Analysis
- max time kernel
92s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_82b8d5ec4f653d7b302b5fba7aacfc26_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_82b8d5ec4f653d7b302b5fba7aacfc26_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_82b8d5ec4f653d7b302b5fba7aacfc26_elex_mafia.exe
- Size 560KB
- Sample260930-xpcqaawtcv
- SHA256 2079a9d30f9071807476acf729564f8207fbf4a888cf55e293170d31a91dd9cf
- MD5 82b8d5ec4f653d7b302b5fba7aacfc26
- SHA1 3551aefe67cec3294a7919cab4b6573b33556de9
- SHA512 5db87008aebcd4ff703ce5a5152f2945232d76782e7c71d84e5da49b036730af7fd6780558e6238372cea4a85832799bc360add32382aa134a5799f055bfccfc
- SSDEEP 12288:MlFXOQUDmrC8Sn2h6QCJi4TI5jOFNqszkTOOkK5zX/BLIZxV:MlUQbC8SkaiKIxOFNpzk55bJLIR
- TLSH T13FC4F1137144C073E5D212304A56CBA22B3F7D359B2AA5C37784266EAFB53D1EA3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4932 3F8B.tmp 852 4017.tmp 6068 4085.tmp 3756 40F2.tmp 2776 417F.tmp 3140 41FC.tmp 4152 4269.tmp 5952 42E6.tmp 4340 4344.tmp 1512 43C1.tmp 5400 441F.tmp 120 448C.tmp 2312 44F9.tmp 3232 4576.tmp 3760 4690.tmp 1208 470D.tmp 4316 477A.tmp 3872 47F7.tmp 5436 4855.tmp 5672 48C2.tmp 3540 4930.tmp 5752 498D.tmp 1544 49FB.tmp 2200 4A87.tmp 4144 4B04.tmp 3084 4B72.tmp 1556 4BDF.tmp 5792 4C6C.tmp 700 4CD9.tmp 5372 4D46.tmp 4452 4DA4.tmp 4024 4E02.tmp 4416 4E60.tmp 4388 4ECD.tmp 4856 4F2B.tmp 1472 4FC7.tmp 5392 5034.tmp 2816 50A2.tmp 1284 5100.tmp 4892 516D.tmp 4684 51DA.tmp 1524 5248.tmp 4264 52A5.tmp 1168 5313.tmp 5520 5371.tmp 3840 53CE.tmp 2872 542C.tmp 3552 5499.tmp 792 54F7.tmp 4868 5555.tmp 3004 55C2.tmp 4576 5620.tmp 616 568D.tmp 1864 56EB.tmp 4256 5759.tmp 2132 57C6.tmp 5080 5833.tmp 4364 5891.tmp 4472 58EF.tmp 5472 595C.tmp 3024 59CA.tmp 4296 5A27.tmp 1896 5A85.tmp 4672 5AE3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 417F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D487.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7897.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E04F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 739B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 762B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB40.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 4932 1268 2026-09-29_82b8d5ec4f653d7b302b5fba7aacfc26_elex_mafia.exe 90 PID 4932 wrote to memory of 852 4932 3F8B.tmp 91 PID 852 wrote to memory of 6068 852 4017.tmp 92 PID 6068 wrote to memory of 3756 6068 4085.tmp 93 PID 3756 wrote to memory of 2776 3756 40F2.tmp 94 PID 2776 wrote to memory of 3140 2776 417F.tmp 95 PID 3140 wrote to memory of 4152 3140 41FC.tmp 96 PID 4152 wrote to memory of 5952 4152 4269.tmp 97 PID 5952 wrote to memory of 4340 5952 42E6.tmp 98 PID 4340 wrote to memory of 1512 4340 4344.tmp 99 PID 1512 wrote to memory of 5400 1512 43C1.tmp 100 PID 5400 wrote to memory of 120 5400 441F.tmp 101 PID 120 wrote to memory of 2312 120 448C.tmp 102 PID 2312 wrote to memory of 3232 2312 44F9.tmp 103 PID 3232 wrote to memory of 3760 3232 4576.tmp 104 PID 3760 wrote to memory of 1208 3760 4690.tmp 105 PID 1208 wrote to memory of 4316 1208 470D.tmp 106 PID 4316 wrote to memory of 3872 4316 477A.tmp 107 PID 3872 wrote to memory of 5436 3872 47F7.tmp 108 PID 5436 wrote to memory of 5672 5436 4855.tmp 109 PID 5672 wrote to memory of 3540 5672 48C2.tmp 110 PID 3540 wrote to memory of 5752 3540 4930.tmp 111 PID 5752 wrote to memory of 1544 5752 498D.tmp 112 PID 1544 wrote to memory of 2200 1544 49FB.tmp 113 PID 2200 wrote to memory of 4144 2200 4A87.tmp 114 PID 4144 wrote to memory of 3084 4144 4B04.tmp 115 PID 3084 wrote to memory of 1556 3084 4B72.tmp 116 PID 1556 wrote to memory of 5792 1556 4BDF.tmp 117 PID 5792 wrote to memory of 700 5792 4C6C.tmp 118 PID 700 wrote to memory of 5372 700 4CD9.tmp 119 PID 5372 wrote to memory of 4452 5372 4D46.tmp 120 PID 4452 wrote to memory of 4024 4452 4DA4.tmp 121 PID 4024 wrote to memory of 4416 4024 4E02.tmp 122 PID 4416 wrote to memory of 4388 4416 4E60.tmp 123 PID 4388 wrote to memory of 4856 4388 4ECD.tmp 124 PID 4856 wrote to memory of 1472 4856 4F2B.tmp 125 PID 1472 wrote to memory of 5392 1472 4FC7.tmp 126 PID 5392 wrote to memory of 2816 5392 5034.tmp 127 PID 2816 wrote to memory of 1284 2816 50A2.tmp 128 PID 1284 wrote to memory of 4892 1284 5100.tmp 129 PID 4892 wrote to memory of 4684 4892 516D.tmp 130 PID 4684 wrote to memory of 1524 4684 51DA.tmp 131 PID 1524 wrote to memory of 4264 1524 5248.tmp 132 PID 4264 wrote to memory of 1168 4264 52A5.tmp 133 PID 1168 wrote to memory of 5520 1168 5313.tmp 134 PID 5520 wrote to memory of 3840 5520 5371.tmp 135 PID 3840 wrote to memory of 2872 3840 53CE.tmp 136 PID 2872 wrote to memory of 3552 2872 542C.tmp 137 PID 3552 wrote to memory of 792 3552 5499.tmp 138 PID 792 wrote to memory of 4868 792 54F7.tmp 139 PID 4868 wrote to memory of 3004 4868 5555.tmp 140 PID 3004 wrote to memory of 4576 3004 55C2.tmp 141 PID 4576 wrote to memory of 616 4576 5620.tmp 142 PID 616 wrote to memory of 1864 616 568D.tmp 143 PID 1864 wrote to memory of 4256 1864 56EB.tmp 144 PID 4256 wrote to memory of 2132 4256 5759.tmp 145 PID 2132 wrote to memory of 5080 2132 57C6.tmp 146 PID 5080 wrote to memory of 4364 5080 5833.tmp 147 PID 4364 wrote to memory of 4472 4364 5891.tmp 148 PID 4472 wrote to memory of 5472 4472 58EF.tmp 149 PID 5472 wrote to memory of 3024 5472 595C.tmp 150 PID 3024 wrote to memory of 4296 3024 59CA.tmp 151 PID 4296 wrote to memory of 1896 4296 5A27.tmp 152 PID 1896 wrote to memory of 4672 1896 5A85.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_82b8d5ec4f653d7b302b5fba7aacfc26_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_82b8d5ec4f653d7b302b5fba7aacfc26_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"C:\Users\Admin\AppData\Local\Temp\3F8B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4017.tmp"C:\Users\Admin\AppData\Local\Temp\4017.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\4085.tmp"C:\Users\Admin\AppData\Local\Temp\4085.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\40F2.tmp"C:\Users\Admin\AppData\Local\Temp\40F2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\417F.tmp"C:\Users\Admin\AppData\Local\Temp\417F.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\41FC.tmp"C:\Users\Admin\AppData\Local\Temp\41FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\4269.tmp"C:\Users\Admin\AppData\Local\Temp\4269.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\42E6.tmp"C:\Users\Admin\AppData\Local\Temp\42E6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\4344.tmp"C:\Users\Admin\AppData\Local\Temp\4344.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\43C1.tmp"C:\Users\Admin\AppData\Local\Temp\43C1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\441F.tmp"C:\Users\Admin\AppData\Local\Temp\441F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\448C.tmp"C:\Users\Admin\AppData\Local\Temp\448C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\44F9.tmp"C:\Users\Admin\AppData\Local\Temp\44F9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\4576.tmp"C:\Users\Admin\AppData\Local\Temp\4576.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4690.tmp"C:\Users\Admin\AppData\Local\Temp\4690.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\470D.tmp"C:\Users\Admin\AppData\Local\Temp\470D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\477A.tmp"C:\Users\Admin\AppData\Local\Temp\477A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\47F7.tmp"C:\Users\Admin\AppData\Local\Temp\47F7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4855.tmp"C:\Users\Admin\AppData\Local\Temp\4855.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\48C2.tmp"C:\Users\Admin\AppData\Local\Temp\48C2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\4930.tmp"C:\Users\Admin\AppData\Local\Temp\4930.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\498D.tmp"C:\Users\Admin\AppData\Local\Temp\498D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4A87.tmp"C:\Users\Admin\AppData\Local\Temp\4A87.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"C:\Users\Admin\AppData\Local\Temp\4C6C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"C:\Users\Admin\AppData\Local\Temp\4CD9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"C:\Users\Admin\AppData\Local\Temp\4DA4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\4E02.tmp"C:\Users\Admin\AppData\Local\Temp\4E02.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\4E60.tmp"C:\Users\Admin\AppData\Local\Temp\4E60.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4ECD.tmp"C:\Users\Admin\AppData\Local\Temp\4ECD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\4FC7.tmp"C:\Users\Admin\AppData\Local\Temp\4FC7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5034.tmp"C:\Users\Admin\AppData\Local\Temp\5034.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\50A2.tmp"C:\Users\Admin\AppData\Local\Temp\50A2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5100.tmp"C:\Users\Admin\AppData\Local\Temp\5100.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\516D.tmp"C:\Users\Admin\AppData\Local\Temp\516D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\51DA.tmp"C:\Users\Admin\AppData\Local\Temp\51DA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5248.tmp"C:\Users\Admin\AppData\Local\Temp\5248.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\52A5.tmp"C:\Users\Admin\AppData\Local\Temp\52A5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\5313.tmp"C:\Users\Admin\AppData\Local\Temp\5313.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5371.tmp"C:\Users\Admin\AppData\Local\Temp\5371.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\53CE.tmp"C:\Users\Admin\AppData\Local\Temp\53CE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\542C.tmp"C:\Users\Admin\AppData\Local\Temp\542C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\5499.tmp"C:\Users\Admin\AppData\Local\Temp\5499.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\54F7.tmp"C:\Users\Admin\AppData\Local\Temp\54F7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\5555.tmp"C:\Users\Admin\AppData\Local\Temp\5555.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5620.tmp"C:\Users\Admin\AppData\Local\Temp\5620.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\568D.tmp"C:\Users\Admin\AppData\Local\Temp\568D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\56EB.tmp"C:\Users\Admin\AppData\Local\Temp\56EB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\5759.tmp"C:\Users\Admin\AppData\Local\Temp\5759.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\57C6.tmp"C:\Users\Admin\AppData\Local\Temp\57C6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\5833.tmp"C:\Users\Admin\AppData\Local\Temp\5833.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\5891.tmp"C:\Users\Admin\AppData\Local\Temp\5891.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\58EF.tmp"C:\Users\Admin\AppData\Local\Temp\58EF.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\595C.tmp"C:\Users\Admin\AppData\Local\Temp\595C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\59CA.tmp"C:\Users\Admin\AppData\Local\Temp\59CA.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5A27.tmp"C:\Users\Admin\AppData\Local\Temp\5A27.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5A85.tmp"C:\Users\Admin\AppData\Local\Temp\5A85.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5AE3.tmp"C:\Users\Admin\AppData\Local\Temp\5AE3.tmp"65⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"66⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"67⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"C:\Users\Admin\AppData\Local\Temp\5C0C.tmp"68⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\5C79.tmp"C:\Users\Admin\AppData\Local\Temp\5C79.tmp"69⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\5CD7.tmp"C:\Users\Admin\AppData\Local\Temp\5CD7.tmp"70⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\5D44.tmp"C:\Users\Admin\AppData\Local\Temp\5D44.tmp"71⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"72⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\5E00.tmp"C:\Users\Admin\AppData\Local\Temp\5E00.tmp"73⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"C:\Users\Admin\AppData\Local\Temp\5E5D.tmp"74⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5EBB.tmp"C:\Users\Admin\AppData\Local\Temp\5EBB.tmp"75⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\5F19.tmp"C:\Users\Admin\AppData\Local\Temp\5F19.tmp"76⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5F86.tmp"C:\Users\Admin\AppData\Local\Temp\5F86.tmp"77⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"C:\Users\Admin\AppData\Local\Temp\5FE4.tmp"78⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\6042.tmp"C:\Users\Admin\AppData\Local\Temp\6042.tmp"79⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\60AF.tmp"C:\Users\Admin\AppData\Local\Temp\60AF.tmp"80⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\611D.tmp"C:\Users\Admin\AppData\Local\Temp\611D.tmp"81⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\619A.tmp"C:\Users\Admin\AppData\Local\Temp\619A.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:480 -
C:\Users\Admin\AppData\Local\Temp\6207.tmp"C:\Users\Admin\AppData\Local\Temp\6207.tmp"83⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\6274.tmp"C:\Users\Admin\AppData\Local\Temp\6274.tmp"84⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\62D2.tmp"C:\Users\Admin\AppData\Local\Temp\62D2.tmp"85⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\6330.tmp"C:\Users\Admin\AppData\Local\Temp\6330.tmp"86⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\638E.tmp"C:\Users\Admin\AppData\Local\Temp\638E.tmp"87⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\63EB.tmp"C:\Users\Admin\AppData\Local\Temp\63EB.tmp"88⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6459.tmp"C:\Users\Admin\AppData\Local\Temp\6459.tmp"89⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\64B6.tmp"C:\Users\Admin\AppData\Local\Temp\64B6.tmp"90⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\6514.tmp"C:\Users\Admin\AppData\Local\Temp\6514.tmp"91⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\6572.tmp"C:\Users\Admin\AppData\Local\Temp\6572.tmp"92⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\65DF.tmp"C:\Users\Admin\AppData\Local\Temp\65DF.tmp"93⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\663D.tmp"C:\Users\Admin\AppData\Local\Temp\663D.tmp"94⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\66BA.tmp"C:\Users\Admin\AppData\Local\Temp\66BA.tmp"95⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6718.tmp"C:\Users\Admin\AppData\Local\Temp\6718.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\6776.tmp"C:\Users\Admin\AppData\Local\Temp\6776.tmp"97⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\6BEA.tmp"C:\Users\Admin\AppData\Local\Temp\6BEA.tmp"98⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\6C58.tmp"C:\Users\Admin\AppData\Local\Temp\6C58.tmp"99⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"C:\Users\Admin\AppData\Local\Temp\6CB5.tmp"100⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\6D23.tmp"C:\Users\Admin\AppData\Local\Temp\6D23.tmp"101⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\6D80.tmp"C:\Users\Admin\AppData\Local\Temp\6D80.tmp"102⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"104⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"105⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\6F17.tmp"C:\Users\Admin\AppData\Local\Temp\6F17.tmp"106⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\6F84.tmp"C:\Users\Admin\AppData\Local\Temp\6F84.tmp"107⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"C:\Users\Admin\AppData\Local\Temp\6FE2.tmp"108⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\704F.tmp"C:\Users\Admin\AppData\Local\Temp\704F.tmp"109⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\70CC.tmp"C:\Users\Admin\AppData\Local\Temp\70CC.tmp"110⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"111⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\71B7.tmp"C:\Users\Admin\AppData\Local\Temp\71B7.tmp"112⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"113⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7282.tmp"C:\Users\Admin\AppData\Local\Temp\7282.tmp"114⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\72D0.tmp"C:\Users\Admin\AppData\Local\Temp\72D0.tmp"115⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"116⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\739B.tmp"C:\Users\Admin\AppData\Local\Temp\739B.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\73E9.tmp"C:\Users\Admin\AppData\Local\Temp\73E9.tmp"118⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\7447.tmp"C:\Users\Admin\AppData\Local\Temp\7447.tmp"119⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\74B4.tmp"C:\Users\Admin\AppData\Local\Temp\74B4.tmp"120⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"121⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\7570.tmp"C:\Users\Admin\AppData\Local\Temp\7570.tmp"122⤵PID:6100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-