Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe
- Size 816KB
- Sample260718-e6z8ssbw9w
- SHA256 cad2bcc9d85e28db4ff1c06cf9aea21471068380cb047872f590ddc1145086b5
- MD5 24c3b29c6ffc1c83d647d1bc5c0a38ed
- SHA1 f2548f5c9cf98e4b40ac84a76abd1aed8eb72107
- SHA512 29df15254932e6e4a5911f736c05fcc104c887d380a174b0de355f4f0d41a3996c9448d12ff804cbed4a64a94e19e031d5edfe675d814b4ec7362f0dc8df28a8
- SSDEEP 12288:+mF/W8Dsy37qIZtnp83VjyjxpCTePXyfzfFG3Z:+m0833TDpQMAKPofY3
- TLSH T16805F111F684C032E59202354F2EEBA2487A7D715B27A4C77B903ABE6FB52D1DA71307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1484 B198.tmp 1644 B2D0.tmp 4976 B36D.tmp 4748 B495.tmp 1560 B570.tmp 452 B64B.tmp 2308 B706.tmp 3708 B7C2.tmp 1052 B86E.tmp 2180 B968.tmp 5096 BA14.tmp 1480 BADF.tmp 4404 BB6B.tmp 4092 BC27.tmp 4368 BCD3.tmp 4192 BD6F.tmp 4652 BE0B.tmp 2128 BEC7.tmp 1724 BF92.tmp 1272 C06D.tmp 204 C119.tmp 1176 C1D4.tmp 3124 C280.tmp 896 C32C.tmp 3324 C3D8.tmp 3364 C464.tmp 4524 C501.tmp 3768 C57E.tmp 3276 C629.tmp 2544 C6D5.tmp 3424 C752.tmp 3764 C7FE.tmp 4464 C87B.tmp 4620 C8C9.tmp 2940 C927.tmp 1664 C975.tmp 3844 C9D3.tmp 4520 CA21.tmp 3932 CA8E.tmp 2740 CADD.tmp 2336 CB3A.tmp 1132 CB98.tmp 4844 CBE6.tmp 1900 CC34.tmp 2440 CC82.tmp 3356 CCE0.tmp 4560 CD2E.tmp 3168 CD7C.tmp 4916 CDCB.tmp 2568 CE28.tmp 4028 CE76.tmp 3148 CEC5.tmp 4684 CF13.tmp 2260 CF70.tmp 1712 CFDE.tmp 4864 D02C.tmp 2832 D099.tmp 5064 D107.tmp 1616 D164.tmp 1660 D1C2.tmp 1924 D230.tmp 2916 D28D.tmp 4700 D2DB.tmp 2356 D339.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 250E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 711F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F170.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 1484 548 2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe 85 PID 1484 wrote to memory of 1644 1484 B198.tmp 86 PID 1644 wrote to memory of 4976 1644 B2D0.tmp 87 PID 4976 wrote to memory of 4748 4976 B36D.tmp 88 PID 4748 wrote to memory of 1560 4748 B495.tmp 89 PID 1560 wrote to memory of 452 1560 B570.tmp 90 PID 452 wrote to memory of 2308 452 B64B.tmp 91 PID 2308 wrote to memory of 3708 2308 B706.tmp 92 PID 3708 wrote to memory of 1052 3708 B7C2.tmp 93 PID 1052 wrote to memory of 2180 1052 B86E.tmp 94 PID 2180 wrote to memory of 5096 2180 B968.tmp 95 PID 5096 wrote to memory of 1480 5096 BA14.tmp 96 PID 1480 wrote to memory of 4404 1480 BADF.tmp 97 PID 4404 wrote to memory of 4092 4404 BB6B.tmp 98 PID 4092 wrote to memory of 4368 4092 BC27.tmp 99 PID 4368 wrote to memory of 4192 4368 BCD3.tmp 100 PID 4192 wrote to memory of 4652 4192 BD6F.tmp 101 PID 4652 wrote to memory of 2128 4652 BE0B.tmp 102 PID 2128 wrote to memory of 1724 2128 BEC7.tmp 103 PID 1724 wrote to memory of 1272 1724 BF92.tmp 104 PID 1272 wrote to memory of 204 1272 C06D.tmp 105 PID 204 wrote to memory of 1176 204 C119.tmp 106 PID 1176 wrote to memory of 3124 1176 C1D4.tmp 107 PID 3124 wrote to memory of 896 3124 C280.tmp 108 PID 896 wrote to memory of 3324 896 C32C.tmp 109 PID 3324 wrote to memory of 3364 3324 C3D8.tmp 110 PID 3364 wrote to memory of 4524 3364 C464.tmp 111 PID 4524 wrote to memory of 3768 4524 C501.tmp 112 PID 3768 wrote to memory of 3276 3768 C57E.tmp 113 PID 3276 wrote to memory of 2544 3276 C629.tmp 114 PID 2544 wrote to memory of 3424 2544 C6D5.tmp 115 PID 3424 wrote to memory of 3764 3424 C752.tmp 116 PID 3764 wrote to memory of 4464 3764 C7FE.tmp 117 PID 4464 wrote to memory of 4620 4464 C87B.tmp 118 PID 4620 wrote to memory of 2940 4620 C8C9.tmp 119 PID 2940 wrote to memory of 1664 2940 C927.tmp 120 PID 1664 wrote to memory of 3844 1664 C975.tmp 121 PID 3844 wrote to memory of 4520 3844 C9D3.tmp 122 PID 4520 wrote to memory of 3932 4520 CA21.tmp 123 PID 3932 wrote to memory of 2740 3932 CA8E.tmp 124 PID 2740 wrote to memory of 2336 2740 CADD.tmp 125 PID 2336 wrote to memory of 1132 2336 CB3A.tmp 126 PID 1132 wrote to memory of 4844 1132 CB98.tmp 127 PID 4844 wrote to memory of 1900 4844 CBE6.tmp 128 PID 1900 wrote to memory of 2440 1900 CC34.tmp 129 PID 2440 wrote to memory of 3356 2440 CC82.tmp 130 PID 3356 wrote to memory of 4560 3356 CCE0.tmp 131 PID 4560 wrote to memory of 3168 4560 CD2E.tmp 132 PID 3168 wrote to memory of 4916 3168 CD7C.tmp 133 PID 4916 wrote to memory of 2568 4916 CDCB.tmp 134 PID 2568 wrote to memory of 4028 2568 CE28.tmp 135 PID 4028 wrote to memory of 3148 4028 CE76.tmp 136 PID 3148 wrote to memory of 4684 3148 CEC5.tmp 137 PID 4684 wrote to memory of 2260 4684 CF13.tmp 138 PID 2260 wrote to memory of 1712 2260 CF70.tmp 139 PID 1712 wrote to memory of 4864 1712 CFDE.tmp 140 PID 4864 wrote to memory of 2832 4864 D02C.tmp 141 PID 2832 wrote to memory of 5064 2832 D099.tmp 142 PID 5064 wrote to memory of 1616 5064 D107.tmp 143 PID 1616 wrote to memory of 1660 1616 D164.tmp 144 PID 1660 wrote to memory of 1924 1660 D1C2.tmp 145 PID 1924 wrote to memory of 2916 1924 D230.tmp 146 PID 2916 wrote to memory of 4700 2916 D28D.tmp 147 PID 4700 wrote to memory of 2356 4700 D2DB.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_24c3b29c6ffc1c83d647d1bc5c0a38ed_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\B495.tmp"C:\Users\Admin\AppData\Local\Temp\B495.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\B64B.tmp"C:\Users\Admin\AppData\Local\Temp\B64B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\B706.tmp"C:\Users\Admin\AppData\Local\Temp\B706.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\BA14.tmp"C:\Users\Admin\AppData\Local\Temp\BA14.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\BC27.tmp"C:\Users\Admin\AppData\Local\Temp\BC27.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\BD6F.tmp"C:\Users\Admin\AppData\Local\Temp\BD6F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\C32C.tmp"C:\Users\Admin\AppData\Local\Temp\C32C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\C501.tmp"C:\Users\Admin\AppData\Local\Temp\C501.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\C57E.tmp"C:\Users\Admin\AppData\Local\Temp\C57E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"C:\Users\Admin\AppData\Local\Temp\C7FE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\C87B.tmp"C:\Users\Admin\AppData\Local\Temp\C87B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\CC34.tmp"C:\Users\Admin\AppData\Local\Temp\CC34.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\CC82.tmp"C:\Users\Admin\AppData\Local\Temp\CC82.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\CF13.tmp"C:\Users\Admin\AppData\Local\Temp\CF13.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"65⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"66⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"67⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"68⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"69⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"70⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\D54C.tmp"C:\Users\Admin\AppData\Local\Temp\D54C.tmp"71⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"73⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"74⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"75⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"76⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"77⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"78⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\D81B.tmp"C:\Users\Admin\AppData\Local\Temp\D81B.tmp"79⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\D869.tmp"C:\Users\Admin\AppData\Local\Temp\D869.tmp"80⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"81⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"82⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\D983.tmp"C:\Users\Admin\AppData\Local\Temp\D983.tmp"83⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"84⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"85⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"86⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\DADA.tmp"C:\Users\Admin\AppData\Local\Temp\DADA.tmp"87⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\DB28.tmp"C:\Users\Admin\AppData\Local\Temp\DB28.tmp"88⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\DB77.tmp"C:\Users\Admin\AppData\Local\Temp\DB77.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:240 -
C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"C:\Users\Admin\AppData\Local\Temp\DBC5.tmp"90⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"91⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"92⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"93⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"94⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"95⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"96⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"97⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\DE84.tmp"C:\Users\Admin\AppData\Local\Temp\DE84.tmp"98⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\DED2.tmp"C:\Users\Admin\AppData\Local\Temp\DED2.tmp"99⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"100⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"101⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"102⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"103⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"104⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"105⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"106⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"107⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\E29B.tmp"C:\Users\Admin\AppData\Local\Temp\E29B.tmp"108⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"109⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"110⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"111⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"112⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"113⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"114⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\E51B.tmp"C:\Users\Admin\AppData\Local\Temp\E51B.tmp"115⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"116⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"C:\Users\Admin\AppData\Local\Temp\E5D7.tmp"117⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"118⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"119⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"120⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\E76D.tmp"C:\Users\Admin\AppData\Local\Temp\E76D.tmp"121⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\E7BB.tmp"C:\Users\Admin\AppData\Local\Temp\E7BB.tmp"122⤵PID:764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-