Analysis
- max time kernel
122s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_ba4347ef0f91f741a9c984bde8be5751_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_ba4347ef0f91f741a9c984bde8be5751_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-28_ba4347ef0f91f741a9c984bde8be5751_elex_mafia.exe
- Size 520KB
- Sample261029-ywp5maev9v
- SHA256 81ae2c11daf7edc5f495846666bad1155722f95f3e86d07e7ef8c7e9df6f9460
- MD5 ba4347ef0f91f741a9c984bde8be5751
- SHA1 270f9ff0917a10dda1b9c54092e8417c2ca3ef7c
- SHA512 ca5f3539f26027bb56b71d1914efddf83d80eb739b06acf7562cde3d8a9b294d74adcde28b0e338cb7dd45d979ca6747428cee27f9091f08feafb225bbbc0391
- SSDEEP 12288:gj8fuxR21t5i8f+ixKUBbwd7n3/uyCrNZ:gj8fuK1GYHxZbg3GyCrN
- TLSH T1F0B4F1127985C033E8D316314A66DBA657BEBC709B3691C73BD0366D6EB42C1E77830A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6024 EF19.tmp 3332 EFB5.tmp 4076 F042.tmp 4048 F0EE.tmp 3356 F1D8.tmp 4044 F246.tmp 4644 F2F1.tmp 4240 F37E.tmp 5080 F40B.tmp 5376 F4B7.tmp 4704 F553.tmp 908 F63D.tmp 4208 F728.tmp 4832 F785.tmp 2452 F7E3.tmp 3364 F860.tmp 2644 F8ED.tmp 848 F95A.tmp 6076 F9F6.tmp 1812 FAA2.tmp 4948 FB7D.tmp 4020 FC48.tmp 1876 FCB5.tmp 764 FD71.tmp 3340 FDFE.tmp 4492 FE9A.tmp 2780 FF26.tmp 4128 FFC3.tmp 6064 40.tmp 4396 DC.tmp 6020 169.tmp 2788 1E6.tmp 2556 291.tmp 5992 31E.tmp 5636 3BA.tmp 3564 428.tmp 4392 4A5.tmp 5816 531.tmp 2476 5AE.tmp 1348 61C.tmp 2712 699.tmp 2004 725.tmp 3264 783.tmp 4576 800.tmp 1800 88D.tmp 1056 90A.tmp 5572 996.tmp 2524 A33.tmp 6116 AB0.tmp 4268 B3C.tmp 5776 B9A.tmp 4784 C27.tmp 3492 CA4.tmp 1284 D01.tmp 3432 D7E.tmp 3848 E0B.tmp 3252 E78.tmp 4156 EF5.tmp 4996 F82.tmp 3536 FEF.tmp 2792 105D.tmp 2736 10DA.tmp 4636 1157.tmp 6012 11C4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 350B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2324.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 669B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4458.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 902B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D775.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F732.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 146F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 105D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BFC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5956 wrote to memory of 6024 5956 2026-10-28_ba4347ef0f91f741a9c984bde8be5751_elex_mafia.exe 88 PID 6024 wrote to memory of 3332 6024 EF19.tmp 89 PID 3332 wrote to memory of 4076 3332 EFB5.tmp 90 PID 4076 wrote to memory of 4048 4076 F042.tmp 91 PID 4048 wrote to memory of 3356 4048 F0EE.tmp 92 PID 3356 wrote to memory of 4044 3356 F1D8.tmp 93 PID 4044 wrote to memory of 4644 4044 F246.tmp 94 PID 4644 wrote to memory of 4240 4644 F2F1.tmp 95 PID 4240 wrote to memory of 5080 4240 F37E.tmp 96 PID 5080 wrote to memory of 5376 5080 F40B.tmp 97 PID 5376 wrote to memory of 4704 5376 F4B7.tmp 98 PID 4704 wrote to memory of 908 4704 F553.tmp 99 PID 908 wrote to memory of 4208 908 F63D.tmp 100 PID 4208 wrote to memory of 4832 4208 F728.tmp 101 PID 4832 wrote to memory of 2452 4832 F785.tmp 102 PID 2452 wrote to memory of 3364 2452 F7E3.tmp 103 PID 3364 wrote to memory of 2644 3364 F860.tmp 104 PID 2644 wrote to memory of 848 2644 F8ED.tmp 105 PID 848 wrote to memory of 6076 848 F95A.tmp 106 PID 6076 wrote to memory of 1812 6076 F9F6.tmp 107 PID 1812 wrote to memory of 4948 1812 FAA2.tmp 108 PID 4948 wrote to memory of 4020 4948 FB7D.tmp 109 PID 4020 wrote to memory of 1876 4020 FC48.tmp 110 PID 1876 wrote to memory of 764 1876 FCB5.tmp 111 PID 764 wrote to memory of 3340 764 FD71.tmp 112 PID 3340 wrote to memory of 4492 3340 FDFE.tmp 113 PID 4492 wrote to memory of 2780 4492 FE9A.tmp 114 PID 2780 wrote to memory of 4128 2780 FF26.tmp 115 PID 4128 wrote to memory of 6064 4128 FFC3.tmp 116 PID 6064 wrote to memory of 4396 6064 40.tmp 117 PID 4396 wrote to memory of 6020 4396 DC.tmp 118 PID 6020 wrote to memory of 2788 6020 169.tmp 119 PID 2788 wrote to memory of 2556 2788 1E6.tmp 120 PID 2556 wrote to memory of 5992 2556 291.tmp 121 PID 5992 wrote to memory of 5636 5992 31E.tmp 122 PID 5636 wrote to memory of 3564 5636 3BA.tmp 123 PID 3564 wrote to memory of 4392 3564 428.tmp 124 PID 4392 wrote to memory of 5816 4392 4A5.tmp 125 PID 5816 wrote to memory of 2476 5816 531.tmp 126 PID 2476 wrote to memory of 1348 2476 5AE.tmp 127 PID 1348 wrote to memory of 2712 1348 61C.tmp 128 PID 2712 wrote to memory of 2004 2712 699.tmp 129 PID 2004 wrote to memory of 3264 2004 725.tmp 130 PID 3264 wrote to memory of 4576 3264 783.tmp 131 PID 4576 wrote to memory of 1800 4576 800.tmp 132 PID 1800 wrote to memory of 1056 1800 88D.tmp 133 PID 1056 wrote to memory of 5572 1056 90A.tmp 134 PID 5572 wrote to memory of 2524 5572 996.tmp 135 PID 2524 wrote to memory of 6116 2524 A33.tmp 136 PID 6116 wrote to memory of 4268 6116 AB0.tmp 137 PID 4268 wrote to memory of 5776 4268 B3C.tmp 138 PID 5776 wrote to memory of 4784 5776 B9A.tmp 139 PID 4784 wrote to memory of 3492 4784 C27.tmp 140 PID 3492 wrote to memory of 1284 3492 CA4.tmp 141 PID 1284 wrote to memory of 3432 1284 D01.tmp 142 PID 3432 wrote to memory of 3848 3432 D7E.tmp 143 PID 3848 wrote to memory of 3252 3848 E0B.tmp 144 PID 3252 wrote to memory of 4156 3252 E78.tmp 145 PID 4156 wrote to memory of 4996 4156 EF5.tmp 146 PID 4996 wrote to memory of 3536 4996 F82.tmp 147 PID 3536 wrote to memory of 2792 3536 FEF.tmp 148 PID 2792 wrote to memory of 2736 2792 105D.tmp 149 PID 2736 wrote to memory of 4636 2736 10DA.tmp 150 PID 4636 wrote to memory of 6012 4636 1157.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_ba4347ef0f91f741a9c984bde8be5751_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_ba4347ef0f91f741a9c984bde8be5751_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\F37E.tmp"C:\Users\Admin\AppData\Local\Temp\F37E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\F860.tmp"C:\Users\Admin\AppData\Local\Temp\F860.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"C:\Users\Admin\AppData\Local\Temp\FB7D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"C:\Users\Admin\AppData\Local\Temp\FFC3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\DC.tmp"C:\Users\Admin\AppData\Local\Temp\DC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\169.tmp"C:\Users\Admin\AppData\Local\Temp\169.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\428.tmp"C:\Users\Admin\AppData\Local\Temp\428.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\996.tmp"C:\Users\Admin\AppData\Local\Temp\996.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\A33.tmp"C:\Users\Admin\AppData\Local\Temp\A33.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\B3C.tmp"C:\Users\Admin\AppData\Local\Temp\B3C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\B9A.tmp"C:\Users\Admin\AppData\Local\Temp\B9A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\C27.tmp"C:\Users\Admin\AppData\Local\Temp\C27.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\CA4.tmp"C:\Users\Admin\AppData\Local\Temp\CA4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\D01.tmp"C:\Users\Admin\AppData\Local\Temp\D01.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\EF5.tmp"C:\Users\Admin\AppData\Local\Temp\EF5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\FEF.tmp"C:\Users\Admin\AppData\Local\Temp\FEF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\10DA.tmp"C:\Users\Admin\AppData\Local\Temp\10DA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1157.tmp"C:\Users\Admin\AppData\Local\Temp\1157.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\11C4.tmp"C:\Users\Admin\AppData\Local\Temp\11C4.tmp"65⤵
- Executes dropped EXE
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\12ED.tmp"C:\Users\Admin\AppData\Local\Temp\12ED.tmp"67⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"68⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\13E7.tmp"C:\Users\Admin\AppData\Local\Temp\13E7.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"70⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"71⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\153F.tmp"C:\Users\Admin\AppData\Local\Temp\153F.tmp"72⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\15BC.tmp"C:\Users\Admin\AppData\Local\Temp\15BC.tmp"73⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"74⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"75⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"76⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\183C.tmp"C:\Users\Admin\AppData\Local\Temp\183C.tmp"78⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\18AA.tmp"C:\Users\Admin\AppData\Local\Temp\18AA.tmp"79⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\1927.tmp"C:\Users\Admin\AppData\Local\Temp\1927.tmp"80⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"81⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\1A01.tmp"C:\Users\Admin\AppData\Local\Temp\1A01.tmp"82⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"83⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"84⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\1B69.tmp"C:\Users\Admin\AppData\Local\Temp\1B69.tmp"85⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"87⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"88⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"89⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"90⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"91⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"92⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"93⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"95⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"96⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\2135.tmp"C:\Users\Admin\AppData\Local\Temp\2135.tmp"97⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"98⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"99⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\229D.tmp"C:\Users\Admin\AppData\Local\Temp\229D.tmp"100⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"101⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2377.tmp"C:\Users\Admin\AppData\Local\Temp\2377.tmp"102⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"103⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"104⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"105⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"106⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"107⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"108⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"109⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\275F.tmp"C:\Users\Admin\AppData\Local\Temp\275F.tmp"110⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"111⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\2859.tmp"C:\Users\Admin\AppData\Local\Temp\2859.tmp"112⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\28B7.tmp"C:\Users\Admin\AppData\Local\Temp\28B7.tmp"113⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\2934.tmp"C:\Users\Admin\AppData\Local\Temp\2934.tmp"114⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\29A1.tmp"C:\Users\Admin\AppData\Local\Temp\29A1.tmp"115⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"C:\Users\Admin\AppData\Local\Temp\2A1E.tmp"116⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"117⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"118⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"119⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"120⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2C61.tmp"C:\Users\Admin\AppData\Local\Temp\2C61.tmp"121⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"122⤵PID:6092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-