Analysis
- max time kernel
150s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_29f510f185b32402b62d99cb13117f84_elex_mafia.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_29f510f185b32402b62d99cb13117f84_elex_mafia.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-17_29f510f185b32402b62d99cb13117f84_elex_mafia.exe
- Size 520KB
- Sample260417-sgsdjsds41
- SHA256 3750ffcc8aa1605b57a4b16eed5e6d5e90152a8f528434c5b9ba664f8775231e
- MD5 29f510f185b32402b62d99cb13117f84
- SHA1 f4371085db9f55d6fc869224b3a19da2d91d2c3c
- SHA512 c82a8399bd432302f9f7f39fd8afe471f5e12c074b85f0debe04b385a240fcff324ddae59c90cc068850f9484e3921d4b8467012193da1122572364a6a243a51
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLn/UDbyCDe0dWDjC1s1uJTT80yWafqW3EcQ9OU:roRXOQjmOykbyCMggT0SbEc+INZE
- TLSH T19EB4F022B584C036E59221304F26DFA14B7F7D668B6AA6C33BC43A6D6EF42D1D634347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1700 E02E.tmp 4944 E09C.tmp 4212 E0EA.tmp 3180 E177.tmp 6012 E203.tmp 5928 E271.tmp 5828 E32C.tmp 3792 E38A.tmp 5040 E426.tmp 3176 E4D2.tmp 1456 E56E.tmp 3928 E60A.tmp 5232 E697.tmp 5124 E6E5.tmp 3908 E762.tmp 2912 E7DF.tmp 4344 E85C.tmp 4340 E8BA.tmp 5996 E918.tmp 4668 E9A4.tmp 5392 EA12.tmp 3268 EAAE.tmp 2180 EB3B.tmp 4312 EBC7.tmp 5460 EC44.tmp 1396 ECC1.tmp 4716 ED4E.tmp 3000 EDAC.tmp 5704 EE29.tmp 5512 EEB5.tmp 3080 EF42.tmp 568 EFCE.tmp 3056 F07A.tmp 4960 F0F7.tmp 1468 F165.tmp 5440 F1B3.tmp 4148 F211.tmp 3952 F25F.tmp 4284 F2BC.tmp 2896 F339.tmp 5416 F3A7.tmp 4260 F405.tmp 4684 F472.tmp 5228 F4D0.tmp 908 F52D.tmp 2784 F58B.tmp 3884 F5D9.tmp 5552 F627.tmp 4564 F685.tmp 4008 F6D3.tmp 2160 F731.tmp 1404 F77F.tmp 4772 F7CD.tmp 2176 F82B.tmp 4784 F889.tmp 1564 F8E7.tmp 4568 F944.tmp 3436 F992.tmp 1684 F9F0.tmp 3420 FA4E.tmp 3732 FABB.tmp 1488 FB19.tmp 2028 FB77.tmp 2560 FBD5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4978.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B14A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 134.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 561A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F18F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5188 wrote to memory of 1700 5188 2026-04-17_29f510f185b32402b62d99cb13117f84_elex_mafia.exe 78 PID 1700 wrote to memory of 4944 1700 E02E.tmp 79 PID 4944 wrote to memory of 4212 4944 E09C.tmp 80 PID 4212 wrote to memory of 3180 4212 E0EA.tmp 81 PID 3180 wrote to memory of 6012 3180 E177.tmp 82 PID 6012 wrote to memory of 5928 6012 E203.tmp 83 PID 5928 wrote to memory of 5828 5928 E271.tmp 84 PID 5828 wrote to memory of 3792 5828 E32C.tmp 85 PID 3792 wrote to memory of 5040 3792 E38A.tmp 86 PID 5040 wrote to memory of 3176 5040 E426.tmp 87 PID 3176 wrote to memory of 1456 3176 E4D2.tmp 88 PID 1456 wrote to memory of 3928 1456 E56E.tmp 89 PID 3928 wrote to memory of 5232 3928 E60A.tmp 90 PID 5232 wrote to memory of 5124 5232 E697.tmp 91 PID 5124 wrote to memory of 3908 5124 E6E5.tmp 92 PID 3908 wrote to memory of 2912 3908 E762.tmp 93 PID 2912 wrote to memory of 4344 2912 E7DF.tmp 94 PID 4344 wrote to memory of 4340 4344 E85C.tmp 95 PID 4340 wrote to memory of 5996 4340 E8BA.tmp 96 PID 5996 wrote to memory of 4668 5996 E918.tmp 97 PID 4668 wrote to memory of 5392 4668 E9A4.tmp 98 PID 5392 wrote to memory of 3268 5392 EA12.tmp 99 PID 3268 wrote to memory of 2180 3268 EAAE.tmp 100 PID 2180 wrote to memory of 4312 2180 EB3B.tmp 101 PID 4312 wrote to memory of 5460 4312 EBC7.tmp 102 PID 5460 wrote to memory of 1396 5460 EC44.tmp 103 PID 1396 wrote to memory of 4716 1396 ECC1.tmp 104 PID 4716 wrote to memory of 3000 4716 ED4E.tmp 105 PID 3000 wrote to memory of 5704 3000 EDAC.tmp 106 PID 5704 wrote to memory of 5512 5704 EE29.tmp 107 PID 5512 wrote to memory of 3080 5512 EEB5.tmp 108 PID 3080 wrote to memory of 568 3080 EF42.tmp 109 PID 568 wrote to memory of 3056 568 EFCE.tmp 110 PID 3056 wrote to memory of 4960 3056 F07A.tmp 111 PID 4960 wrote to memory of 1468 4960 F0F7.tmp 112 PID 1468 wrote to memory of 5440 1468 F165.tmp 113 PID 5440 wrote to memory of 4148 5440 F1B3.tmp 114 PID 4148 wrote to memory of 3952 4148 F211.tmp 115 PID 3952 wrote to memory of 4284 3952 F25F.tmp 116 PID 4284 wrote to memory of 2896 4284 F2BC.tmp 117 PID 2896 wrote to memory of 5416 2896 F339.tmp 118 PID 5416 wrote to memory of 4260 5416 F3A7.tmp 119 PID 4260 wrote to memory of 4684 4260 F405.tmp 120 PID 4684 wrote to memory of 5228 4684 F472.tmp 121 PID 5228 wrote to memory of 908 5228 F4D0.tmp 122 PID 908 wrote to memory of 2784 908 F52D.tmp 123 PID 2784 wrote to memory of 3884 2784 F58B.tmp 124 PID 3884 wrote to memory of 5552 3884 F5D9.tmp 125 PID 5552 wrote to memory of 4564 5552 F627.tmp 126 PID 4564 wrote to memory of 4008 4564 F685.tmp 127 PID 4008 wrote to memory of 2160 4008 F6D3.tmp 128 PID 2160 wrote to memory of 1404 2160 F731.tmp 129 PID 1404 wrote to memory of 4772 1404 F77F.tmp 130 PID 4772 wrote to memory of 2176 4772 F7CD.tmp 131 PID 2176 wrote to memory of 4784 2176 F82B.tmp 132 PID 4784 wrote to memory of 1564 4784 F889.tmp 133 PID 1564 wrote to memory of 4568 1564 F8E7.tmp 134 PID 4568 wrote to memory of 3436 4568 F944.tmp 135 PID 3436 wrote to memory of 1684 3436 F992.tmp 136 PID 1684 wrote to memory of 3420 1684 F9F0.tmp 137 PID 3420 wrote to memory of 3732 3420 FA4E.tmp 138 PID 3732 wrote to memory of 1488 3732 FABB.tmp 139 PID 1488 wrote to memory of 2028 1488 FB19.tmp 140 PID 2028 wrote to memory of 2560 2028 FB77.tmp 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_29f510f185b32402b62d99cb13117f84_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_29f510f185b32402b62d99cb13117f84_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\F472.tmp"C:\Users\Admin\AppData\Local\Temp\F472.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"C:\Users\Admin\AppData\Local\Temp\F9F0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"65⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"66⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"67⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"68⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"69⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"70⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"71⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"72⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"73⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"74⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"75⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"76⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"77⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"78⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"79⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"80⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"81⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"83⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"84⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"85⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"86⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"87⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"88⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"89⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"90⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"91⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"92⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"93⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"94⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"95⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"96⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"97⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"98⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"99⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"100⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"101⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"102⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"103⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"104⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"105⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"106⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"107⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"108⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"109⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"110⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"111⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"112⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"113⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"114⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\BA3.tmp"C:\Users\Admin\AppData\Local\Temp\BA3.tmp"115⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"116⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"117⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"118⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"119⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"120⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"121⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"122⤵PID:3172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-