Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_2ca62ced7679b8bd7bc5fc5b9f22d52c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_2ca62ced7679b8bd7bc5fc5b9f22d52c_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-21_2ca62ced7679b8bd7bc5fc5b9f22d52c_elex_mafia.exe
- Size 520KB
- Sample260822-vtsk7aff99
- SHA256 2c735762ad3a3574c18e928e34d951fb15ca4044de0e2eadf505d230b145cc63
- MD5 2ca62ced7679b8bd7bc5fc5b9f22d52c
- SHA1 f411ac5a0717ee3e6676eea211c40d2550903ca3
- SHA512 af84fa3ca60b3308e341c1971fd34dc721fabd3b8b2f7e682d51437807ff00b1d7a0895820e1d12679c8836bb65c546d57b051a4f685d76efe6772ede81975be
- SSDEEP 12288:gj8fuxR21t5i8fPtD3vm+qRK5vcXWmQnZTt4IvNZ6:gj8fuK1GYPxv6RbXWmYZTt4IvNI
- TLSH T14EB4F0117845C037E8D216308B65DBA24BBE7D398B2A81C73BC036AD6FB56D1D67831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2444 C213.tmp 2528 C2DE.tmp 4852 C38A.tmp 1416 C435.tmp 4008 C501.tmp 2808 C58D.tmp 3948 C5FB.tmp 3020 C678.tmp 3816 C723.tmp 4900 C7C0.tmp 4536 C82D.tmp 1580 C8AA.tmp 2620 C946.tmp 2392 C9F2.tmp 3808 CA7F.tmp 1840 CB3A.tmp 704 CBE6.tmp 3208 CC73.tmp 1012 CD1F.tmp 3068 CDBB.tmp 3532 CE57.tmp 1172 CED4.tmp 1432 CF70.tmp 1680 D00D.tmp 3124 D07A.tmp 2920 D145.tmp 396 D1E1.tmp 1048 D25E.tmp 1064 D2FB.tmp 4428 D397.tmp 748 D472.tmp 4892 D4EF.tmp 4860 D5D9.tmp 636 D627.tmp 2948 D695.tmp 2152 D702.tmp 4520 D760.tmp 440 D7BD.tmp 412 D82B.tmp 1608 D889.tmp 3804 D8E6.tmp 3820 D944.tmp 1072 D9C1.tmp 3320 DA2E.tmp 3664 DA7D.tmp 1916 DAEA.tmp 1716 DB48.tmp 3324 DB96.tmp 1576 DC03.tmp 1692 DC61.tmp 2144 DCCE.tmp 1984 DD3C.tmp 2328 DD99.tmp 740 DDF7.tmp 2876 DE55.tmp 4620 DED2.tmp 3852 DF20.tmp 552 DF6E.tmp 4248 DFCC.tmp 2156 E01A.tmp 4256 E078.tmp 5000 E0C6.tmp 3496 E124.tmp 2136 E172.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E412.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 287D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 358D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A53F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 141B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1723.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 2444 4124 2026-08-21_2ca62ced7679b8bd7bc5fc5b9f22d52c_elex_mafia.exe 86 PID 2444 wrote to memory of 2528 2444 C213.tmp 87 PID 2528 wrote to memory of 4852 2528 C2DE.tmp 88 PID 4852 wrote to memory of 1416 4852 C38A.tmp 89 PID 1416 wrote to memory of 4008 1416 C435.tmp 90 PID 4008 wrote to memory of 2808 4008 C501.tmp 91 PID 2808 wrote to memory of 3948 2808 C58D.tmp 92 PID 3948 wrote to memory of 3020 3948 C5FB.tmp 93 PID 3020 wrote to memory of 3816 3020 C678.tmp 94 PID 3816 wrote to memory of 4900 3816 C723.tmp 95 PID 4900 wrote to memory of 4536 4900 C7C0.tmp 96 PID 4536 wrote to memory of 1580 4536 C82D.tmp 97 PID 1580 wrote to memory of 2620 1580 C8AA.tmp 98 PID 2620 wrote to memory of 2392 2620 C946.tmp 99 PID 2392 wrote to memory of 3808 2392 C9F2.tmp 100 PID 3808 wrote to memory of 1840 3808 CA7F.tmp 101 PID 1840 wrote to memory of 704 1840 CB3A.tmp 102 PID 704 wrote to memory of 3208 704 CBE6.tmp 103 PID 3208 wrote to memory of 1012 3208 CC73.tmp 104 PID 1012 wrote to memory of 3068 1012 CD1F.tmp 105 PID 3068 wrote to memory of 3532 3068 CDBB.tmp 106 PID 3532 wrote to memory of 1172 3532 CE57.tmp 107 PID 1172 wrote to memory of 1432 1172 CED4.tmp 108 PID 1432 wrote to memory of 1680 1432 CF70.tmp 109 PID 1680 wrote to memory of 3124 1680 D00D.tmp 110 PID 3124 wrote to memory of 2920 3124 D07A.tmp 111 PID 2920 wrote to memory of 396 2920 D145.tmp 112 PID 396 wrote to memory of 1048 396 D1E1.tmp 113 PID 1048 wrote to memory of 1064 1048 D25E.tmp 114 PID 1064 wrote to memory of 4428 1064 D2FB.tmp 115 PID 4428 wrote to memory of 748 4428 D397.tmp 116 PID 748 wrote to memory of 4892 748 D472.tmp 117 PID 4892 wrote to memory of 4860 4892 D4EF.tmp 118 PID 4860 wrote to memory of 636 4860 D5D9.tmp 119 PID 636 wrote to memory of 2948 636 D627.tmp 120 PID 2948 wrote to memory of 2152 2948 D695.tmp 121 PID 2152 wrote to memory of 4520 2152 D702.tmp 122 PID 4520 wrote to memory of 440 4520 D760.tmp 123 PID 440 wrote to memory of 412 440 D7BD.tmp 124 PID 412 wrote to memory of 1608 412 D82B.tmp 125 PID 1608 wrote to memory of 3804 1608 D889.tmp 126 PID 3804 wrote to memory of 3820 3804 D8E6.tmp 127 PID 3820 wrote to memory of 1072 3820 D944.tmp 128 PID 1072 wrote to memory of 3320 1072 D9C1.tmp 129 PID 3320 wrote to memory of 3664 3320 DA2E.tmp 130 PID 3664 wrote to memory of 1916 3664 DA7D.tmp 131 PID 1916 wrote to memory of 1716 1916 DAEA.tmp 132 PID 1716 wrote to memory of 3324 1716 DB48.tmp 133 PID 3324 wrote to memory of 1576 3324 DB96.tmp 134 PID 1576 wrote to memory of 1692 1576 DC03.tmp 135 PID 1692 wrote to memory of 2144 1692 DC61.tmp 136 PID 2144 wrote to memory of 1984 2144 DCCE.tmp 137 PID 1984 wrote to memory of 2328 1984 DD3C.tmp 138 PID 2328 wrote to memory of 740 2328 DD99.tmp 139 PID 740 wrote to memory of 2876 740 DDF7.tmp 140 PID 2876 wrote to memory of 4620 2876 DE55.tmp 141 PID 4620 wrote to memory of 3852 4620 DED2.tmp 142 PID 3852 wrote to memory of 552 3852 DF20.tmp 143 PID 552 wrote to memory of 4248 552 DF6E.tmp 144 PID 4248 wrote to memory of 2156 4248 DFCC.tmp 145 PID 2156 wrote to memory of 4256 2156 E01A.tmp 146 PID 4256 wrote to memory of 5000 4256 E078.tmp 147 PID 5000 wrote to memory of 3496 5000 E0C6.tmp 148 PID 3496 wrote to memory of 2136 3496 E124.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_2ca62ced7679b8bd7bc5fc5b9f22d52c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_2ca62ced7679b8bd7bc5fc5b9f22d52c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\C435.tmp"C:\Users\Admin\AppData\Local\Temp\C435.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\C501.tmp"C:\Users\Admin\AppData\Local\Temp\C501.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C678.tmp"C:\Users\Admin\AppData\Local\Temp\C678.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\CED4.tmp"C:\Users\Admin\AppData\Local\Temp\CED4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\D07A.tmp"C:\Users\Admin\AppData\Local\Temp\D07A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\D145.tmp"C:\Users\Admin\AppData\Local\Temp\D145.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\D25E.tmp"C:\Users\Admin\AppData\Local\Temp\D25E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\D4EF.tmp"C:\Users\Admin\AppData\Local\Temp\D4EF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\D695.tmp"C:\Users\Admin\AppData\Local\Temp\D695.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\D760.tmp"C:\Users\Admin\AppData\Local\Temp\D760.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\D944.tmp"C:\Users\Admin\AppData\Local\Temp\D944.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\DD99.tmp"C:\Users\Admin\AppData\Local\Temp\DD99.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\DED2.tmp"C:\Users\Admin\AppData\Local\Temp\DED2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\DF20.tmp"C:\Users\Admin\AppData\Local\Temp\DF20.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\E01A.tmp"C:\Users\Admin\AppData\Local\Temp\E01A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\E078.tmp"C:\Users\Admin\AppData\Local\Temp\E078.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E124.tmp"C:\Users\Admin\AppData\Local\Temp\E124.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\E172.tmp"C:\Users\Admin\AppData\Local\Temp\E172.tmp"65⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"66⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"67⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"69⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"70⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"71⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\E460.tmp"C:\Users\Admin\AppData\Local\Temp\E460.tmp"73⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"C:\Users\Admin\AppData\Local\Temp\E4AE.tmp"74⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\E50C.tmp"C:\Users\Admin\AppData\Local\Temp\E50C.tmp"75⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\E579.tmp"C:\Users\Admin\AppData\Local\Temp\E579.tmp"76⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"77⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"78⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"79⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"80⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"81⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"82⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"83⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"84⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"85⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"86⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"87⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"88⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"89⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"90⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"91⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"92⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"93⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"94⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\EC5F.tmp"C:\Users\Admin\AppData\Local\Temp\EC5F.tmp"95⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"96⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"97⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\ED49.tmp"C:\Users\Admin\AppData\Local\Temp\ED49.tmp"98⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\ED97.tmp"C:\Users\Admin\AppData\Local\Temp\ED97.tmp"99⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\EE05.tmp"C:\Users\Admin\AppData\Local\Temp\EE05.tmp"100⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\EE62.tmp"C:\Users\Admin\AppData\Local\Temp\EE62.tmp"101⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"102⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"C:\Users\Admin\AppData\Local\Temp\EF2D.tmp"103⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"104⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"105⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\F056.tmp"C:\Users\Admin\AppData\Local\Temp\F056.tmp"106⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"107⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\F0F3.tmp"C:\Users\Admin\AppData\Local\Temp\F0F3.tmp"108⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"109⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"C:\Users\Admin\AppData\Local\Temp\F1DD.tmp"110⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"111⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"112⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"114⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"115⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"116⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\F42F.tmp"C:\Users\Admin\AppData\Local\Temp\F42F.tmp"117⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\F47D.tmp"C:\Users\Admin\AppData\Local\Temp\F47D.tmp"118⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\F4DB.tmp"C:\Users\Admin\AppData\Local\Temp\F4DB.tmp"119⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"120⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"121⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-