Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_f2b113177f4c972a8ec1a9902560b1b9_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_f2b113177f4c972a8ec1a9902560b1b9_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-01_f2b113177f4c972a8ec1a9902560b1b9_elex_mafia.exe
- Size 581KB
- Sample261102-dvm9esew5t
- SHA256 c0861d93fe33dadb640d1c72dfd520f316bf845ee9130d17f1840c0dbff8ea42
- MD5 f2b113177f4c972a8ec1a9902560b1b9
- SHA1 d0dba5d0e51e82a2c3ee46429b78a4bbf21cff0e
- SHA512 62ea6d756c7151ef936c9e2b6e8114b0685f13077cfccf204d93538448a1c8e4858bc16f59300233e2b6361988166600e8cc230e3f5672b8286cafeff04a2923
- SSDEEP 12288:yZ355mztdeUIUGpNt11u5MfxXxZdRKea2iKhBwSvO/qZoXWjdqW:yZ3qzaUIUUv9TZd852iWwSIqqGhT
- TLSH T143C40111B985C032F5E206304A6AEBA6597B7C731B7658CB7B90776E2FB01D1E375302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1344 F085.tmp 2800 F131.tmp 3396 F22B.tmp 3816 F2E7.tmp 4304 F373.tmp 5008 F45E.tmp 4776 F4EA.tmp 4940 F567.tmp 4404 F613.tmp 4804 F6AF.tmp 2284 F73C.tmp 4680 F7B9.tmp 4936 F855.tmp 4952 F8F1.tmp 1632 F97E.tmp 4512 FA3A.tmp 1804 FAC6.tmp 3684 FB53.tmp 4884 FBFF.tmp 3172 FC9B.tmp 208 FD37.tmp 4292 FDD3.tmp 368 FE70.tmp 4820 FF1C.tmp 2476 FF99.tmp 816 44.tmp 1796 A2.tmp 3060 14E.tmp 3940 20A.tmp 4072 2B5.tmp 3116 352.tmp 4356 3DE.tmp 4340 47B.tmp 1520 4E8.tmp 1688 536.tmp 1908 584.tmp 4020 5D2.tmp 1140 640.tmp 1712 68E.tmp 4388 6DC.tmp 1240 73A.tmp 1656 797.tmp 3112 7E6.tmp 1708 824.tmp 4964 882.tmp 4044 8D0.tmp 2420 90E.tmp 2084 95D.tmp 2616 9AB.tmp 2784 A18.tmp 4540 A57.tmp 1172 AA5.tmp 4452 AF3.tmp 3572 B51.tmp 3188 B9F.tmp 4236 BDD.tmp 3652 C2B.tmp 4016 C89.tmp 1548 CC8.tmp 1448 D25.tmp 2496 D73.tmp 2976 DD1.tmp 1620 E2F.tmp 3156 E7D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 643E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 932E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 1344 3880 2026-11-01_f2b113177f4c972a8ec1a9902560b1b9_elex_mafia.exe 85 PID 1344 wrote to memory of 2800 1344 F085.tmp 86 PID 2800 wrote to memory of 3396 2800 F131.tmp 87 PID 3396 wrote to memory of 3816 3396 F22B.tmp 88 PID 3816 wrote to memory of 4304 3816 F2E7.tmp 89 PID 4304 wrote to memory of 5008 4304 F373.tmp 90 PID 5008 wrote to memory of 4776 5008 F45E.tmp 91 PID 4776 wrote to memory of 4940 4776 F4EA.tmp 92 PID 4940 wrote to memory of 4404 4940 F567.tmp 93 PID 4404 wrote to memory of 4804 4404 F613.tmp 94 PID 4804 wrote to memory of 2284 4804 F6AF.tmp 95 PID 2284 wrote to memory of 4680 2284 F73C.tmp 96 PID 4680 wrote to memory of 4936 4680 F7B9.tmp 97 PID 4936 wrote to memory of 4952 4936 F855.tmp 98 PID 4952 wrote to memory of 1632 4952 F8F1.tmp 99 PID 1632 wrote to memory of 4512 1632 F97E.tmp 100 PID 4512 wrote to memory of 1804 4512 FA3A.tmp 101 PID 1804 wrote to memory of 3684 1804 FAC6.tmp 102 PID 3684 wrote to memory of 4884 3684 FB53.tmp 103 PID 4884 wrote to memory of 3172 4884 FBFF.tmp 106 PID 3172 wrote to memory of 208 3172 FC9B.tmp 107 PID 208 wrote to memory of 4292 208 FD37.tmp 108 PID 4292 wrote to memory of 368 4292 FDD3.tmp 109 PID 368 wrote to memory of 4820 368 FE70.tmp 110 PID 4820 wrote to memory of 2476 4820 FF1C.tmp 111 PID 2476 wrote to memory of 816 2476 FF99.tmp 112 PID 816 wrote to memory of 1796 816 44.tmp 113 PID 1796 wrote to memory of 3060 1796 A2.tmp 115 PID 3060 wrote to memory of 3940 3060 14E.tmp 116 PID 3940 wrote to memory of 4072 3940 20A.tmp 118 PID 4072 wrote to memory of 3116 4072 2B5.tmp 119 PID 3116 wrote to memory of 4356 3116 352.tmp 120 PID 4356 wrote to memory of 4340 4356 3DE.tmp 121 PID 4340 wrote to memory of 1520 4340 47B.tmp 122 PID 1520 wrote to memory of 1688 1520 4E8.tmp 123 PID 1688 wrote to memory of 1908 1688 536.tmp 124 PID 1908 wrote to memory of 4020 1908 584.tmp 125 PID 4020 wrote to memory of 1140 4020 5D2.tmp 126 PID 1140 wrote to memory of 1712 1140 640.tmp 127 PID 1712 wrote to memory of 4388 1712 68E.tmp 128 PID 4388 wrote to memory of 1240 4388 6DC.tmp 129 PID 1240 wrote to memory of 1656 1240 73A.tmp 130 PID 1656 wrote to memory of 3112 1656 797.tmp 131 PID 3112 wrote to memory of 1708 3112 7E6.tmp 132 PID 1708 wrote to memory of 4964 1708 824.tmp 133 PID 4964 wrote to memory of 4044 4964 882.tmp 134 PID 4044 wrote to memory of 2420 4044 8D0.tmp 135 PID 2420 wrote to memory of 2084 2420 90E.tmp 136 PID 2084 wrote to memory of 2616 2084 95D.tmp 137 PID 2616 wrote to memory of 2784 2616 9AB.tmp 138 PID 2784 wrote to memory of 4540 2784 A18.tmp 139 PID 4540 wrote to memory of 1172 4540 A57.tmp 140 PID 1172 wrote to memory of 4452 1172 AA5.tmp 141 PID 4452 wrote to memory of 3572 4452 AF3.tmp 142 PID 3572 wrote to memory of 3188 3572 B51.tmp 143 PID 3188 wrote to memory of 4236 3188 B9F.tmp 144 PID 4236 wrote to memory of 3652 4236 BDD.tmp 145 PID 3652 wrote to memory of 4016 3652 C2B.tmp 146 PID 4016 wrote to memory of 1548 4016 C89.tmp 147 PID 1548 wrote to memory of 1448 1548 CC8.tmp 149 PID 1448 wrote to memory of 2496 1448 D25.tmp 150 PID 2496 wrote to memory of 2976 2496 D73.tmp 151 PID 2976 wrote to memory of 1620 2976 DD1.tmp 152 PID 1620 wrote to memory of 3156 1620 E2F.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_f2b113177f4c972a8ec1a9902560b1b9_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f2b113177f4c972a8ec1a9902560b1b9_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\F085.tmp"C:\Users\Admin\AppData\Local\Temp\F085.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\F131.tmp"C:\Users\Admin\AppData\Local\Temp\F131.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\F22B.tmp"C:\Users\Admin\AppData\Local\Temp\F22B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"C:\Users\Admin\AppData\Local\Temp\F4EA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\F613.tmp"C:\Users\Admin\AppData\Local\Temp\F613.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\F6AF.tmp"C:\Users\Admin\AppData\Local\Temp\F6AF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\F73C.tmp"C:\Users\Admin\AppData\Local\Temp\F73C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\F855.tmp"C:\Users\Admin\AppData\Local\Temp\F855.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\F97E.tmp"C:\Users\Admin\AppData\Local\Temp\F97E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\FB53.tmp"C:\Users\Admin\AppData\Local\Temp\FB53.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\FD37.tmp"C:\Users\Admin\AppData\Local\Temp\FD37.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\FE70.tmp"C:\Users\Admin\AppData\Local\Temp\FE70.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\44.tmp"C:\Users\Admin\AppData\Local\Temp\44.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\20A.tmp"C:\Users\Admin\AppData\Local\Temp\20A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\3DE.tmp"C:\Users\Admin\AppData\Local\Temp\3DE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4E8.tmp"C:\Users\Admin\AppData\Local\Temp\4E8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\584.tmp"C:\Users\Admin\AppData\Local\Temp\584.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\640.tmp"C:\Users\Admin\AppData\Local\Temp\640.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\6DC.tmp"C:\Users\Admin\AppData\Local\Temp\6DC.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7E6.tmp"C:\Users\Admin\AppData\Local\Temp\7E6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\882.tmp"C:\Users\Admin\AppData\Local\Temp\882.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8D0.tmp"C:\Users\Admin\AppData\Local\Temp\8D0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A18.tmp"C:\Users\Admin\AppData\Local\Temp\A18.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A57.tmp"C:\Users\Admin\AppData\Local\Temp\A57.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\B51.tmp"C:\Users\Admin\AppData\Local\Temp\B51.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\B9F.tmp"C:\Users\Admin\AppData\Local\Temp\B9F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\C89.tmp"C:\Users\Admin\AppData\Local\Temp\C89.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DD1.tmp"C:\Users\Admin\AppData\Local\Temp\DD1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\E7D.tmp"C:\Users\Admin\AppData\Local\Temp\E7D.tmp"65⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\EDB.tmp"C:\Users\Admin\AppData\Local\Temp\EDB.tmp"66⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"67⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\F96.tmp"C:\Users\Admin\AppData\Local\Temp\F96.tmp"68⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\FE4.tmp"C:\Users\Admin\AppData\Local\Temp\FE4.tmp"69⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"70⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\1071.tmp"C:\Users\Admin\AppData\Local\Temp\1071.tmp"71⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\10BF.tmp"C:\Users\Admin\AppData\Local\Temp\10BF.tmp"72⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"73⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\115B.tmp"C:\Users\Admin\AppData\Local\Temp\115B.tmp"74⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\11B9.tmp"C:\Users\Admin\AppData\Local\Temp\11B9.tmp"75⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\1207.tmp"C:\Users\Admin\AppData\Local\Temp\1207.tmp"76⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"77⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"78⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\1301.tmp"C:\Users\Admin\AppData\Local\Temp\1301.tmp"79⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"80⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\139E.tmp"C:\Users\Admin\AppData\Local\Temp\139E.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:228 -
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"83⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"84⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\14F5.tmp"C:\Users\Admin\AppData\Local\Temp\14F5.tmp"85⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"86⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"88⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\165D.tmp"C:\Users\Admin\AppData\Local\Temp\165D.tmp"89⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"90⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\1728.tmp"C:\Users\Admin\AppData\Local\Temp\1728.tmp"91⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"92⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"93⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"94⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"96⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"97⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"98⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"99⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"100⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"101⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"102⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"103⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"104⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"105⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"107⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"C:\Users\Admin\AppData\Local\Temp\1CC5.tmp"108⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\1D33.tmp"C:\Users\Admin\AppData\Local\Temp\1D33.tmp"109⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"110⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"111⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"112⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\1E9A.tmp"C:\Users\Admin\AppData\Local\Temp\1E9A.tmp"113⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"114⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\1F46.tmp"C:\Users\Admin\AppData\Local\Temp\1F46.tmp"115⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\1F94.tmp"C:\Users\Admin\AppData\Local\Temp\1F94.tmp"116⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2001.tmp"C:\Users\Admin\AppData\Local\Temp\2001.tmp"117⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\206F.tmp"C:\Users\Admin\AppData\Local\Temp\206F.tmp"118⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\20AD.tmp"C:\Users\Admin\AppData\Local\Temp\20AD.tmp"119⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"120⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"121⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"122⤵PID:4628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-