Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 14:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_3e00a86938f43260ced94c004788fc6c_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_3e00a86938f43260ced94c004788fc6c_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-02_3e00a86938f43260ced94c004788fc6c_elex_mafia.exe
- Size 520KB
- Sample261003-rfvxls1v4r
- SHA256 42a210993ee46d9b1f03535f945f7fe777f3598c7b6e33f1b208a67aef1b7f9f
- MD5 3e00a86938f43260ced94c004788fc6c
- SHA1 4555a0a38c34894b1f56e29da24b0414dc1a529f
- SHA512 085745f96924744b5414f6ea88e4d1cfc88c2b3cb3d04c9265a3840e2311af3f2a315558faf7d06738e919089e53466b0646fa5098ed0d0fc1ebb4624b7fa3b2
- SSDEEP 12288:gj8fuxR21t5i8fAM2A0MJBmfTGzyiVHADkNZ6:gj8fuK1GYAM2A0MJBmfsyiVggNI
- TLSH T1D1B4F1227984C037E9D716308A55EBA20BBE7D355B2695C33B80366D6FB52D2D73830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2872 EE8C.tmp 4472 EF77.tmp 1416 EFF4.tmp 1960 F0A0.tmp 1836 F11D.tmp 1520 F1E8.tmp 5864 F274.tmp 4056 F2F1.tmp 4992 F3BD.tmp 1888 F497.tmp 5892 F572.tmp 2588 F63D.tmp 2616 F718.tmp 2552 F7F3.tmp 2416 F870.tmp 3176 F8FC.tmp 5148 F989.tmp 1720 FA25.tmp 5704 FAA2.tmp 5688 FB1F.tmp 3468 FBBB.tmp 1176 FC87.tmp 4880 FD71.tmp 5748 FE0D.tmp 5300 FEC9.tmp 4508 FF55.tmp 2980 40.tmp 3276 CC.tmp 5048 149.tmp 1440 1D6.tmp 4252 272.tmp 1148 30E.tmp 3400 3E9.tmp 5948 466.tmp 1344 4D4.tmp 2160 541.tmp 2152 5BE.tmp 1600 62B.tmp 2488 6A8.tmp 5568 735.tmp 5572 793.tmp 6080 81F.tmp 1164 89C.tmp 124 929.tmp 2920 9D5.tmp 4864 A52.tmp 5176 ADE.tmp 4592 B6B.tmp 2280 C07.tmp 4000 C94.tmp 4012 D01.tmp 3268 D8E.tmp 3764 E0B.tmp 4480 E88.tmp 5684 F15.tmp 2940 F82.tmp 4952 FFF.tmp 2852 108C.tmp 3452 1128.tmp 468 1195.tmp 3128 1222.tmp 1964 129F.tmp 4860 133B.tmp 4752 13B8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 434F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 689A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4998.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 627F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 636A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 292F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 924A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B96E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 916F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B23.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2872 1844 2026-10-02_3e00a86938f43260ced94c004788fc6c_elex_mafia.exe 90 PID 2872 wrote to memory of 4472 2872 EE8C.tmp 91 PID 4472 wrote to memory of 1416 4472 EF77.tmp 92 PID 1416 wrote to memory of 1960 1416 EFF4.tmp 93 PID 1960 wrote to memory of 1836 1960 F0A0.tmp 94 PID 1836 wrote to memory of 1520 1836 F11D.tmp 95 PID 1520 wrote to memory of 5864 1520 F1E8.tmp 96 PID 5864 wrote to memory of 4056 5864 F274.tmp 97 PID 4056 wrote to memory of 4992 4056 F2F1.tmp 98 PID 4992 wrote to memory of 1888 4992 F3BD.tmp 99 PID 1888 wrote to memory of 5892 1888 F497.tmp 100 PID 5892 wrote to memory of 2588 5892 F572.tmp 101 PID 2588 wrote to memory of 2616 2588 F63D.tmp 102 PID 2616 wrote to memory of 2552 2616 F718.tmp 103 PID 2552 wrote to memory of 2416 2552 F7F3.tmp 104 PID 2416 wrote to memory of 3176 2416 F870.tmp 105 PID 3176 wrote to memory of 5148 3176 F8FC.tmp 106 PID 5148 wrote to memory of 1720 5148 F989.tmp 107 PID 1720 wrote to memory of 5704 1720 FA25.tmp 108 PID 5704 wrote to memory of 5688 5704 FAA2.tmp 109 PID 5688 wrote to memory of 3468 5688 FB1F.tmp 110 PID 3468 wrote to memory of 1176 3468 FBBB.tmp 111 PID 1176 wrote to memory of 4880 1176 FC87.tmp 112 PID 4880 wrote to memory of 5748 4880 FD71.tmp 113 PID 5748 wrote to memory of 5300 5748 FE0D.tmp 114 PID 5300 wrote to memory of 4508 5300 FEC9.tmp 115 PID 4508 wrote to memory of 2980 4508 FF55.tmp 116 PID 2980 wrote to memory of 3276 2980 40.tmp 117 PID 3276 wrote to memory of 5048 3276 CC.tmp 118 PID 5048 wrote to memory of 1440 5048 149.tmp 119 PID 1440 wrote to memory of 4252 1440 1D6.tmp 120 PID 4252 wrote to memory of 1148 4252 272.tmp 121 PID 1148 wrote to memory of 3400 1148 30E.tmp 122 PID 3400 wrote to memory of 5948 3400 3E9.tmp 123 PID 5948 wrote to memory of 1344 5948 466.tmp 124 PID 1344 wrote to memory of 2160 1344 4D4.tmp 125 PID 2160 wrote to memory of 2152 2160 541.tmp 126 PID 2152 wrote to memory of 1600 2152 5BE.tmp 127 PID 1600 wrote to memory of 2488 1600 62B.tmp 128 PID 2488 wrote to memory of 5568 2488 6A8.tmp 129 PID 5568 wrote to memory of 5572 5568 735.tmp 130 PID 5572 wrote to memory of 6080 5572 793.tmp 131 PID 6080 wrote to memory of 1164 6080 81F.tmp 132 PID 1164 wrote to memory of 124 1164 89C.tmp 133 PID 124 wrote to memory of 2920 124 929.tmp 134 PID 2920 wrote to memory of 4864 2920 9D5.tmp 135 PID 4864 wrote to memory of 5176 4864 A52.tmp 136 PID 5176 wrote to memory of 4592 5176 ADE.tmp 137 PID 4592 wrote to memory of 2280 4592 B6B.tmp 138 PID 2280 wrote to memory of 4000 2280 C07.tmp 139 PID 4000 wrote to memory of 4012 4000 C94.tmp 140 PID 4012 wrote to memory of 3268 4012 D01.tmp 141 PID 3268 wrote to memory of 3764 3268 D8E.tmp 142 PID 3764 wrote to memory of 4480 3764 E0B.tmp 143 PID 4480 wrote to memory of 5684 4480 E88.tmp 144 PID 5684 wrote to memory of 2940 5684 F15.tmp 145 PID 2940 wrote to memory of 4952 2940 F82.tmp 146 PID 4952 wrote to memory of 2852 4952 FFF.tmp 147 PID 2852 wrote to memory of 3452 2852 108C.tmp 148 PID 3452 wrote to memory of 468 3452 1128.tmp 149 PID 468 wrote to memory of 3128 468 1195.tmp 150 PID 3128 wrote to memory of 1964 3128 1222.tmp 151 PID 1964 wrote to memory of 4860 1964 129F.tmp 152 PID 4860 wrote to memory of 4752 4860 133B.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_3e00a86938f43260ced94c004788fc6c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_3e00a86938f43260ced94c004788fc6c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\EF77.tmp"C:\Users\Admin\AppData\Local\Temp\EF77.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\F274.tmp"C:\Users\Admin\AppData\Local\Temp\F274.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\F989.tmp"C:\Users\Admin\AppData\Local\Temp\F989.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\FC87.tmp"C:\Users\Admin\AppData\Local\Temp\FC87.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\1D6.tmp"C:\Users\Admin\AppData\Local\Temp\1D6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\541.tmp"C:\Users\Admin\AppData\Local\Temp\541.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5BE.tmp"C:\Users\Admin\AppData\Local\Temp\5BE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\735.tmp"C:\Users\Admin\AppData\Local\Temp\735.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\793.tmp"C:\Users\Admin\AppData\Local\Temp\793.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\81F.tmp"C:\Users\Admin\AppData\Local\Temp\81F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\89C.tmp"C:\Users\Admin\AppData\Local\Temp\89C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\9D5.tmp"C:\Users\Admin\AppData\Local\Temp\9D5.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\A52.tmp"C:\Users\Admin\AppData\Local\Temp\A52.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\B6B.tmp"C:\Users\Admin\AppData\Local\Temp\B6B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\C94.tmp"C:\Users\Admin\AppData\Local\Temp\C94.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\E88.tmp"C:\Users\Admin\AppData\Local\Temp\E88.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\1195.tmp"C:\Users\Admin\AppData\Local\Temp\1195.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\129F.tmp"C:\Users\Admin\AppData\Local\Temp\129F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\133B.tmp"C:\Users\Admin\AppData\Local\Temp\133B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"65⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"66⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\14C2.tmp"C:\Users\Admin\AppData\Local\Temp\14C2.tmp"67⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\151F.tmp"C:\Users\Admin\AppData\Local\Temp\151F.tmp"68⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\159C.tmp"C:\Users\Admin\AppData\Local\Temp\159C.tmp"69⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"70⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"71⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1733.tmp"C:\Users\Admin\AppData\Local\Temp\1733.tmp"72⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\17B0.tmp"C:\Users\Admin\AppData\Local\Temp\17B0.tmp"73⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\183C.tmp"C:\Users\Admin\AppData\Local\Temp\183C.tmp"74⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\18D9.tmp"C:\Users\Admin\AppData\Local\Temp\18D9.tmp"75⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1965.tmp"C:\Users\Admin\AppData\Local\Temp\1965.tmp"76⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\19D3.tmp"C:\Users\Admin\AppData\Local\Temp\19D3.tmp"77⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\1A6F.tmp"C:\Users\Admin\AppData\Local\Temp\1A6F.tmp"78⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"79⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\1B98.tmp"C:\Users\Admin\AppData\Local\Temp\1B98.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\1C15.tmp"C:\Users\Admin\AppData\Local\Temp\1C15.tmp"81⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\1C82.tmp"C:\Users\Admin\AppData\Local\Temp\1C82.tmp"82⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"83⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"84⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"85⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"86⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\1F22.tmp"C:\Users\Admin\AppData\Local\Temp\1F22.tmp"87⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"C:\Users\Admin\AppData\Local\Temp\1F9F.tmp"88⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\204B.tmp"C:\Users\Admin\AppData\Local\Temp\204B.tmp"89⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"90⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2145.tmp"C:\Users\Admin\AppData\Local\Temp\2145.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\21C2.tmp"C:\Users\Admin\AppData\Local\Temp\21C2.tmp"92⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"93⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"94⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"95⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\23C5.tmp"C:\Users\Admin\AppData\Local\Temp\23C5.tmp"96⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"97⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"98⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"99⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"100⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"101⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"102⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"103⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"104⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"105⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\28C7.tmp"C:\Users\Admin\AppData\Local\Temp\28C7.tmp"106⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2944.tmp"C:\Users\Admin\AppData\Local\Temp\2944.tmp"107⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\29C1.tmp"C:\Users\Admin\AppData\Local\Temp\29C1.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"109⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"110⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"111⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"112⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\2C80.tmp"C:\Users\Admin\AppData\Local\Temp\2C80.tmp"113⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"114⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\2DB8.tmp"C:\Users\Admin\AppData\Local\Temp\2DB8.tmp"115⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\2E45.tmp"C:\Users\Admin\AppData\Local\Temp\2E45.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"117⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"118⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\300A.tmp"C:\Users\Admin\AppData\Local\Temp\300A.tmp"119⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\3097.tmp"C:\Users\Admin\AppData\Local\Temp\3097.tmp"120⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"121⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-