Analysis
- max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-18_23a30e0e29f4b5c77e06439e77709740_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_23a30e0e29f4b5c77e06439e77709740_elex_mafia.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-18_23a30e0e29f4b5c77e06439e77709740_elex_mafia.exe
- Size 520KB
- Sample260518-jtxpcsc18m
- SHA256 703bf2e6140e19d072fd72cb692c1a107615c8539eb8c1de82b323306e73b4ae
- MD5 23a30e0e29f4b5c77e06439e77709740
- SHA1 829bfadb3a8b74db9936f25ea1fa62dbbdb9fa23
- SHA512 185e7ed535d0a5eb65c385d4a32b5fa2e22cd49fc9963adbe7133cb251a175ea7628b0a7ec1d2b02ea4e88916cc5cb4f75ce1b48c7ded0194bdb2ad2152de25d
- SSDEEP 12288:gj8fuxR21t5i8fw97ip+kEnovn+sv0L9N6IeNAl1h2QNZ:gj8fuK1GYw4L3vn+sv0LL6I71ZN
- TLSH T169B4F011BA89C033E9E615304B53DBA60BBB7D755B2695C73B80266D3EB42C1E77830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 820 B234.tmp 4924 B33E.tmp 2924 B409.tmp 2300 B512.tmp 1480 B5CE.tmp 3792 B66A.tmp 1960 B735.tmp 3736 B7F1.tmp 4248 B8CC.tmp 116 B9B6.tmp 4996 BA33.tmp 3216 BB3D.tmp 1952 BC27.tmp 3992 BCE2.tmp 3276 BDAE.tmp 3204 BE79.tmp 2812 BF15.tmp 456 BFB1.tmp 3412 C06D.tmp 4024 C138.tmp 1664 C1E4.tmp 1720 C280.tmp 3932 C35B.tmp 980 C426.tmp 632 C4B2.tmp 4844 C57E.tmp 1136 C639.tmp 4568 C6D5.tmp 3084 C743.tmp 4920 C7EF.tmp 4968 C88B.tmp 2004 C937.tmp 2480 C9F2.tmp 4496 CA60.tmp 1788 CABD.tmp 4280 CB2B.tmp 3724 CB98.tmp 1428 CC05.tmp 3672 CC63.tmp 4984 CCC1.tmp 2476 CD1F.tmp 4196 CD7C.tmp 332 CDDA.tmp 4312 CE48.tmp 2536 CEC5.tmp 872 CF32.tmp 2904 CFBF.tmp 5028 D04B.tmp 2180 D0B9.tmp 3096 D116.tmp 1844 D174.tmp 4460 D1E1.tmp 4332 D24F.tmp 220 D29D.tmp 2184 D2FB.tmp 4592 D368.tmp 3124 D3D5.tmp 3804 D452.tmp 2208 D4A1.tmp 2312 D51E.tmp 2396 D59B.tmp 4672 D627.tmp 824 D6B4.tmp 4912 D740.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 938C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A697.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 548F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F39.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3784 wrote to memory of 820 3784 2026-05-18_23a30e0e29f4b5c77e06439e77709740_elex_mafia.exe 86 PID 820 wrote to memory of 4924 820 B234.tmp 88 PID 4924 wrote to memory of 2924 4924 B33E.tmp 90 PID 2924 wrote to memory of 2300 2924 B409.tmp 91 PID 2300 wrote to memory of 1480 2300 B512.tmp 93 PID 1480 wrote to memory of 3792 1480 B5CE.tmp 94 PID 3792 wrote to memory of 1960 3792 B66A.tmp 95 PID 1960 wrote to memory of 3736 1960 B735.tmp 96 PID 3736 wrote to memory of 4248 3736 B7F1.tmp 97 PID 4248 wrote to memory of 116 4248 B8CC.tmp 98 PID 116 wrote to memory of 4996 116 B9B6.tmp 99 PID 4996 wrote to memory of 3216 4996 BA33.tmp 100 PID 3216 wrote to memory of 1952 3216 BB3D.tmp 101 PID 1952 wrote to memory of 3992 1952 BC27.tmp 102 PID 3992 wrote to memory of 3276 3992 BCE2.tmp 103 PID 3276 wrote to memory of 3204 3276 BDAE.tmp 104 PID 3204 wrote to memory of 2812 3204 BE79.tmp 105 PID 2812 wrote to memory of 456 2812 BF15.tmp 106 PID 456 wrote to memory of 3412 456 BFB1.tmp 107 PID 3412 wrote to memory of 4024 3412 C06D.tmp 108 PID 4024 wrote to memory of 1664 4024 C138.tmp 109 PID 1664 wrote to memory of 1720 1664 C1E4.tmp 110 PID 1720 wrote to memory of 3932 1720 C280.tmp 111 PID 3932 wrote to memory of 980 3932 C35B.tmp 112 PID 980 wrote to memory of 632 980 C426.tmp 113 PID 632 wrote to memory of 4844 632 C4B2.tmp 114 PID 4844 wrote to memory of 1136 4844 C57E.tmp 115 PID 1136 wrote to memory of 4568 1136 C639.tmp 117 PID 4568 wrote to memory of 3084 4568 C6D5.tmp 118 PID 3084 wrote to memory of 4920 3084 C743.tmp 119 PID 4920 wrote to memory of 4968 4920 C7EF.tmp 120 PID 4968 wrote to memory of 2004 4968 C88B.tmp 121 PID 2004 wrote to memory of 2480 2004 C937.tmp 122 PID 2480 wrote to memory of 4496 2480 C9F2.tmp 123 PID 4496 wrote to memory of 1788 4496 CA60.tmp 124 PID 1788 wrote to memory of 4280 1788 CABD.tmp 125 PID 4280 wrote to memory of 3724 4280 CB2B.tmp 126 PID 3724 wrote to memory of 1428 3724 CB98.tmp 127 PID 1428 wrote to memory of 3672 1428 CC05.tmp 128 PID 3672 wrote to memory of 4984 3672 CC63.tmp 129 PID 4984 wrote to memory of 2476 4984 CCC1.tmp 130 PID 2476 wrote to memory of 4196 2476 CD1F.tmp 131 PID 4196 wrote to memory of 332 4196 CD7C.tmp 132 PID 332 wrote to memory of 4312 332 CDDA.tmp 133 PID 4312 wrote to memory of 2536 4312 CE48.tmp 134 PID 2536 wrote to memory of 872 2536 CEC5.tmp 135 PID 872 wrote to memory of 2904 872 CF32.tmp 136 PID 2904 wrote to memory of 5028 2904 CFBF.tmp 137 PID 5028 wrote to memory of 2180 5028 D04B.tmp 138 PID 2180 wrote to memory of 3096 2180 D0B9.tmp 139 PID 3096 wrote to memory of 1844 3096 D116.tmp 140 PID 1844 wrote to memory of 4460 1844 D174.tmp 141 PID 4460 wrote to memory of 4332 4460 D1E1.tmp 142 PID 4332 wrote to memory of 220 4332 D24F.tmp 143 PID 220 wrote to memory of 2184 220 D29D.tmp 144 PID 2184 wrote to memory of 4592 2184 D2FB.tmp 145 PID 4592 wrote to memory of 3124 4592 D368.tmp 146 PID 3124 wrote to memory of 3804 3124 D3D5.tmp 147 PID 3804 wrote to memory of 2208 3804 D452.tmp 148 PID 2208 wrote to memory of 2312 2208 D4A1.tmp 149 PID 2312 wrote to memory of 2396 2312 D51E.tmp 150 PID 2396 wrote to memory of 4672 2396 D59B.tmp 151 PID 4672 wrote to memory of 824 4672 D627.tmp 152 PID 824 wrote to memory of 4912 824 D6B4.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_23a30e0e29f4b5c77e06439e77709740_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_23a30e0e29f4b5c77e06439e77709740_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\B33E.tmp"C:\Users\Admin\AppData\Local\Temp\B33E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B512.tmp"C:\Users\Admin\AppData\Local\Temp\B512.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\B66A.tmp"C:\Users\Admin\AppData\Local\Temp\B66A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\B735.tmp"C:\Users\Admin\AppData\Local\Temp\B735.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"C:\Users\Admin\AppData\Local\Temp\B8CC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\BA33.tmp"C:\Users\Admin\AppData\Local\Temp\BA33.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"C:\Users\Admin\AppData\Local\Temp\BB3D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\BC27.tmp"C:\Users\Admin\AppData\Local\Temp\BC27.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\BF15.tmp"C:\Users\Admin\AppData\Local\Temp\BF15.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\C138.tmp"C:\Users\Admin\AppData\Local\Temp\C138.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\C426.tmp"C:\Users\Admin\AppData\Local\Temp\C426.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\C57E.tmp"C:\Users\Admin\AppData\Local\Temp\C57E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\C743.tmp"C:\Users\Admin\AppData\Local\Temp\C743.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\C937.tmp"C:\Users\Admin\AppData\Local\Temp\C937.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\D04B.tmp"C:\Users\Admin\AppData\Local\Temp\D04B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\D174.tmp"C:\Users\Admin\AppData\Local\Temp\D174.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D29D.tmp"C:\Users\Admin\AppData\Local\Temp\D29D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\D4A1.tmp"C:\Users\Admin\AppData\Local\Temp\D4A1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\D740.tmp"C:\Users\Admin\AppData\Local\Temp\D740.tmp"65⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"66⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"67⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"68⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"69⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"70⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"71⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"72⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"73⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"74⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\DC32.tmp"C:\Users\Admin\AppData\Local\Temp\DC32.tmp"75⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\DC90.tmp"C:\Users\Admin\AppData\Local\Temp\DC90.tmp"76⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\DCFD.tmp"C:\Users\Admin\AppData\Local\Temp\DCFD.tmp"77⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"78⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\DDD8.tmp"C:\Users\Admin\AppData\Local\Temp\DDD8.tmp"79⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"80⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"81⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"82⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"83⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"84⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"85⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\E087.tmp"C:\Users\Admin\AppData\Local\Temp\E087.tmp"86⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"87⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"88⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"89⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\E20E.tmp"C:\Users\Admin\AppData\Local\Temp\E20E.tmp"90⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"91⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"92⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"93⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"94⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"95⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"96⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"97⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\E55A.tmp"C:\Users\Admin\AppData\Local\Temp\E55A.tmp"98⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"99⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\E635.tmp"C:\Users\Admin\AppData\Local\Temp\E635.tmp"100⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"101⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"102⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"103⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"104⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\E838.tmp"C:\Users\Admin\AppData\Local\Temp\E838.tmp"105⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"106⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\E913.tmp"C:\Users\Admin\AppData\Local\Temp\E913.tmp"107⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"108⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"109⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"110⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"C:\Users\Admin\AppData\Local\Temp\EAD8.tmp"111⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"112⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"113⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\EC11.tmp"C:\Users\Admin\AppData\Local\Temp\EC11.tmp"114⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"115⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\ED49.tmp"C:\Users\Admin\AppData\Local\Temp\ED49.tmp"117⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"118⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\EE14.tmp"C:\Users\Admin\AppData\Local\Temp\EE14.tmp"119⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"120⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"121⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-