFD.tmp 1500 60A9.tmp 2132 6145.tmp 360 61E2.tmp 1012 624F.tmp 1200 62CC.tmp 3172 6387.tmp 2496 6404.tmp 4344 64B0.tmp 2788 650E.tmp 2964 65AA.tmp 224 6647.tmp 2008 6721.tmp 2408 67BE.tmp 2324 683B.tmp 4968 6889.tmp 1172 68E6.tmp 3828 6954.tmp 2880 69A2.tmp 3644 6A00.tmp 4872 6A4E.tmp 2372 6ACB.tmp 2548 6B38.tmp 4136 6B86.tmp 3228 6BE4.tmp 2392 6C42.tmp 2868 6C90.tmp 2196 6CFD.tmp 1980 6D5B.tmp 2552 6DB9.tmp 5000 6E07.tmp 2500 6E65.tmp 2428 6EC2.tmp 4484 6F30.tmp 1860 6F9D.tmp 3140 6FEB.tmp 2508 7049.tmp 1748 70C6.tmp 5004 7124.tmp 4028 7172.tmp 864 71C0.tmp 4320 723D.tmp 1828 728B.tmp 3520 72F9.tmp 904 7347.tmp 3340 7395.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A19A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9774.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7395.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8855.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C290.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DFC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4400 wrote to memory of 3684 4400 2026-08-17_c3abb46d023d065edae235e02d05a76f_elex_mafia.exe 86 PID 3684 wrote to memory of 3816 3684 5455.tmp 87 PID 3816 wrote to memory of 2144 3816 5520.tmp 88 PID 2144 wrote to memory of 3720 2144 55BC.tmp 89 PID 3720 wrote to memory of 5068 3720 5697.tmp 90 PID 5068 wrote to memory of 672 5068 5743.tmp 91 PID 672 wrote to memory of 2304 672 57C0.tmp 92 PID 2304 wrote to memory of 3632 2304 586C.tmp 93 PID 3632 wrote to memory of 4796 3632 58F8.tmp 94 PID 4796 wrote to memory of 4660 4796 59A4.tmp 95 PID 4660 wrote to memory of 4512 4660 5A60.tmp 96 PID 4512 wrote to memory of 4200 4512 5B2B.tmp 97 PID 4200 wrote to memory of 4876 4200 5BC7.tmp 98 PID 4876 wrote to memory of 4776 4876 5C83.tmp 99 PID 4776 wrote to memory of 3404 4776 5D00.tmp 100 PID 3404 wrote to memory of 2584 3404 5DAB.tmp 101 PID 2584 wrote to memory of 1916 2584 5E28.tmp 102 PID 1916 wrote to memory of 2684 1916 5ED4.tmp 103 PID 2684 wrote to memory of 4112 2684 5F71.tmp 104 PID 4112 wrote to memory of 1500 4112 5FFD.tmp 105 PID 1500 wrote to memory of 2132 1500 60A9.tmp 106 PID 2132 wrote to memory of 360 2132 6145.tmp 107 PID 360 wrote to memory of 1012 360 61E2.tmp 108 PID 1012 wrote to memory of 1200 1012 624F.tmp 109 PID 1200 wrote to memory of 3172 1200 62CC.tmp 110 PID 3172 wrote to memory of 2496 3172 6387.tmp 111 PID 2496 wrote to memory of 4344 2496 6404.tmp 112 PID 4344 wrote to memory of 2788 4344 64B0.tmp 113 PID 2788 wrote to memory of 2964 2788 650E.tmp 114 PID 2964 wrote to memory of 224 2964 65AA.tmp 115 PID 224 wrote to memory of 2008 224 6647.tmp 116 PID 2008 wrote to memory of 2408 2008 6721.tmp 117 PID 2408 wrote to memory of 2324 2408 67BE.tmp 118 PID 2324 wrote to memory of 4968 2324 683B.tmp 119 PID 4968 wrote to memory of 1172 4968 6889.tmp 120 PID 1172 wrote to memory of 3828 1172 68E6.tmp 121 PID 3828 wrote to memory of 2880 3828 6954.tmp 122 PID 2880 wrote to memory of 3644 2880 69A2.tmp 123 PID 3644 wrote to memory of 4872 3644 6A00.tmp 124 PID 4872 wrote to memory of 2372 4872 6A4E.tmp 125 PID 2372 wrote to memory of 2548 2372 6ACB.tmp 126 PID 2548 wrote to memory of 4136 2548 6B38.tmp 127 PID 4136 wrote to memory of 3228 4136 6B86.tmp 128 PID 3228 wrote to memory of 2392 3228 6BE4.tmp 129 PID 2392 wrote to memory of 2868 2392 6C42.tmp 130 PID 2868 wrote to memory of 2196 2868 6C90.tmp 131 PID 2196 wrote to memory of 1980 2196 6CFD.tmp 132 PID 1980 wrote to memory of 2552 1980 6D5B.tmp 133 PID 2552 wrote to memory of 5000 2552 6DB9.tmp 134 PID 5000 wrote to memory of 2500 5000 6E07.tmp 135 PID 2500 wrote to memory of 2428 2500 6E65.tmp 136 PID 2428 wrote to memory of 4484 2428 6EC2.tmp 137 PID 4484 wrote to memory of 1860 4484 6F30.tmp 138 PID 1860 wrote to memory of 3140 1860 6F9D.tmp 139 PID 3140 wrote to memory of 2508 3140 6FEB.tmp 140 PID 2508 wrote to memory of 1748 2508 7049.tmp 141 PID 1748 wrote to memory of 5004 1748 70C6.tmp 142 PID 5004 wrote to memory of 4028 5004 7124.tmp 143 PID 4028 wrote to memory of 864 4028 7172.tmp 144 PID 864 wrote to memory of 4320 864 71C0.tmp 145 PID 4320 wrote to memory of 1828 4320 723D.tmp 146 PID 1828 wrote to memory of 3520 1828 728B.tmp 147 PID 3520 wrote to memory of 904 3520 72F9.tmp 148 PID 904 wrote to memory of 3340 904 7347.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_c3abb46d023d065edae235e02d05a76f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_c3abb46d023d065edae235e02d05a76f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\5743.tmp"C:\Users\Admin\AppData\Local\Temp\5743.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\7124.tmp"C:\Users\Admin\AppData\Local\Temp\7124.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"66⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"67⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\748F.tmp"C:\Users\Admin\AppData\Local\Temp\748F.tmp"68⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"69⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"70⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\75B8.tmp"C:\Users\Admin\AppData\Local\Temp\75B8.tmp"71⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"72⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"73⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"74⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"75⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"76⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\77CB.tmp"C:\Users\Admin\AppData\Local\Temp\77CB.tmp"77⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"78⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"79⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"80⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"81⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"82⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"83⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"84⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"85⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"86⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"87⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\7C01.tmp"C:\Users\Admin\AppData\Local\Temp\7C01.tmp"88⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"89⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"90⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"91⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"92⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"93⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"94⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\7E72.tmp"C:\Users\Admin\AppData\Local\Temp\7E72.tmp"95⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"96⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"97⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"98⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"99⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"100⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"101⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"102⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"103⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"104⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\825A.tmp"C:\Users\Admin\AppData\Local\Temp\825A.tmp"105⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"106⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"107⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"108⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"109⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"110⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"111⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\8529.tmp"C:\Users\Admin\AppData\Local\Temp\8529.tmp"112⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8587.tmp"C:\Users\Admin\AppData\Local\Temp\8587.tmp"113⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\85D5.tmp"C:\Users\Admin\AppData\Local\Temp\85D5.tmp"114⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"115⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"116⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"117⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"118⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"119⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"120⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"122⤵PID:1128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-