Analysis
- max time kernel
150s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 02:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-30_e059d4fdb416275be020f0dc02a929c3_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-30_e059d4fdb416275be020f0dc02a929c3_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-30_e059d4fdb416275be020f0dc02a929c3_elex_mafia.exe
- Size 524KB
- Sample260831-c47hzstema
- SHA256 24455521a42e350f9a812fe057ea80097cb81bdf0356e55051b30ea1bc052276
- MD5 e059d4fdb416275be020f0dc02a929c3
- SHA1 277bf70706d95a15c19f9a7a6f49d90c6a7780ef
- SHA512 dcd9511c86bd0a695816fe25323de7c154da8f11862bf39c84c6fe6e076fdf5837df6d6a4056ca69c293b86262c26509050d3eec24dae594aeffe110d029d70b
- SSDEEP 6144:bDPT5/HMrIlMtDmyzfSyL66Tf79xIeRBSIYJXYWyLTBBUAan3D3idp1/rcj2AUsz:TRyZzqyL66T+INWITBomvVwSGNZ
- TLSH T1FEB4F115B684C432F29211368F66EB61597A7C75AB26A4CB3BC4267E2FB03D1D3B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1232 5C92.tmp 1864 5D6D.tmp 5028 5E77.tmp 2052 5F90.tmp 2232 607A.tmp 2844 6155.tmp 2624 6201.tmp 916 62FB.tmp 2724 6433.tmp 2972 650E.tmp 3968 65E9.tmp 4932 66C4.tmp 3068 678F.tmp 2824 6898.tmp 4700 6973.tmp 1308 6A0F.tmp 5092 6B19.tmp 4044 6C23.tmp 116 6D2C.tmp 2364 6E26.tmp 5040 6EE2.tmp 2208 6FCC.tmp 5012 7078.tmp 4812 7182.tmp 3592 729B.tmp 876 7395.tmp 2692 7460.tmp 4576 752B.tmp 3472 7635.tmp 4884 772F.tmp 3328 7829.tmp 4840 7903.tmp 1860 79EE.tmp 4328 7A7A.tmp 3588 7B36.tmp 2904 7BD2.tmp 1128 7C6E.tmp 4420 7CFB.tmp 1104 7D78.tmp 3772 7E05.tmp 2908 7E91.tmp 2144 7F0E.tmp 4072 7FBA.tmp 3860 8047.tmp 4124 80D3.tmp 4552 817F.tmp 2348 81FC.tmp 4260 8279.tmp 4168 82E7.tmp 1640 8364.tmp 1776 83C1.tmp 1760 8410.tmp 680 845E.tmp 1256 84AC.tmp 3984 8519.tmp 4816 8567.tmp 5084 85B5.tmp 3512 8604.tmp 3580 8652.tmp 896 86A0.tmp 900 86DE.tmp 1952 872C.tmp 3284 877B.tmp 3516 87C9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 772F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B30F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 115B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A275.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A16B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C290.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B179.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA3A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 1232 4936 2026-08-30_e059d4fdb416275be020f0dc02a929c3_elex_mafia.exe 84 PID 1232 wrote to memory of 1864 1232 5C92.tmp 85 PID 1864 wrote to memory of 5028 1864 5D6D.tmp 86 PID 5028 wrote to memory of 2052 5028 5E77.tmp 87 PID 2052 wrote to memory of 2232 2052 5F90.tmp 88 PID 2232 wrote to memory of 2844 2232 607A.tmp 89 PID 2844 wrote to memory of 2624 2844 6155.tmp 90 PID 2624 wrote to memory of 916 2624 6201.tmp 91 PID 916 wrote to memory of 2724 916 62FB.tmp 92 PID 2724 wrote to memory of 2972 2724 6433.tmp 93 PID 2972 wrote to memory of 3968 2972 650E.tmp 94 PID 3968 wrote to memory of 4932 3968 65E9.tmp 95 PID 4932 wrote to memory of 3068 4932 66C4.tmp 96 PID 3068 wrote to memory of 2824 3068 678F.tmp 97 PID 2824 wrote to memory of 4700 2824 6898.tmp 99 PID 4700 wrote to memory of 1308 4700 6973.tmp 100 PID 1308 wrote to memory of 5092 1308 6A0F.tmp 103 PID 5092 wrote to memory of 4044 5092 6B19.tmp 104 PID 4044 wrote to memory of 116 4044 6C23.tmp 106 PID 116 wrote to memory of 2364 116 6D2C.tmp 107 PID 2364 wrote to memory of 5040 2364 6E26.tmp 109 PID 5040 wrote to memory of 2208 5040 6EE2.tmp 110 PID 2208 wrote to memory of 5012 2208 6FCC.tmp 111 PID 5012 wrote to memory of 4812 5012 7078.tmp 112 PID 4812 wrote to memory of 3592 4812 7182.tmp 113 PID 3592 wrote to memory of 876 3592 729B.tmp 114 PID 876 wrote to memory of 2692 876 7395.tmp 115 PID 2692 wrote to memory of 4576 2692 7460.tmp 116 PID 4576 wrote to memory of 3472 4576 752B.tmp 117 PID 3472 wrote to memory of 4884 3472 7635.tmp 118 PID 4884 wrote to memory of 3328 4884 772F.tmp 119 PID 3328 wrote to memory of 4840 3328 7829.tmp 120 PID 4840 wrote to memory of 1860 4840 7903.tmp 121 PID 1860 wrote to memory of 4328 1860 79EE.tmp 122 PID 4328 wrote to memory of 3588 4328 7A7A.tmp 123 PID 3588 wrote to memory of 2904 3588 7B36.tmp 124 PID 2904 wrote to memory of 1128 2904 7BD2.tmp 125 PID 1128 wrote to memory of 4420 1128 7C6E.tmp 126 PID 4420 wrote to memory of 1104 4420 7CFB.tmp 127 PID 1104 wrote to memory of 3772 1104 7D78.tmp 128 PID 3772 wrote to memory of 2908 3772 7E05.tmp 129 PID 2908 wrote to memory of 2144 2908 7E91.tmp 130 PID 2144 wrote to memory of 4072 2144 7F0E.tmp 131 PID 4072 wrote to memory of 3860 4072 7FBA.tmp 132 PID 3860 wrote to memory of 4124 3860 8047.tmp 133 PID 4124 wrote to memory of 4552 4124 80D3.tmp 134 PID 4552 wrote to memory of 2348 4552 817F.tmp 135 PID 2348 wrote to memory of 4260 2348 81FC.tmp 136 PID 4260 wrote to memory of 4168 4260 8279.tmp 137 PID 4168 wrote to memory of 1640 4168 82E7.tmp 138 PID 1640 wrote to memory of 1776 1640 8364.tmp 139 PID 1776 wrote to memory of 1760 1776 83C1.tmp 140 PID 1760 wrote to memory of 680 1760 8410.tmp 141 PID 680 wrote to memory of 1256 680 845E.tmp 142 PID 1256 wrote to memory of 3984 1256 84AC.tmp 143 PID 3984 wrote to memory of 4816 3984 8519.tmp 144 PID 4816 wrote to memory of 5084 4816 8567.tmp 145 PID 5084 wrote to memory of 3512 5084 85B5.tmp 146 PID 3512 wrote to memory of 3580 3512 8604.tmp 147 PID 3580 wrote to memory of 896 3580 8652.tmp 148 PID 896 wrote to memory of 900 896 86A0.tmp 149 PID 900 wrote to memory of 1952 900 86DE.tmp 150 PID 1952 wrote to memory of 3284 1952 872C.tmp 151 PID 3284 wrote to memory of 3516 3284 877B.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_e059d4fdb416275be020f0dc02a929c3_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_e059d4fdb416275be020f0dc02a929c3_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7182.tmp"C:\Users\Admin\AppData\Local\Temp\7182.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\772F.tmp"C:\Users\Admin\AppData\Local\Temp\772F.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\7903.tmp"C:\Users\Admin\AppData\Local\Temp\7903.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\7E91.tmp"C:\Users\Admin\AppData\Local\Temp\7E91.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\8364.tmp"C:\Users\Admin\AppData\Local\Temp\8364.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\8519.tmp"C:\Users\Admin\AppData\Local\Temp\8519.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8604.tmp"C:\Users\Admin\AppData\Local\Temp\8604.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"65⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\8817.tmp"C:\Users\Admin\AppData\Local\Temp\8817.tmp"66⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"68⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"70⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"71⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"72⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"74⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"C:\Users\Admin\AppData\Local\Temp\8AD6.tmp"75⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"76⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\8B82.tmp"C:\Users\Admin\AppData\Local\Temp\8B82.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"C:\Users\Admin\AppData\Local\Temp\8BD0.tmp"78⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"C:\Users\Admin\AppData\Local\Temp\8C1E.tmp"79⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"80⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"81⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"82⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"83⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"84⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"85⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"86⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"87⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\8EED.tmp"C:\Users\Admin\AppData\Local\Temp\8EED.tmp"88⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"89⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\8F89.tmp"C:\Users\Admin\AppData\Local\Temp\8F89.tmp"90⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"91⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9025.tmp"C:\Users\Admin\AppData\Local\Temp\9025.tmp"92⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\9093.tmp"C:\Users\Admin\AppData\Local\Temp\9093.tmp"93⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"94⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\912F.tmp"C:\Users\Admin\AppData\Local\Temp\912F.tmp"95⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"96⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"97⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\9219.tmp"C:\Users\Admin\AppData\Local\Temp\9219.tmp"98⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\9267.tmp"C:\Users\Admin\AppData\Local\Temp\9267.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\92B6.tmp"C:\Users\Admin\AppData\Local\Temp\92B6.tmp"100⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"101⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\9361.tmp"C:\Users\Admin\AppData\Local\Temp\9361.tmp"102⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\93B0.tmp"C:\Users\Admin\AppData\Local\Temp\93B0.tmp"103⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"104⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9815.tmp"C:\Users\Admin\AppData\Local\Temp\9815.tmp"105⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\9863.tmp"C:\Users\Admin\AppData\Local\Temp\9863.tmp"106⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\98B1.tmp"C:\Users\Admin\AppData\Local\Temp\98B1.tmp"107⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"108⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\995D.tmp"C:\Users\Admin\AppData\Local\Temp\995D.tmp"109⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"110⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\9A09.tmp"C:\Users\Admin\AppData\Local\Temp\9A09.tmp"111⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\9A76.tmp"C:\Users\Admin\AppData\Local\Temp\9A76.tmp"112⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"113⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\9B12.tmp"C:\Users\Admin\AppData\Local\Temp\9B12.tmp"114⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"115⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"116⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"C:\Users\Admin\AppData\Local\Temp\9BFD.tmp"117⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"118⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"119⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\9D16.tmp"C:\Users\Admin\AppData\Local\Temp\9D16.tmp"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\9D64.tmp"C:\Users\Admin\AppData\Local\Temp\9D64.tmp"121⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"122⤵PID:3332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-