Analysis
- max time kernel
120s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_bc3d14e15c2f88a90f1e0f094daa2790_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_bc3d14e15c2f88a90f1e0f094daa2790_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-24_bc3d14e15c2f88a90f1e0f094daa2790_elex_mafia.exe
- Size 520KB
- Sample260924-dk6ysacf29
- SHA256 f48a32321a265815e32c50b57c4a0c96e5490d3ce203bdf53c8d93c398440243
- MD5 bc3d14e15c2f88a90f1e0f094daa2790
- SHA1 9c439b96dd59d6291f27e0b243965e7e1d9a3269
- SHA512 de12f8e06c2febc56e0c657085a752342890df74f142d0db728dce931bf3e10e69cd34b97f09447a53fe1076a1ebade3285a5de3fb9525b5ee81741c78054f2f
- SSDEEP 12288:gj8fuxR21t5i8fDYhw+/FcaI6dBwZcAlFRMPNZ:gj8fuK1GY8hw+iaI4OZcAkN
- TLSH T1A3B4F101B545C036D9E616354B62EBA50BBE3D385B3695C73BC036BE6EB52C2D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3216 3AB.tmp 240 485.tmp 4120 4F3.tmp 2096 5BE.tmp 4360 66A.tmp 4408 745.tmp 5312 82F.tmp 5400 8CB.tmp 5588 987.tmp 4296 A13.tmp 1180 ADE.tmp 4540 C17.tmp 4544 D21.tmp 4784 DBD.tmp 1600 E59.tmp 2796 F34.tmp 4088 FD0.tmp 1204 107C.tmp 624 1147.tmp 1872 1212.tmp 3588 12AE.tmp 5716 136A.tmp 1092 13E7.tmp 4712 14D1.tmp 4272 156E.tmp 6140 1658.tmp 5572 1723.tmp 3940 17FE.tmp 4900 18C9.tmp 5584 1965.tmp 5296 1A30.tmp 2224 1ADC.tmp 2848 1B98.tmp 4840 1C24.tmp 3144 1CA1.tmp 4312 1D0F.tmp 3524 1D8C.tmp 1800 1E18.tmp 5456 1EA5.tmp 4580 1F22.tmp 4052 1F9F.tmp 2980 200C.tmp 1804 207A.tmp 2592 20F7.tmp 5916 2183.tmp 2976 223F.tmp 4352 22EB.tmp 2864 2387.tmp 3548 2414.tmp 5844 24A0.tmp 6096 252D.tmp 1820 25B9.tmp 3068 2646.tmp 1768 26D3.tmp 4848 276F.tmp 2056 27EC.tmp 4924 2869.tmp 5948 28E6.tmp 1628 2973.tmp 1616 29FF.tmp 4824 2A7C.tmp 5532 2B47.tmp 2988 2BD4.tmp 3892 2C70.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 245D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 917E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C07E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 557F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F01E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 949B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9641.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9101.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 542C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 3216 4656 2026-09-24_bc3d14e15c2f88a90f1e0f094daa2790_elex_mafia.exe 90 PID 3216 wrote to memory of 240 3216 3AB.tmp 91 PID 240 wrote to memory of 4120 240 485.tmp 92 PID 4120 wrote to memory of 2096 4120 4F3.tmp 93 PID 2096 wrote to memory of 4360 2096 5BE.tmp 94 PID 4360 wrote to memory of 4408 4360 66A.tmp 95 PID 4408 wrote to memory of 5312 4408 745.tmp 96 PID 5312 wrote to memory of 5400 5312 82F.tmp 97 PID 5400 wrote to memory of 5588 5400 8CB.tmp 98 PID 5588 wrote to memory of 4296 5588 987.tmp 99 PID 4296 wrote to memory of 1180 4296 A13.tmp 100 PID 1180 wrote to memory of 4540 1180 ADE.tmp 101 PID 4540 wrote to memory of 4544 4540 C17.tmp 102 PID 4544 wrote to memory of 4784 4544 D21.tmp 103 PID 4784 wrote to memory of 1600 4784 DBD.tmp 104 PID 1600 wrote to memory of 2796 1600 E59.tmp 105 PID 2796 wrote to memory of 4088 2796 F34.tmp 106 PID 4088 wrote to memory of 1204 4088 FD0.tmp 107 PID 1204 wrote to memory of 624 1204 107C.tmp 108 PID 624 wrote to memory of 1872 624 1147.tmp 109 PID 1872 wrote to memory of 3588 1872 1212.tmp 110 PID 3588 wrote to memory of 5716 3588 12AE.tmp 111 PID 5716 wrote to memory of 1092 5716 136A.tmp 112 PID 1092 wrote to memory of 4712 1092 13E7.tmp 113 PID 4712 wrote to memory of 4272 4712 14D1.tmp 114 PID 4272 wrote to memory of 6140 4272 156E.tmp 115 PID 6140 wrote to memory of 5572 6140 1658.tmp 116 PID 5572 wrote to memory of 3940 5572 1723.tmp 117 PID 3940 wrote to memory of 4900 3940 17FE.tmp 118 PID 4900 wrote to memory of 5584 4900 18C9.tmp 119 PID 5584 wrote to memory of 5296 5584 1965.tmp 120 PID 5296 wrote to memory of 2224 5296 1A30.tmp 121 PID 2224 wrote to memory of 2848 2224 1ADC.tmp 122 PID 2848 wrote to memory of 4840 2848 1B98.tmp 123 PID 4840 wrote to memory of 3144 4840 1C24.tmp 124 PID 3144 wrote to memory of 4312 3144 1CA1.tmp 125 PID 4312 wrote to memory of 3524 4312 1D0F.tmp 126 PID 3524 wrote to memory of 1800 3524 1D8C.tmp 127 PID 1800 wrote to memory of 5456 1800 1E18.tmp 128 PID 5456 wrote to memory of 4580 5456 1EA5.tmp 129 PID 4580 wrote to memory of 4052 4580 1F22.tmp 130 PID 4052 wrote to memory of 2980 4052 1F9F.tmp 131 PID 2980 wrote to memory of 1804 2980 200C.tmp 132 PID 1804 wrote to memory of 2592 1804 207A.tmp 133 PID 2592 wrote to memory of 5916 2592 20F7.tmp 134 PID 5916 wrote to memory of 2976 5916 2183.tmp 135 PID 2976 wrote to memory of 4352 2976 223F.tmp 136 PID 4352 wrote to memory of 2864 4352 22EB.tmp 137 PID 2864 wrote to memory of 3548 2864 2387.tmp 138 PID 3548 wrote to memory of 5844 3548 2414.tmp 139 PID 5844 wrote to memory of 6096 5844 24A0.tmp 140 PID 6096 wrote to memory of 1820 6096 252D.tmp 141 PID 1820 wrote to memory of 3068 1820 25B9.tmp 142 PID 3068 wrote to memory of 1768 3068 2646.tmp 143 PID 1768 wrote to memory of 4848 1768 26D3.tmp 144 PID 4848 wrote to memory of 2056 4848 276F.tmp 145 PID 2056 wrote to memory of 4924 2056 27EC.tmp 146 PID 4924 wrote to memory of 5948 4924 2869.tmp 147 PID 5948 wrote to memory of 1628 5948 28E6.tmp 148 PID 1628 wrote to memory of 1616 1628 2973.tmp 149 PID 1616 wrote to memory of 4824 1616 29FF.tmp 150 PID 4824 wrote to memory of 5532 4824 2A7C.tmp 151 PID 5532 wrote to memory of 2988 5532 2B47.tmp 152 PID 2988 wrote to memory of 3892 2988 2BD4.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_bc3d14e15c2f88a90f1e0f094daa2790_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_bc3d14e15c2f88a90f1e0f094daa2790_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\4F3.tmp"C:\Users\Admin\AppData\Local\Temp\4F3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5BE.tmp"C:\Users\Admin\AppData\Local\Temp\5BE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\66A.tmp"C:\Users\Admin\AppData\Local\Temp\66A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\745.tmp"C:\Users\Admin\AppData\Local\Temp\745.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\82F.tmp"C:\Users\Admin\AppData\Local\Temp\82F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\8CB.tmp"C:\Users\Admin\AppData\Local\Temp\8CB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\E59.tmp"C:\Users\Admin\AppData\Local\Temp\E59.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\107C.tmp"C:\Users\Admin\AppData\Local\Temp\107C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\136A.tmp"C:\Users\Admin\AppData\Local\Temp\136A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\13E7.tmp"C:\Users\Admin\AppData\Local\Temp\13E7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\156E.tmp"C:\Users\Admin\AppData\Local\Temp\156E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\18C9.tmp"C:\Users\Admin\AppData\Local\Temp\18C9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\1965.tmp"C:\Users\Admin\AppData\Local\Temp\1965.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"C:\Users\Admin\AppData\Local\Temp\1ADC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1B98.tmp"C:\Users\Admin\AppData\Local\Temp\1B98.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\1F22.tmp"C:\Users\Admin\AppData\Local\Temp\1F22.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\200C.tmp"C:\Users\Admin\AppData\Local\Temp\200C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\207A.tmp"C:\Users\Admin\AppData\Local\Temp\207A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\20F7.tmp"C:\Users\Admin\AppData\Local\Temp\20F7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2183.tmp"C:\Users\Admin\AppData\Local\Temp\2183.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\22EB.tmp"C:\Users\Admin\AppData\Local\Temp\22EB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\28E6.tmp"C:\Users\Admin\AppData\Local\Temp\28E6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\2973.tmp"C:\Users\Admin\AppData\Local\Temp\2973.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\2B47.tmp"C:\Users\Admin\AppData\Local\Temp\2B47.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"65⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\2CED.tmp"C:\Users\Admin\AppData\Local\Temp\2CED.tmp"66⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"67⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"68⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\2E74.tmp"C:\Users\Admin\AppData\Local\Temp\2E74.tmp"69⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"70⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2F6E.tmp"C:\Users\Admin\AppData\Local\Temp\2F6E.tmp"71⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"72⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\3077.tmp"C:\Users\Admin\AppData\Local\Temp\3077.tmp"73⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"74⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"75⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\325C.tmp"C:\Users\Admin\AppData\Local\Temp\325C.tmp"76⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\3308.tmp"C:\Users\Admin\AppData\Local\Temp\3308.tmp"77⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\33A4.tmp"C:\Users\Admin\AppData\Local\Temp\33A4.tmp"78⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\3450.tmp"C:\Users\Admin\AppData\Local\Temp\3450.tmp"79⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\350B.tmp"C:\Users\Admin\AppData\Local\Temp\350B.tmp"80⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"81⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3605.tmp"C:\Users\Admin\AppData\Local\Temp\3605.tmp"82⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\3682.tmp"C:\Users\Admin\AppData\Local\Temp\3682.tmp"83⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\36FF.tmp"C:\Users\Admin\AppData\Local\Temp\36FF.tmp"84⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\378C.tmp"C:\Users\Admin\AppData\Local\Temp\378C.tmp"85⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3828.tmp"C:\Users\Admin\AppData\Local\Temp\3828.tmp"86⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\38C4.tmp"C:\Users\Admin\AppData\Local\Temp\38C4.tmp"87⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3941.tmp"C:\Users\Admin\AppData\Local\Temp\3941.tmp"88⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\39AF.tmp"C:\Users\Admin\AppData\Local\Temp\39AF.tmp"89⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3A5B.tmp"C:\Users\Admin\AppData\Local\Temp\3A5B.tmp"90⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"C:\Users\Admin\AppData\Local\Temp\3AB8.tmp"91⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\3B35.tmp"C:\Users\Admin\AppData\Local\Temp\3B35.tmp"92⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"93⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3C7E.tmp"C:\Users\Admin\AppData\Local\Temp\3C7E.tmp"94⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"95⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\3D58.tmp"C:\Users\Admin\AppData\Local\Temp\3D58.tmp"96⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"C:\Users\Admin\AppData\Local\Temp\3DE5.tmp"97⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\3E81.tmp"C:\Users\Admin\AppData\Local\Temp\3E81.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"99⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"C:\Users\Admin\AppData\Local\Temp\3F7B.tmp"100⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4017.tmp"C:\Users\Admin\AppData\Local\Temp\4017.tmp"101⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\40A4.tmp"C:\Users\Admin\AppData\Local\Temp\40A4.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\4131.tmp"C:\Users\Admin\AppData\Local\Temp\4131.tmp"103⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\419E.tmp"C:\Users\Admin\AppData\Local\Temp\419E.tmp"104⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\421B.tmp"C:\Users\Admin\AppData\Local\Temp\421B.tmp"105⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\4298.tmp"C:\Users\Admin\AppData\Local\Temp\4298.tmp"106⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\4305.tmp"C:\Users\Admin\AppData\Local\Temp\4305.tmp"107⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\4392.tmp"C:\Users\Admin\AppData\Local\Temp\4392.tmp"108⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\443E.tmp"C:\Users\Admin\AppData\Local\Temp\443E.tmp"109⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\44BB.tmp"C:\Users\Admin\AppData\Local\Temp\44BB.tmp"110⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\4557.tmp"C:\Users\Admin\AppData\Local\Temp\4557.tmp"111⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\45C5.tmp"C:\Users\Admin\AppData\Local\Temp\45C5.tmp"112⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\4651.tmp"C:\Users\Admin\AppData\Local\Temp\4651.tmp"113⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\46CE.tmp"C:\Users\Admin\AppData\Local\Temp\46CE.tmp"114⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\474B.tmp"C:\Users\Admin\AppData\Local\Temp\474B.tmp"115⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\47A9.tmp"C:\Users\Admin\AppData\Local\Temp\47A9.tmp"116⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4826.tmp"C:\Users\Admin\AppData\Local\Temp\4826.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\48A3.tmp"C:\Users\Admin\AppData\Local\Temp\48A3.tmp"118⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\496E.tmp"C:\Users\Admin\AppData\Local\Temp\496E.tmp"119⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"120⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"121⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"122⤵PID:1272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-