Analysis
- max time kernel
131s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 09:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-01_74624846f9ade0f723797190b20df5ff_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-01_74624846f9ade0f723797190b20df5ff_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-09-01_74624846f9ade0f723797190b20df5ff_elex_mafia.exe
- Size 524KB
- Sample260903-lr3tpsep4z
- SHA256 586b203d0aeef23b36de357df00471959ca39a1b3ce7d61269864dd19f4bdefa
- MD5 74624846f9ade0f723797190b20df5ff
- SHA1 94781180639fa3e248c345816fd94bd445064e26
- SHA512 1a26589e73b5a4afe946f65a4f5a190bcafd4f229ea6d6022ad019880686b42a89e104388ba81e466d951a71b5c12f97ca2ff6b3154c3d543666ce9bd563cd02
- SSDEEP 12288:TRyZzqyL66TWJPhWqJWW73DTPQcF3jNZ:TRyQylTW98qJd3nQyjN
- TLSH T11DB4F015B988C032E2D211728F59EB92193A7C755F2794CB3B95227E6EF03D1D6B830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5080 388B.tmp 3216 3965.tmp 5132 3A6F.tmp 3304 3B59.tmp 4480 3C44.tmp 4236 3D5D.tmp 108 3E76.tmp 2668 3F51.tmp 3260 401C.tmp 3844 4164.tmp 3312 426E.tmp 2260 4349.tmp 1080 4452.tmp 2236 455C.tmp 5940 4675.tmp 2432 4731.tmp 5968 482B.tmp 2512 4905.tmp 3496 49F0.tmp 5932 4AF9.tmp 2504 4BC5.tmp 5532 4CBF.tmp 3068 4D7A.tmp 1520 4E84.tmp 1652 4F7E.tmp 2880 5058.tmp 5096 5124.tmp 6028 526C.tmp 3668 53B4.tmp 4580 54AE.tmp 3380 55B7.tmp 3140 56E0.tmp 3736 57FA.tmp 3512 58D4.tmp 2640 5971.tmp 5148 59DE.tmp 4116 5A6B.tmp 4536 5B16.tmp 4520 5BB3.tmp 6076 5C6E.tmp 1908 5D1A.tmp 5664 5DA7.tmp 748 5E81.tmp 4740 5EFE.tmp 2032 5FD9.tmp 2848 6066.tmp 3460 60F2.tmp 3892 617F.tmp 2400 622B.tmp 3336 62C7.tmp 1612 6344.tmp 5064 63D1.tmp 5732 643E.tmp 5424 64BB.tmp 4860 6557.tmp 1004 65D4.tmp 4796 6651.tmp 4500 66BF.tmp 120 675B.tmp 236 67C8.tmp 1604 6845.tmp 4128 68C2.tmp 5752 695F.tmp 1216 69CC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 441F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 376D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 101E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE21.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5260 wrote to memory of 5080 5260 2026-09-01_74624846f9ade0f723797190b20df5ff_elex_mafia.exe 89 PID 5080 wrote to memory of 3216 5080 388B.tmp 90 PID 3216 wrote to memory of 5132 3216 3965.tmp 91 PID 5132 wrote to memory of 3304 5132 3A6F.tmp 92 PID 3304 wrote to memory of 4480 3304 3B59.tmp 93 PID 4480 wrote to memory of 4236 4480 3C44.tmp 94 PID 4236 wrote to memory of 108 4236 3D5D.tmp 95 PID 108 wrote to memory of 2668 108 3E76.tmp 96 PID 2668 wrote to memory of 3260 2668 3F51.tmp 97 PID 3260 wrote to memory of 3844 3260 401C.tmp 98 PID 3844 wrote to memory of 3312 3844 4164.tmp 99 PID 3312 wrote to memory of 2260 3312 426E.tmp 100 PID 2260 wrote to memory of 1080 2260 4349.tmp 101 PID 1080 wrote to memory of 2236 1080 4452.tmp 102 PID 2236 wrote to memory of 5940 2236 455C.tmp 103 PID 5940 wrote to memory of 2432 5940 4675.tmp 104 PID 2432 wrote to memory of 5968 2432 4731.tmp 105 PID 5968 wrote to memory of 2512 5968 482B.tmp 106 PID 2512 wrote to memory of 3496 2512 4905.tmp 107 PID 3496 wrote to memory of 5932 3496 49F0.tmp 108 PID 5932 wrote to memory of 2504 5932 4AF9.tmp 109 PID 2504 wrote to memory of 5532 2504 4BC5.tmp 110 PID 5532 wrote to memory of 3068 5532 4CBF.tmp 111 PID 3068 wrote to memory of 1520 3068 4D7A.tmp 112 PID 1520 wrote to memory of 1652 1520 4E84.tmp 113 PID 1652 wrote to memory of 2880 1652 4F7E.tmp 114 PID 2880 wrote to memory of 5096 2880 5058.tmp 115 PID 5096 wrote to memory of 6028 5096 5124.tmp 116 PID 6028 wrote to memory of 3668 6028 526C.tmp 117 PID 3668 wrote to memory of 4580 3668 53B4.tmp 118 PID 4580 wrote to memory of 3380 4580 54AE.tmp 119 PID 3380 wrote to memory of 3140 3380 55B7.tmp 120 PID 3140 wrote to memory of 3736 3140 56E0.tmp 121 PID 3736 wrote to memory of 3512 3736 57FA.tmp 122 PID 3512 wrote to memory of 2640 3512 58D4.tmp 123 PID 2640 wrote to memory of 5148 2640 5971.tmp 124 PID 5148 wrote to memory of 4116 5148 59DE.tmp 125 PID 4116 wrote to memory of 4536 4116 5A6B.tmp 126 PID 4536 wrote to memory of 4520 4536 5B16.tmp 127 PID 4520 wrote to memory of 6076 4520 5BB3.tmp 128 PID 6076 wrote to memory of 1908 6076 5C6E.tmp 129 PID 1908 wrote to memory of 5664 1908 5D1A.tmp 130 PID 5664 wrote to memory of 748 5664 5DA7.tmp 131 PID 748 wrote to memory of 4740 748 5E81.tmp 132 PID 4740 wrote to memory of 2032 4740 5EFE.tmp 133 PID 2032 wrote to memory of 2848 2032 5FD9.tmp 134 PID 2848 wrote to memory of 3460 2848 6066.tmp 135 PID 3460 wrote to memory of 3892 3460 60F2.tmp 136 PID 3892 wrote to memory of 2400 3892 617F.tmp 137 PID 2400 wrote to memory of 3336 2400 622B.tmp 138 PID 3336 wrote to memory of 1612 3336 62C7.tmp 139 PID 1612 wrote to memory of 5064 1612 6344.tmp 140 PID 5064 wrote to memory of 5732 5064 63D1.tmp 141 PID 5732 wrote to memory of 5424 5732 643E.tmp 142 PID 5424 wrote to memory of 4860 5424 64BB.tmp 143 PID 4860 wrote to memory of 1004 4860 6557.tmp 144 PID 1004 wrote to memory of 4796 1004 65D4.tmp 145 PID 4796 wrote to memory of 4500 4796 6651.tmp 146 PID 4500 wrote to memory of 120 4500 66BF.tmp 147 PID 120 wrote to memory of 236 120 675B.tmp 148 PID 236 wrote to memory of 1604 236 67C8.tmp 149 PID 1604 wrote to memory of 4128 1604 6845.tmp 150 PID 4128 wrote to memory of 5752 4128 68C2.tmp 151 PID 5752 wrote to memory of 1216 5752 695F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_74624846f9ade0f723797190b20df5ff_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_74624846f9ade0f723797190b20df5ff_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\388B.tmp"C:\Users\Admin\AppData\Local\Temp\388B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\3C44.tmp"C:\Users\Admin\AppData\Local\Temp\3C44.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4452.tmp"C:\Users\Admin\AppData\Local\Temp\4452.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4E84.tmp"C:\Users\Admin\AppData\Local\Temp\4E84.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\53B4.tmp"C:\Users\Admin\AppData\Local\Temp\53B4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\54AE.tmp"C:\Users\Admin\AppData\Local\Temp\54AE.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\55B7.tmp"C:\Users\Admin\AppData\Local\Temp\55B7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\56E0.tmp"C:\Users\Admin\AppData\Local\Temp\56E0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\58D4.tmp"C:\Users\Admin\AppData\Local\Temp\58D4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5BB3.tmp"C:\Users\Admin\AppData\Local\Temp\5BB3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\5E81.tmp"C:\Users\Admin\AppData\Local\Temp\5E81.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6066.tmp"C:\Users\Admin\AppData\Local\Temp\6066.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\60F2.tmp"C:\Users\Admin\AppData\Local\Temp\60F2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\622B.tmp"C:\Users\Admin\AppData\Local\Temp\622B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\62C7.tmp"C:\Users\Admin\AppData\Local\Temp\62C7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\6344.tmp"C:\Users\Admin\AppData\Local\Temp\6344.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\63D1.tmp"C:\Users\Admin\AppData\Local\Temp\63D1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\643E.tmp"C:\Users\Admin\AppData\Local\Temp\643E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\64BB.tmp"C:\Users\Admin\AppData\Local\Temp\64BB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\68C2.tmp"C:\Users\Admin\AppData\Local\Temp\68C2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\695F.tmp"C:\Users\Admin\AppData\Local\Temp\695F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\69CC.tmp"C:\Users\Admin\AppData\Local\Temp\69CC.tmp"65⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"66⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"67⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"68⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"69⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"70⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"71⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\6D18.tmp"C:\Users\Admin\AppData\Local\Temp\6D18.tmp"72⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\6D95.tmp"C:\Users\Admin\AppData\Local\Temp\6D95.tmp"73⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6E02.tmp"C:\Users\Admin\AppData\Local\Temp\6E02.tmp"74⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"75⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"76⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6F79.tmp"C:\Users\Admin\AppData\Local\Temp\6F79.tmp"77⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"78⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\7064.tmp"C:\Users\Admin\AppData\Local\Temp\7064.tmp"79⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"80⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\715E.tmp"C:\Users\Admin\AppData\Local\Temp\715E.tmp"81⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\71EA.tmp"C:\Users\Admin\AppData\Local\Temp\71EA.tmp"82⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"83⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:976 -
C:\Users\Admin\AppData\Local\Temp\7380.tmp"C:\Users\Admin\AppData\Local\Temp\7380.tmp"85⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\73FD.tmp"C:\Users\Admin\AppData\Local\Temp\73FD.tmp"86⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"87⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"88⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7574.tmp"C:\Users\Admin\AppData\Local\Temp\7574.tmp"89⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"90⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\767E.tmp"C:\Users\Admin\AppData\Local\Temp\767E.tmp"91⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"92⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7788.tmp"C:\Users\Admin\AppData\Local\Temp\7788.tmp"93⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\77F5.tmp"C:\Users\Admin\AppData\Local\Temp\77F5.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"95⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"96⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"97⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"98⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\7A66.tmp"C:\Users\Admin\AppData\Local\Temp\7A66.tmp"99⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"100⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"102⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"103⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"104⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"105⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"C:\Users\Admin\AppData\Local\Temp\7E4E.tmp"106⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"107⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"109⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"110⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"111⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"112⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"113⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"114⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\8340.tmp"C:\Users\Admin\AppData\Local\Temp\8340.tmp"115⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"116⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"117⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\84F5.tmp"C:\Users\Admin\AppData\Local\Temp\84F5.tmp"118⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\8591.tmp"C:\Users\Admin\AppData\Local\Temp\8591.tmp"119⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"120⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"121⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\8776.tmp"C:\Users\Admin\AppData\Local\Temp\8776.tmp"122⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-