Analysis
- max time kernel
124s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe
- Size 561KB
- Sample260908-gr4zjssfpg
- SHA256 1b66ef2e7e201c6375a999c0b43131d7e2a5ca681704e6f2e087e6487f9696ab
- MD5 c85417670a8f941865f013745825280e
- SHA1 a2357a2839c4d0fb4043c06ac69be210ca96a179
- SHA512 de4a3c6372c0824845d743c38e433c566829e81211f91d7179890d10a0efb7c209dfa6821e0e634540dd5c737ce92afdee3723ae1cb80caf5265476d547b5ac8
- SSDEEP 12288:VuelPWET0yhkDF1iP49JGdzKhrw1IGkADZuL:8eEEvhkJ1mjzKh4vkADoL
- TLSH T120C4D011B2D8C435F5F31A344AF49BA2097B7D625B35D9CF2788266D2EB12D0EA38713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6052 F19.tmp 3288 FE4.tmp 5756 10B0.tmp 3344 113C.tmp 4592 11F8.tmp 4660 1275.tmp 3840 135F.tmp 4544 1478.tmp 2156 1534.tmp 3596 15FF.tmp 3088 16E9.tmp 1864 17E3.tmp 2644 188F.tmp 4964 190C.tmp 2976 19A8.tmp 3180 1A74.tmp 5000 1B3F.tmp 256 1BBC.tmp 4764 1C48.tmp 3380 1D23.tmp 1940 1DDF.tmp 4796 1EB9.tmp 5052 1F36.tmp 3820 1FD3.tmp 1124 206F.tmp 3580 212A.tmp 6068 21C7.tmp 5380 2292.tmp 3884 234D.tmp 1356 23E9.tmp 5092 2495.tmp 2728 2551.tmp 5628 261C.tmp 2300 2699.tmp 2104 2706.tmp 5652 2783.tmp 5792 2810.tmp 2720 288D.tmp 3696 291A.tmp 1920 29A6.tmp 4324 2A23.tmp 4692 2A91.tmp 2432 2B0E.tmp 2648 2B7B.tmp 5780 2C08.tmp 4392 2C75.tmp 6088 2CF2.tmp 4844 2D8E.tmp 5816 2E1B.tmp 3208 2E98.tmp 2836 2F15.tmp 3376 2F92.tmp 816 2FFF.tmp 2288 306D.tmp 1964 30EA.tmp 3944 3176.tmp 2968 3203.tmp 5760 3270.tmp 4948 32FD.tmp 4488 337A.tmp 2608 33E7.tmp 1380 3483.tmp 4860 3500.tmp 5332 358D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 337A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A34B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 6052 4608 2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe 89 PID 6052 wrote to memory of 3288 6052 F19.tmp 90 PID 3288 wrote to memory of 5756 3288 FE4.tmp 91 PID 5756 wrote to memory of 3344 5756 10B0.tmp 92 PID 3344 wrote to memory of 4592 3344 113C.tmp 93 PID 4592 wrote to memory of 4660 4592 11F8.tmp 94 PID 4660 wrote to memory of 3840 4660 1275.tmp 95 PID 3840 wrote to memory of 4544 3840 135F.tmp 96 PID 4544 wrote to memory of 2156 4544 1478.tmp 97 PID 2156 wrote to memory of 3596 2156 1534.tmp 98 PID 3596 wrote to memory of 3088 3596 15FF.tmp 99 PID 3088 wrote to memory of 1864 3088 16E9.tmp 100 PID 1864 wrote to memory of 2644 1864 17E3.tmp 101 PID 2644 wrote to memory of 4964 2644 188F.tmp 102 PID 4964 wrote to memory of 2976 4964 190C.tmp 103 PID 2976 wrote to memory of 3180 2976 19A8.tmp 104 PID 3180 wrote to memory of 5000 3180 1A74.tmp 105 PID 5000 wrote to memory of 256 5000 1B3F.tmp 106 PID 256 wrote to memory of 4764 256 1BBC.tmp 107 PID 4764 wrote to memory of 3380 4764 1C48.tmp 108 PID 3380 wrote to memory of 1940 3380 1D23.tmp 109 PID 1940 wrote to memory of 4796 1940 1DDF.tmp 110 PID 4796 wrote to memory of 5052 4796 1EB9.tmp 111 PID 5052 wrote to memory of 3820 5052 1F36.tmp 112 PID 3820 wrote to memory of 1124 3820 1FD3.tmp 113 PID 1124 wrote to memory of 3580 1124 206F.tmp 114 PID 3580 wrote to memory of 6068 3580 212A.tmp 115 PID 6068 wrote to memory of 5380 6068 21C7.tmp 116 PID 5380 wrote to memory of 3884 5380 2292.tmp 117 PID 3884 wrote to memory of 1356 3884 234D.tmp 118 PID 1356 wrote to memory of 5092 1356 23E9.tmp 119 PID 5092 wrote to memory of 2728 5092 2495.tmp 120 PID 2728 wrote to memory of 5628 2728 2551.tmp 121 PID 5628 wrote to memory of 2300 5628 261C.tmp 122 PID 2300 wrote to memory of 2104 2300 2699.tmp 123 PID 2104 wrote to memory of 5652 2104 2706.tmp 124 PID 5652 wrote to memory of 5792 5652 2783.tmp 125 PID 5792 wrote to memory of 2720 5792 2810.tmp 126 PID 2720 wrote to memory of 3696 2720 288D.tmp 127 PID 3696 wrote to memory of 1920 3696 291A.tmp 128 PID 1920 wrote to memory of 4324 1920 29A6.tmp 129 PID 4324 wrote to memory of 4692 4324 2A23.tmp 130 PID 4692 wrote to memory of 2432 4692 2A91.tmp 131 PID 2432 wrote to memory of 2648 2432 2B0E.tmp 132 PID 2648 wrote to memory of 5780 2648 2B7B.tmp 133 PID 5780 wrote to memory of 4392 5780 2C08.tmp 134 PID 4392 wrote to memory of 6088 4392 2C75.tmp 135 PID 6088 wrote to memory of 4844 6088 2CF2.tmp 136 PID 4844 wrote to memory of 5816 4844 2D8E.tmp 137 PID 5816 wrote to memory of 3208 5816 2E1B.tmp 138 PID 3208 wrote to memory of 2836 3208 2E98.tmp 139 PID 2836 wrote to memory of 3376 2836 2F15.tmp 140 PID 3376 wrote to memory of 816 3376 2F92.tmp 141 PID 816 wrote to memory of 2288 816 2FFF.tmp 142 PID 2288 wrote to memory of 1964 2288 306D.tmp 143 PID 1964 wrote to memory of 3944 1964 30EA.tmp 144 PID 3944 wrote to memory of 2968 3944 3176.tmp 145 PID 2968 wrote to memory of 5760 2968 3203.tmp 146 PID 5760 wrote to memory of 4948 5760 3270.tmp 147 PID 4948 wrote to memory of 4488 4948 32FD.tmp 148 PID 4488 wrote to memory of 2608 4488 337A.tmp 149 PID 2608 wrote to memory of 1380 2608 33E7.tmp 150 PID 1380 wrote to memory of 4860 1380 3483.tmp 151 PID 4860 wrote to memory of 5332 4860 3500.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_c85417670a8f941865f013745825280e_elex_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\FE4.tmp"C:\Users\Admin\AppData\Local\Temp\FE4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\113C.tmp"C:\Users\Admin\AppData\Local\Temp\113C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\1275.tmp"C:\Users\Admin\AppData\Local\Temp\1275.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\1478.tmp"C:\Users\Admin\AppData\Local\Temp\1478.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1A74.tmp"C:\Users\Admin\AppData\Local\Temp\1A74.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1D23.tmp"C:\Users\Admin\AppData\Local\Temp\1D23.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"C:\Users\Admin\AppData\Local\Temp\1EB9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\1F36.tmp"C:\Users\Admin\AppData\Local\Temp\1F36.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\206F.tmp"C:\Users\Admin\AppData\Local\Temp\206F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\212A.tmp"C:\Users\Admin\AppData\Local\Temp\212A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\234D.tmp"C:\Users\Admin\AppData\Local\Temp\234D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\2551.tmp"C:\Users\Admin\AppData\Local\Temp\2551.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\261C.tmp"C:\Users\Admin\AppData\Local\Temp\261C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\2699.tmp"C:\Users\Admin\AppData\Local\Temp\2699.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\2810.tmp"C:\Users\Admin\AppData\Local\Temp\2810.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\291A.tmp"C:\Users\Admin\AppData\Local\Temp\291A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\29A6.tmp"C:\Users\Admin\AppData\Local\Temp\29A6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\2A91.tmp"C:\Users\Admin\AppData\Local\Temp\2A91.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\2B0E.tmp"C:\Users\Admin\AppData\Local\Temp\2B0E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\2C75.tmp"C:\Users\Admin\AppData\Local\Temp\2C75.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\2E98.tmp"C:\Users\Admin\AppData\Local\Temp\2E98.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\2F15.tmp"C:\Users\Admin\AppData\Local\Temp\2F15.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"C:\Users\Admin\AppData\Local\Temp\2FFF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\306D.tmp"C:\Users\Admin\AppData\Local\Temp\306D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\3203.tmp"C:\Users\Admin\AppData\Local\Temp\3203.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\32FD.tmp"C:\Users\Admin\AppData\Local\Temp\32FD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"65⤵
- Executes dropped EXE
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"66⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"67⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"68⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\37EE.tmp"C:\Users\Admin\AppData\Local\Temp\37EE.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\385C.tmp"C:\Users\Admin\AppData\Local\Temp\385C.tmp"71⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"72⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"73⤵PID:5156
-
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"74⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\3A31.tmp"C:\Users\Admin\AppData\Local\Temp\3A31.tmp"75⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"76⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"77⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"78⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"79⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"80⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"C:\Users\Admin\AppData\Local\Temp\3D5D.tmp"81⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"82⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"83⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"84⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"85⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"86⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"87⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"88⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\4174.tmp"C:\Users\Admin\AppData\Local\Temp\4174.tmp"89⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"90⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"91⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\42EB.tmp"C:\Users\Admin\AppData\Local\Temp\42EB.tmp"92⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\43F5.tmp"C:\Users\Admin\AppData\Local\Temp\43F5.tmp"94⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\4462.tmp"C:\Users\Admin\AppData\Local\Temp\4462.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"96⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"97⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\45E9.tmp"C:\Users\Admin\AppData\Local\Temp\45E9.tmp"98⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\4666.tmp"C:\Users\Admin\AppData\Local\Temp\4666.tmp"99⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\46D3.tmp"C:\Users\Admin\AppData\Local\Temp\46D3.tmp"100⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"101⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"102⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"103⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\48A8.tmp"C:\Users\Admin\AppData\Local\Temp\48A8.tmp"104⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"105⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"106⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"107⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"108⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\4B09.tmp"C:\Users\Admin\AppData\Local\Temp\4B09.tmp"109⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"110⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"111⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"112⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"C:\Users\Admin\AppData\Local\Temp\4D1C.tmp"113⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"114⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"115⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"116⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\4F10.tmp"C:\Users\Admin\AppData\Local\Temp\4F10.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"C:\Users\Admin\AppData\Local\Temp\4F8D.tmp"118⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\502A.tmp"C:\Users\Admin\AppData\Local\Temp\502A.tmp"119⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"120⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5114.tmp"C:\Users\Admin\AppData\Local\Temp\5114.tmp"121⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\5181.tmp"C:\Users\Admin\AppData\Local\Temp\5181.tmp"122⤵PID:4408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-