Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_98104a2859ff0050afd6f186fea204f9_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_98104a2859ff0050afd6f186fea204f9_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_98104a2859ff0050afd6f186fea204f9_elex_mafia.exe
- Size 524KB
- Sample260930-wxfapsvt9k
- SHA256 e8c3bb3223104f20d81726b0700634e1dd47e50bf38ba5a451fe3ae49673c4b5
- MD5 98104a2859ff0050afd6f186fea204f9
- SHA1 48fe83a5b5586748467d8ba4c5dad078559f6957
- SHA512 43f5c585cb11c8d9545a9eddd207a5719152b003e1ff039ec6233d0b98adce5c0f0e43f1f82d9752e2bd0bf070c5dae681f74cf1de08bdc1f1725236873d350a
- SSDEEP 12288:TRyZzqyL66TdSh1ehv+6KCBlUKGFSLQchnLcEAIzdNZ:TRyQylTdNh2DCrUZaQUJ5N
- TLSH T1C0B4F025BA44C032F29219768B66DB92497E7D75AB2664C73BC4363E2FF03D1D278207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 124 71AC.tmp 5948 72C5.tmp 2888 73FD.tmp 2908 74E8.tmp 5508 75E2.tmp 4864 767E.tmp 1408 7778.tmp 3568 7843.tmp 1064 790E.tmp 5756 79E9.tmp 5388 7AC4.tmp 4200 7BCD.tmp 4980 7C99.tmp 1792 7DB2.tmp 4748 7E8D.tmp 4592 7FA6.tmp 3304 80DE.tmp 4136 81D8.tmp 1348 8301.tmp 812 842A.tmp 2312 8563.tmp 4336 865D.tmp 4912 8728.tmp 2108 8802.tmp 5804 890C.tmp 3440 89E7.tmp 1580 8AE1.tmp 2848 8BFA.tmp 2788 8D42.tmp 4896 8E1D.tmp 4176 8F36.tmp 5176 9040.tmp 5964 9149.tmp 5036 9215.tmp 2528 92B1.tmp 2044 935D.tmp 3184 93DA.tmp 6072 9476.tmp 5392 9503.tmp 1052 959F.tmp 1296 967A.tmp 5916 9706.tmp 2392 9793.tmp 4924 983F.tmp 2440 990A.tmp 2916 99C5.tmp 1392 9A81.tmp 5264 9B4C.tmp 260 9BB9.tmp 636 9C27.tmp 5836 9CA4.tmp 5196 9D21.tmp 4884 9D8E.tmp 5324 9E0B.tmp 3120 9E98.tmp 4324 9F05.tmp 4852 9F72.tmp 5872 9FEF.tmp 3488 A06C.tmp 3364 A0DA.tmp 4444 A157.tmp 4516 A1B5.tmp 4600 A222.tmp 2428 A28F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 784E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8161.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 587D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2116.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5292 wrote to memory of 124 5292 2026-09-29_98104a2859ff0050afd6f186fea204f9_elex_mafia.exe 91 PID 124 wrote to memory of 5948 124 71AC.tmp 92 PID 5948 wrote to memory of 2888 5948 72C5.tmp 93 PID 2888 wrote to memory of 2908 2888 73FD.tmp 94 PID 2908 wrote to memory of 5508 2908 74E8.tmp 95 PID 5508 wrote to memory of 4864 5508 75E2.tmp 96 PID 4864 wrote to memory of 1408 4864 767E.tmp 97 PID 1408 wrote to memory of 3568 1408 7778.tmp 98 PID 3568 wrote to memory of 1064 3568 7843.tmp 99 PID 1064 wrote to memory of 5756 1064 790E.tmp 100 PID 5756 wrote to memory of 5388 5756 79E9.tmp 101 PID 5388 wrote to memory of 4200 5388 7AC4.tmp 102 PID 4200 wrote to memory of 4980 4200 7BCD.tmp 103 PID 4980 wrote to memory of 1792 4980 7C99.tmp 104 PID 1792 wrote to memory of 4748 1792 7DB2.tmp 105 PID 4748 wrote to memory of 4592 4748 7E8D.tmp 106 PID 4592 wrote to memory of 3304 4592 7FA6.tmp 107 PID 3304 wrote to memory of 4136 3304 80DE.tmp 108 PID 4136 wrote to memory of 1348 4136 81D8.tmp 109 PID 1348 wrote to memory of 812 1348 8301.tmp 110 PID 812 wrote to memory of 2312 812 842A.tmp 111 PID 2312 wrote to memory of 4336 2312 8563.tmp 112 PID 4336 wrote to memory of 4912 4336 865D.tmp 113 PID 4912 wrote to memory of 2108 4912 8728.tmp 114 PID 2108 wrote to memory of 5804 2108 8802.tmp 115 PID 5804 wrote to memory of 3440 5804 890C.tmp 116 PID 3440 wrote to memory of 1580 3440 89E7.tmp 117 PID 1580 wrote to memory of 2848 1580 8AE1.tmp 118 PID 2848 wrote to memory of 2788 2848 8BFA.tmp 119 PID 2788 wrote to memory of 4896 2788 8D42.tmp 120 PID 4896 wrote to memory of 4176 4896 8E1D.tmp 121 PID 4176 wrote to memory of 5176 4176 8F36.tmp 122 PID 5176 wrote to memory of 5964 5176 9040.tmp 123 PID 5964 wrote to memory of 5036 5964 9149.tmp 124 PID 5036 wrote to memory of 2528 5036 9215.tmp 125 PID 2528 wrote to memory of 2044 2528 92B1.tmp 126 PID 2044 wrote to memory of 3184 2044 935D.tmp 127 PID 3184 wrote to memory of 6072 3184 93DA.tmp 128 PID 6072 wrote to memory of 5392 6072 9476.tmp 129 PID 5392 wrote to memory of 1052 5392 9503.tmp 130 PID 1052 wrote to memory of 1296 1052 959F.tmp 131 PID 1296 wrote to memory of 5916 1296 967A.tmp 132 PID 5916 wrote to memory of 2392 5916 9706.tmp 133 PID 2392 wrote to memory of 4924 2392 9793.tmp 134 PID 4924 wrote to memory of 2440 4924 983F.tmp 135 PID 2440 wrote to memory of 2916 2440 990A.tmp 136 PID 2916 wrote to memory of 1392 2916 99C5.tmp 137 PID 1392 wrote to memory of 5264 1392 9A81.tmp 138 PID 5264 wrote to memory of 260 5264 9B4C.tmp 139 PID 260 wrote to memory of 636 260 9BB9.tmp 140 PID 636 wrote to memory of 5836 636 9C27.tmp 141 PID 5836 wrote to memory of 5196 5836 9CA4.tmp 142 PID 5196 wrote to memory of 4884 5196 9D21.tmp 143 PID 4884 wrote to memory of 5324 4884 9D8E.tmp 144 PID 5324 wrote to memory of 3120 5324 9E0B.tmp 145 PID 3120 wrote to memory of 4324 3120 9E98.tmp 146 PID 4324 wrote to memory of 4852 4324 9F05.tmp 147 PID 4852 wrote to memory of 5872 4852 9F72.tmp 148 PID 5872 wrote to memory of 3488 5872 9FEF.tmp 149 PID 3488 wrote to memory of 3364 3488 A06C.tmp 150 PID 3364 wrote to memory of 4444 3364 A0DA.tmp 151 PID 4444 wrote to memory of 4516 4444 A157.tmp 152 PID 4516 wrote to memory of 4600 4516 A1B5.tmp 153 PID 4600 wrote to memory of 2428 4600 A222.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_98104a2859ff0050afd6f186fea204f9_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_98104a2859ff0050afd6f186fea204f9_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\72C5.tmp"C:\Users\Admin\AppData\Local\Temp\72C5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\73FD.tmp"C:\Users\Admin\AppData\Local\Temp\73FD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\74E8.tmp"C:\Users\Admin\AppData\Local\Temp\74E8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\75E2.tmp"C:\Users\Admin\AppData\Local\Temp\75E2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\767E.tmp"C:\Users\Admin\AppData\Local\Temp\767E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\79E9.tmp"C:\Users\Admin\AppData\Local\Temp\79E9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\7BCD.tmp"C:\Users\Admin\AppData\Local\Temp\7BCD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\80DE.tmp"C:\Users\Admin\AppData\Local\Temp\80DE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\842A.tmp"C:\Users\Admin\AppData\Local\Temp\842A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\8563.tmp"C:\Users\Admin\AppData\Local\Temp\8563.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\890C.tmp"C:\Users\Admin\AppData\Local\Temp\890C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\9149.tmp"C:\Users\Admin\AppData\Local\Temp\9149.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\9476.tmp"C:\Users\Admin\AppData\Local\Temp\9476.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\9503.tmp"C:\Users\Admin\AppData\Local\Temp\9503.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\959F.tmp"C:\Users\Admin\AppData\Local\Temp\959F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\990A.tmp"C:\Users\Admin\AppData\Local\Temp\990A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\99C5.tmp"C:\Users\Admin\AppData\Local\Temp\99C5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\9A81.tmp"C:\Users\Admin\AppData\Local\Temp\9A81.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9F72.tmp"C:\Users\Admin\AppData\Local\Temp\9F72.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"C:\Users\Admin\AppData\Local\Temp\A1B5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A222.tmp"C:\Users\Admin\AppData\Local\Temp\A222.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A28F.tmp"C:\Users\Admin\AppData\Local\Temp\A28F.tmp"65⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A30C.tmp"C:\Users\Admin\AppData\Local\Temp\A30C.tmp"66⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\A37A.tmp"C:\Users\Admin\AppData\Local\Temp\A37A.tmp"67⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"C:\Users\Admin\AppData\Local\Temp\A3F7.tmp"68⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\A464.tmp"C:\Users\Admin\AppData\Local\Temp\A464.tmp"69⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"70⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"71⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"72⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A677.tmp"C:\Users\Admin\AppData\Local\Temp\A677.tmp"73⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"C:\Users\Admin\AppData\Local\Temp\A6E5.tmp"74⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\A771.tmp"C:\Users\Admin\AppData\Local\Temp\A771.tmp"75⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"76⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"77⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"78⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\A946.tmp"C:\Users\Admin\AppData\Local\Temp\A946.tmp"79⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"80⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"81⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"82⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"83⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"84⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\AC63.tmp"C:\Users\Admin\AppData\Local\Temp\AC63.tmp"85⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"C:\Users\Admin\AppData\Local\Temp\ACF0.tmp"86⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"87⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\AE09.tmp"C:\Users\Admin\AppData\Local\Temp\AE09.tmp"88⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"89⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\AF22.tmp"C:\Users\Admin\AppData\Local\Temp\AF22.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"91⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"92⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"93⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"C:\Users\Admin\AppData\Local\Temp\B0E7.tmp"94⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"95⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"96⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"97⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"98⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:272 -
C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"C:\Users\Admin\AppData\Local\Temp\B3C6.tmp"100⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"101⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"102⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"103⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"104⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"105⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"C:\Users\Admin\AppData\Local\Temp\B6A4.tmp"106⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\B731.tmp"C:\Users\Admin\AppData\Local\Temp\B731.tmp"107⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"108⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"109⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"110⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"112⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"113⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"114⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\BABB.tmp"C:\Users\Admin\AppData\Local\Temp\BABB.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\BB38.tmp"C:\Users\Admin\AppData\Local\Temp\BB38.tmp"116⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"117⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BC32.tmp"C:\Users\Admin\AppData\Local\Temp\BC32.tmp"118⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"119⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"C:\Users\Admin\AppData\Local\Temp\BD1C.tmp"120⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"121⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\BE16.tmp"C:\Users\Admin\AppData\Local\Temp\BE16.tmp"122⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-