Analysis
- max time kernel
124s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_a807d982399d70a1d4bfcdff9da565eb_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-07_a807d982399d70a1d4bfcdff9da565eb_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-09-07_a807d982399d70a1d4bfcdff9da565eb_elex_mafia.exe
- Size 520KB
- Sample260908-kqdmraec79
- SHA256 b4cce066facddbd965c317e6b159e51d07b80a37bfdd634a0c7fe4122c74603d
- MD5 a807d982399d70a1d4bfcdff9da565eb
- SHA1 2231ed487c2a1c1b8535a63e114cf5cd5aeff3ae
- SHA512 c50da03c7a22a7a33dab5729e5dc0e61f94328fed5b681aa1b6b0a02cd437aa2e73e21a58f2f0f68a366a0f488f3e0296ebe1ad1455d55507db78ef3daa7654b
- SSDEEP 12288:gj8fuxR21t5i8fsWjJeanxuTTPl1hnKNZ6:gj8fuK1GYzEa8TTPl11KNI
- TLSH T14FB4F112B544C032E9D316310B66DBA20BBE7D799B2691C33BD4266E7FF52C1963834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1960 DACB.tmp 2044 DBA5.tmp 3404 DC9F.tmp 5620 DDE8.tmp 4396 DF01.tmp 5408 DF8D.tmp 5892 E068.tmp 1964 E114.tmp 2296 E1C0.tmp 2600 E2BA.tmp 976 E375.tmp 4156 E46F.tmp 1460 E52B.tmp 1228 E5E6.tmp 2412 E700.tmp 4504 E7AC.tmp 5780 E848.tmp 2300 E923.tmp 4896 E9BF.tmp 244 EA9A.tmp 1836 EB45.tmp 4272 EC20.tmp 4588 ECEB.tmp 5808 ED88.tmp 2476 EE43.tmp 1500 EEFF.tmp 5284 EFCA.tmp 1096 F047.tmp 2868 F102.tmp 4092 F18F.tmp 1320 F23B.tmp 3284 F315.tmp 4296 F400.tmp 5512 F47D.tmp 3440 F519.tmp 1124 F5C5.tmp 2464 F661.tmp 540 F71D.tmp 1700 F7A9.tmp 5412 F836.tmp 3388 F8D2.tmp 4696 F98E.tmp 5792 FA1A.tmp 2500 FAC6.tmp 1076 FB53.tmp 2828 FBEF.tmp 5148 FC8B.tmp 4664 FD66.tmp 1088 FDF3.tmp 2028 FE7F.tmp 1272 FEFC.tmp 3024 FFB8.tmp 1172 64.tmp 1704 100.tmp 3592 17D.tmp 1352 219.tmp 840 2B5.tmp 4264 342.tmp 1444 3EE.tmp 5664 49A.tmp 2248 536.tmp 1388 5C3.tmp 3684 67E.tmp 5700 6FB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 267A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B82B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3167.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F18A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 349E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 883C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6075.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1960 1488 2026-09-07_a807d982399d70a1d4bfcdff9da565eb_elex_mafia.exe 89 PID 1960 wrote to memory of 2044 1960 DACB.tmp 90 PID 2044 wrote to memory of 3404 2044 DBA5.tmp 91 PID 3404 wrote to memory of 5620 3404 DC9F.tmp 92 PID 5620 wrote to memory of 4396 5620 DDE8.tmp 93 PID 4396 wrote to memory of 5408 4396 DF01.tmp 94 PID 5408 wrote to memory of 5892 5408 DF8D.tmp 95 PID 5892 wrote to memory of 1964 5892 E068.tmp 96 PID 1964 wrote to memory of 2296 1964 E114.tmp 97 PID 2296 wrote to memory of 2600 2296 E1C0.tmp 98 PID 2600 wrote to memory of 976 2600 E2BA.tmp 99 PID 976 wrote to memory of 4156 976 E375.tmp 100 PID 4156 wrote to memory of 1460 4156 E46F.tmp 101 PID 1460 wrote to memory of 1228 1460 E52B.tmp 102 PID 1228 wrote to memory of 2412 1228 E5E6.tmp 103 PID 2412 wrote to memory of 4504 2412 E700.tmp 104 PID 4504 wrote to memory of 5780 4504 E7AC.tmp 105 PID 5780 wrote to memory of 2300 5780 E848.tmp 106 PID 2300 wrote to memory of 4896 2300 E923.tmp 107 PID 4896 wrote to memory of 244 4896 E9BF.tmp 108 PID 244 wrote to memory of 1836 244 EA9A.tmp 109 PID 1836 wrote to memory of 4272 1836 EB45.tmp 110 PID 4272 wrote to memory of 4588 4272 EC20.tmp 111 PID 4588 wrote to memory of 5808 4588 ECEB.tmp 112 PID 5808 wrote to memory of 2476 5808 ED88.tmp 113 PID 2476 wrote to memory of 1500 2476 EE43.tmp 114 PID 1500 wrote to memory of 5284 1500 EEFF.tmp 115 PID 5284 wrote to memory of 1096 5284 EFCA.tmp 116 PID 1096 wrote to memory of 2868 1096 F047.tmp 117 PID 2868 wrote to memory of 4092 2868 F102.tmp 118 PID 4092 wrote to memory of 1320 4092 F18F.tmp 119 PID 1320 wrote to memory of 3284 1320 F23B.tmp 120 PID 3284 wrote to memory of 4296 3284 F315.tmp 121 PID 4296 wrote to memory of 5512 4296 F400.tmp 122 PID 5512 wrote to memory of 3440 5512 F47D.tmp 123 PID 3440 wrote to memory of 1124 3440 F519.tmp 124 PID 1124 wrote to memory of 2464 1124 F5C5.tmp 125 PID 2464 wrote to memory of 540 2464 F661.tmp 126 PID 540 wrote to memory of 1700 540 F71D.tmp 127 PID 1700 wrote to memory of 5412 1700 F7A9.tmp 128 PID 5412 wrote to memory of 3388 5412 F836.tmp 129 PID 3388 wrote to memory of 4696 3388 F8D2.tmp 130 PID 4696 wrote to memory of 5792 4696 F98E.tmp 131 PID 5792 wrote to memory of 2500 5792 FA1A.tmp 132 PID 2500 wrote to memory of 1076 2500 FAC6.tmp 133 PID 1076 wrote to memory of 2828 1076 FB53.tmp 134 PID 2828 wrote to memory of 5148 2828 FBEF.tmp 135 PID 5148 wrote to memory of 4664 5148 FC8B.tmp 136 PID 4664 wrote to memory of 1088 4664 FD66.tmp 137 PID 1088 wrote to memory of 2028 1088 FDF3.tmp 138 PID 2028 wrote to memory of 1272 2028 FE7F.tmp 139 PID 1272 wrote to memory of 3024 1272 FEFC.tmp 140 PID 3024 wrote to memory of 1172 3024 FFB8.tmp 141 PID 1172 wrote to memory of 1704 1172 64.tmp 142 PID 1704 wrote to memory of 3592 1704 100.tmp 143 PID 3592 wrote to memory of 1352 3592 17D.tmp 144 PID 1352 wrote to memory of 840 1352 219.tmp 145 PID 840 wrote to memory of 4264 840 2B5.tmp 146 PID 4264 wrote to memory of 1444 4264 342.tmp 147 PID 1444 wrote to memory of 5664 1444 3EE.tmp 148 PID 5664 wrote to memory of 2248 5664 49A.tmp 149 PID 2248 wrote to memory of 1388 2248 536.tmp 150 PID 1388 wrote to memory of 3684 1388 5C3.tmp 151 PID 3684 wrote to memory of 5700 3684 67E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_a807d982399d70a1d4bfcdff9da565eb_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_a807d982399d70a1d4bfcdff9da565eb_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\DACB.tmp"C:\Users\Admin\AppData\Local\Temp\DACB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\DC9F.tmp"C:\Users\Admin\AppData\Local\Temp\DC9F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"C:\Users\Admin\AppData\Local\Temp\DF8D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\E375.tmp"C:\Users\Admin\AppData\Local\Temp\E375.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\E52B.tmp"C:\Users\Admin\AppData\Local\Temp\E52B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\E923.tmp"C:\Users\Admin\AppData\Local\Temp\E923.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\EB45.tmp"C:\Users\Admin\AppData\Local\Temp\EB45.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\EC20.tmp"C:\Users\Admin\AppData\Local\Temp\EC20.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\F047.tmp"C:\Users\Admin\AppData\Local\Temp\F047.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\F102.tmp"C:\Users\Admin\AppData\Local\Temp\F102.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\F18F.tmp"C:\Users\Admin\AppData\Local\Temp\F18F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\F315.tmp"C:\Users\Admin\AppData\Local\Temp\F315.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\F47D.tmp"C:\Users\Admin\AppData\Local\Temp\F47D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F836.tmp"C:\Users\Admin\AppData\Local\Temp\F836.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\F98E.tmp"C:\Users\Admin\AppData\Local\Temp\F98E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"C:\Users\Admin\AppData\Local\Temp\FA1A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\FB53.tmp"C:\Users\Admin\AppData\Local\Temp\FB53.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"C:\Users\Admin\AppData\Local\Temp\FDF3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\FEFC.tmp"C:\Users\Admin\AppData\Local\Temp\FEFC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\64.tmp"C:\Users\Admin\AppData\Local\Temp\64.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\100.tmp"C:\Users\Admin\AppData\Local\Temp\100.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\17D.tmp"C:\Users\Admin\AppData\Local\Temp\17D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\219.tmp"C:\Users\Admin\AppData\Local\Temp\219.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\342.tmp"C:\Users\Admin\AppData\Local\Temp\342.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\3EE.tmp"C:\Users\Admin\AppData\Local\Temp\3EE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\49A.tmp"C:\Users\Admin\AppData\Local\Temp\49A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\67E.tmp"C:\Users\Admin\AppData\Local\Temp\67E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\6FB.tmp"C:\Users\Admin\AppData\Local\Temp\6FB.tmp"65⤵
- Executes dropped EXE
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"66⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"67⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\8D0.tmp"C:\Users\Admin\AppData\Local\Temp\8D0.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\97C.tmp"C:\Users\Admin\AppData\Local\Temp\97C.tmp"69⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"71⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B31.tmp"C:\Users\Admin\AppData\Local\Temp\B31.tmp"72⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"73⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\C6A.tmp"C:\Users\Admin\AppData\Local\Temp\C6A.tmp"74⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\CE7.tmp"C:\Users\Admin\AppData\Local\Temp\CE7.tmp"75⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"76⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"78⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"79⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\F96.tmp"C:\Users\Admin\AppData\Local\Temp\F96.tmp"80⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"81⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"82⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"83⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"84⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"85⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\136F.tmp"C:\Users\Admin\AppData\Local\Temp\136F.tmp"86⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\140B.tmp"C:\Users\Admin\AppData\Local\Temp\140B.tmp"87⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"88⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"89⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"90⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"91⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"92⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"93⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:296 -
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"95⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"96⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"97⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"99⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"100⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"C:\Users\Admin\AppData\Local\Temp\1BBC.tmp"101⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1C48.tmp"C:\Users\Admin\AppData\Local\Temp\1C48.tmp"102⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"103⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\1D52.tmp"C:\Users\Admin\AppData\Local\Temp\1D52.tmp"104⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"105⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"C:\Users\Admin\AppData\Local\Temp\1E5C.tmp"106⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"107⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"108⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"109⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"110⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"111⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\21F5.tmp"C:\Users\Admin\AppData\Local\Temp\21F5.tmp"112⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"113⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"114⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\238C.tmp"C:\Users\Admin\AppData\Local\Temp\238C.tmp"115⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp"C:\Users\Admin\AppData\Local\Temp\2428.tmp"116⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\24B5.tmp"C:\Users\Admin\AppData\Local\Temp\24B5.tmp"117⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\2532.tmp"C:\Users\Admin\AppData\Local\Temp\2532.tmp"118⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"119⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\26F7.tmp"C:\Users\Admin\AppData\Local\Temp\26F7.tmp"121⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2774.tmp"C:\Users\Admin\AppData\Local\Temp\2774.tmp"122⤵PID:5436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-