Analysis
- max time kernel
100s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_78cc231d64eb4957487f8b8018cd1279_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_78cc231d64eb4957487f8b8018cd1279_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-01_78cc231d64eb4957487f8b8018cd1279_elex_mafia.exe
- Size 581KB
- Sample261002-nfbxysyene
- SHA256 3541a2c78213b3ebefc00cd71f0179131dea507f527ae94d2098f820b00cebe5
- MD5 78cc231d64eb4957487f8b8018cd1279
- SHA1 1ea02e6f35851b7901aed1c928aee5f579d819cd
- SHA512 2fbe726544cb9ba816841254c7d5110b89ee4f2e1e48d10e28d145e10168c6fb2728dee204e6b043a8e5af97ea8b59218c1788bc725095064482dc29147fdcb6
- SSDEEP 12288:yZ355mztdeUIuMP2Qb5hXMi1qZoXWjdqW:yZ3qzaUIuMVbTXMi1qqGhT
- TLSH T1AEC4F111B645C036F2A241344A6AEB9599BB7D335B37A8CF3B94262E6FB12D1D335303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1096 9F82.tmp 3160 A09B.tmp 4620 A1A5.tmp 4304 A2AF.tmp 3180 A3B8.tmp 3060 A4B2.tmp 3664 A639.tmp 4072 A752.tmp 5900 A82D.tmp 2728 A8C9.tmp 2392 A9A4.tmp 5100 AACD.tmp 2748 AC34.tmp 1660 AD1E.tmp 4224 AE28.tmp 2160 AF61.tmp 1356 B07A.tmp 3616 B1C2.tmp 6108 B2BC.tmp 5924 B397.tmp 3064 B462.tmp 1292 B5BA.tmp 2872 B694.tmp 1920 B75F.tmp 2896 B83A.tmp 1436 B925.tmp 1520 BA2E.tmp 3144 BAF9.tmp 3176 BBD4.tmp 2988 BCCE.tmp 4668 BDC8.tmp 5744 BF20.tmp 2192 BFCC.tmp 2680 C068.tmp 1772 C0F5.tmp 900 C191.tmp 3408 C21D.tmp 1280 C2AA.tmp 5592 C375.tmp 2676 C402.tmp 3312 C4DD.tmp 5932 C5A8.tmp 556 C654.tmp 4492 C6E0.tmp 3204 C76D.tmp 4812 C819.tmp 3608 C8C5.tmp 2616 C980.tmp 1788 CA2C.tmp 4736 CAA9.tmp 2688 CB45.tmp 5696 CBD2.tmp 4396 CC6E.tmp 5416 CD1A.tmp 4704 CD87.tmp 4744 CDF5.tmp 692 CE62.tmp 3096 CEDF.tmp 5668 CFAA.tmp 3832 D046.tmp 3368 D0E3.tmp 5872 D17F.tmp 5248 D1FC.tmp 5500 D289.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 981B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A51B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D533.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 350B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A75D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 469F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 734D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E44B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A21.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 1096 1324 2026-10-01_78cc231d64eb4957487f8b8018cd1279_elex_mafia.exe 90 PID 1096 wrote to memory of 3160 1096 9F82.tmp 91 PID 3160 wrote to memory of 4620 3160 A09B.tmp 92 PID 4620 wrote to memory of 4304 4620 A1A5.tmp 93 PID 4304 wrote to memory of 3180 4304 A2AF.tmp 94 PID 3180 wrote to memory of 3060 3180 A3B8.tmp 95 PID 3060 wrote to memory of 3664 3060 A4B2.tmp 96 PID 3664 wrote to memory of 4072 3664 A639.tmp 97 PID 4072 wrote to memory of 5900 4072 A752.tmp 98 PID 5900 wrote to memory of 2728 5900 A82D.tmp 99 PID 2728 wrote to memory of 2392 2728 A8C9.tmp 100 PID 2392 wrote to memory of 5100 2392 A9A4.tmp 101 PID 5100 wrote to memory of 2748 5100 AACD.tmp 102 PID 2748 wrote to memory of 1660 2748 AC34.tmp 103 PID 1660 wrote to memory of 4224 1660 AD1E.tmp 104 PID 4224 wrote to memory of 2160 4224 AE28.tmp 105 PID 2160 wrote to memory of 1356 2160 AF61.tmp 106 PID 1356 wrote to memory of 3616 1356 B07A.tmp 107 PID 3616 wrote to memory of 6108 3616 B1C2.tmp 108 PID 6108 wrote to memory of 5924 6108 B2BC.tmp 109 PID 5924 wrote to memory of 3064 5924 B397.tmp 110 PID 3064 wrote to memory of 1292 3064 B462.tmp 111 PID 1292 wrote to memory of 2872 1292 B5BA.tmp 112 PID 2872 wrote to memory of 1920 2872 B694.tmp 113 PID 1920 wrote to memory of 2896 1920 B75F.tmp 114 PID 2896 wrote to memory of 1436 2896 B83A.tmp 115 PID 1436 wrote to memory of 1520 1436 B925.tmp 116 PID 1520 wrote to memory of 3144 1520 BA2E.tmp 117 PID 3144 wrote to memory of 3176 3144 BAF9.tmp 118 PID 3176 wrote to memory of 2988 3176 BBD4.tmp 119 PID 2988 wrote to memory of 4668 2988 BCCE.tmp 120 PID 4668 wrote to memory of 5744 4668 BDC8.tmp 121 PID 5744 wrote to memory of 2192 5744 BF20.tmp 122 PID 2192 wrote to memory of 2680 2192 BFCC.tmp 123 PID 2680 wrote to memory of 1772 2680 C068.tmp 124 PID 1772 wrote to memory of 900 1772 C0F5.tmp 125 PID 900 wrote to memory of 3408 900 C191.tmp 126 PID 3408 wrote to memory of 1280 3408 C21D.tmp 127 PID 1280 wrote to memory of 5592 1280 C2AA.tmp 128 PID 5592 wrote to memory of 2676 5592 C375.tmp 129 PID 2676 wrote to memory of 3312 2676 C402.tmp 130 PID 3312 wrote to memory of 5932 3312 C4DD.tmp 131 PID 5932 wrote to memory of 556 5932 C5A8.tmp 132 PID 556 wrote to memory of 4492 556 C654.tmp 133 PID 4492 wrote to memory of 3204 4492 C6E0.tmp 134 PID 3204 wrote to memory of 4812 3204 C76D.tmp 135 PID 4812 wrote to memory of 3608 4812 C819.tmp 136 PID 3608 wrote to memory of 2616 3608 C8C5.tmp 137 PID 2616 wrote to memory of 1788 2616 C980.tmp 138 PID 1788 wrote to memory of 4736 1788 CA2C.tmp 139 PID 4736 wrote to memory of 2688 4736 CAA9.tmp 140 PID 2688 wrote to memory of 5696 2688 CB45.tmp 141 PID 5696 wrote to memory of 4396 5696 CBD2.tmp 142 PID 4396 wrote to memory of 5416 4396 CC6E.tmp 143 PID 5416 wrote to memory of 4704 5416 CD1A.tmp 144 PID 4704 wrote to memory of 4744 4704 CD87.tmp 145 PID 4744 wrote to memory of 692 4744 CDF5.tmp 146 PID 692 wrote to memory of 3096 692 CE62.tmp 147 PID 3096 wrote to memory of 5668 3096 CEDF.tmp 148 PID 5668 wrote to memory of 3832 5668 CFAA.tmp 149 PID 3832 wrote to memory of 3368 3832 D046.tmp 150 PID 3368 wrote to memory of 5872 3368 D0E3.tmp 151 PID 5872 wrote to memory of 5248 5872 D17F.tmp 152 PID 5248 wrote to memory of 5500 5248 D1FC.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_78cc231d64eb4957487f8b8018cd1279_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_78cc231d64eb4957487f8b8018cd1279_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\9F82.tmp"C:\Users\Admin\AppData\Local\Temp\9F82.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\A09B.tmp"C:\Users\Admin\AppData\Local\Temp\A09B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A639.tmp"C:\Users\Admin\AppData\Local\Temp\A639.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\A752.tmp"C:\Users\Admin\AppData\Local\Temp\A752.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\A82D.tmp"C:\Users\Admin\AppData\Local\Temp\A82D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"C:\Users\Admin\AppData\Local\Temp\A9A4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\AC34.tmp"C:\Users\Admin\AppData\Local\Temp\AC34.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\AD1E.tmp"C:\Users\Admin\AppData\Local\Temp\AD1E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\AF61.tmp"C:\Users\Admin\AppData\Local\Temp\AF61.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\B397.tmp"C:\Users\Admin\AppData\Local\Temp\B397.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\B925.tmp"C:\Users\Admin\AppData\Local\Temp\B925.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\BF20.tmp"C:\Users\Admin\AppData\Local\Temp\BF20.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"C:\Users\Admin\AppData\Local\Temp\C0F5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C21D.tmp"C:\Users\Admin\AppData\Local\Temp\C21D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"C:\Users\Admin\AppData\Local\Temp\C2AA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\C654.tmp"C:\Users\Admin\AppData\Local\Temp\C654.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"C:\Users\Admin\AppData\Local\Temp\C6E0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\C819.tmp"C:\Users\Admin\AppData\Local\Temp\C819.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"C:\Users\Admin\AppData\Local\Temp\C8C5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\C980.tmp"C:\Users\Admin\AppData\Local\Temp\C980.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"C:\Users\Admin\AppData\Local\Temp\CAA9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"C:\Users\Admin\AppData\Local\Temp\CBD2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"C:\Users\Admin\AppData\Local\Temp\CD1A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"C:\Users\Admin\AppData\Local\Temp\CEDF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"C:\Users\Admin\AppData\Local\Temp\D0E3.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\D17F.tmp"C:\Users\Admin\AppData\Local\Temp\D17F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"C:\Users\Admin\AppData\Local\Temp\D1FC.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"65⤵
- Executes dropped EXE
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"66⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"67⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"68⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"69⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"70⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\D642.tmp"C:\Users\Admin\AppData\Local\Temp\D642.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"C:\Users\Admin\AppData\Local\Temp\D6AF.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\D71C.tmp"C:\Users\Admin\AppData\Local\Temp\D71C.tmp"73⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"74⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"75⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"76⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"77⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"78⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"79⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"80⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"81⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"C:\Users\Admin\AppData\Local\Temp\DAE5.tmp"82⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\DB53.tmp"C:\Users\Admin\AppData\Local\Temp\DB53.tmp"83⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"84⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"85⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"86⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\DD08.tmp"C:\Users\Admin\AppData\Local\Temp\DD08.tmp"87⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\DD75.tmp"C:\Users\Admin\AppData\Local\Temp\DD75.tmp"88⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"89⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"90⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"C:\Users\Admin\AppData\Local\Temp\DE9E.tmp"91⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"C:\Users\Admin\AppData\Local\Temp\DF1B.tmp"92⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"93⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"94⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"95⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"96⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\E12F.tmp"C:\Users\Admin\AppData\Local\Temp\E12F.tmp"97⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"98⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"99⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\E257.tmp"C:\Users\Admin\AppData\Local\Temp\E257.tmp"100⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"101⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"102⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\E380.tmp"C:\Users\Admin\AppData\Local\Temp\E380.tmp"103⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"104⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"C:\Users\Admin\AppData\Local\Temp\E4D8.tmp"106⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"107⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"108⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\E620.tmp"C:\Users\Admin\AppData\Local\Temp\E620.tmp"109⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"110⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"111⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\E749.tmp"C:\Users\Admin\AppData\Local\Temp\E749.tmp"112⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"113⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"114⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"115⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"C:\Users\Admin\AppData\Local\Temp\E8C0.tmp"116⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"117⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"119⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"120⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"121⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"122⤵PID:3388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-