Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_647f4286f17479c2b3f7f60b842c05ad_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_647f4286f17479c2b3f7f60b842c05ad_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_647f4286f17479c2b3f7f60b842c05ad_elex_mafia.exe
- Size 560KB
- Sample260802-rpc36abc67
- SHA256 c29e3e441306fda8dfe5b77db983c1449d8e163a6ef62ab2630161373a3e4474
- MD5 647f4286f17479c2b3f7f60b842c05ad
- SHA1 bca201511730cb188eff38e2788cedda647e891d
- SHA512 7545e1d1b8f654ab50da57a35790855a4849223125e00d5024e920daacce7c3a336e5f12b31a9ad8665bc7d40b9fed614f5d9fa5b14753fda071fb607aa2d408
- SSDEEP 12288:MlFXOQUDmrC8Sgq34hn5R9BLVJYKGocr8MygLNIZxV:MlUQbC8Sgd5jBrYKXEfIR
- TLSH T1FDC4F1177644C0B3E6C212314A56CBA22B3F7D755B29A0C737902A6DAFB53C1DA3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4540 990.tmp 3380 AD8.tmp 3356 D2A.tmp 4664 E72.tmp 4732 F9B.tmp 1676 10C4.tmp 2128 11ED.tmp 3272 12F6.tmp 4828 141F.tmp 644 1519.tmp 1608 1604.tmp 1124 16FE.tmp 2972 1817.tmp 1672 1930.tmp 2464 1A3A.tmp 4468 1B43.tmp 3520 1C4D.tmp 216 1D47.tmp 2452 1E22.tmp 3360 1F3B.tmp 1640 2006.tmp 2152 2110.tmp 1372 2229.tmp 4180 2352.tmp 468 243C.tmp 4632 2546.tmp 1084 2650.tmp 1504 2769.tmp 1028 2863.tmp 2236 296C.tmp 1232 2A47.tmp 4960 2B22.tmp 4384 2BFD.tmp 2192 2C99.tmp 1656 2D45.tmp 3496 2DF1.tmp 2788 2E9D.tmp 1916 2F48.tmp 4156 2FA6.tmp 2536 3042.tmp 4652 310E.tmp 3936 31AA.tmp 2208 3256.tmp 4924 3321.tmp 1816 33AD.tmp 2196 3459.tmp 4492 3515.tmp 3964 362E.tmp 4012 368C.tmp 3252 36F9.tmp 3100 3776.tmp 4996 37D4.tmp 3904 3841.tmp 4876 389F.tmp 4648 390C.tmp 3748 396A.tmp 4660 39C8.tmp 3780 3A26.tmp 4168 3AA3.tmp 4964 3AF1.tmp 888 3B4F.tmp 1744 3BBC.tmp 2312 3C68.tmp 2156 3CD5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 942D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B14A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 748F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4438.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C17.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 4540 872 2026-08-02_647f4286f17479c2b3f7f60b842c05ad_elex_mafia.exe 85 PID 4540 wrote to memory of 3380 4540 990.tmp 86 PID 3380 wrote to memory of 3356 3380 AD8.tmp 87 PID 3356 wrote to memory of 4664 3356 D2A.tmp 88 PID 4664 wrote to memory of 4732 4664 E72.tmp 89 PID 4732 wrote to memory of 1676 4732 F9B.tmp 90 PID 1676 wrote to memory of 2128 1676 10C4.tmp 91 PID 2128 wrote to memory of 3272 2128 11ED.tmp 92 PID 3272 wrote to memory of 4828 3272 12F6.tmp 93 PID 4828 wrote to memory of 644 4828 141F.tmp 94 PID 644 wrote to memory of 1608 644 1519.tmp 95 PID 1608 wrote to memory of 1124 1608 1604.tmp 96 PID 1124 wrote to memory of 2972 1124 16FE.tmp 97 PID 2972 wrote to memory of 1672 2972 1817.tmp 98 PID 1672 wrote to memory of 2464 1672 1930.tmp 99 PID 2464 wrote to memory of 4468 2464 1A3A.tmp 100 PID 4468 wrote to memory of 3520 4468 1B43.tmp 101 PID 3520 wrote to memory of 216 3520 1C4D.tmp 102 PID 216 wrote to memory of 2452 216 1D47.tmp 103 PID 2452 wrote to memory of 3360 2452 1E22.tmp 104 PID 3360 wrote to memory of 1640 3360 1F3B.tmp 105 PID 1640 wrote to memory of 2152 1640 2006.tmp 106 PID 2152 wrote to memory of 1372 2152 2110.tmp 107 PID 1372 wrote to memory of 4180 1372 2229.tmp 108 PID 4180 wrote to memory of 468 4180 2352.tmp 109 PID 468 wrote to memory of 4632 468 243C.tmp 110 PID 4632 wrote to memory of 1084 4632 2546.tmp 111 PID 1084 wrote to memory of 1504 1084 2650.tmp 112 PID 1504 wrote to memory of 1028 1504 2769.tmp 113 PID 1028 wrote to memory of 2236 1028 2863.tmp 114 PID 2236 wrote to memory of 1232 2236 296C.tmp 115 PID 1232 wrote to memory of 4960 1232 2A47.tmp 116 PID 4960 wrote to memory of 4384 4960 2B22.tmp 117 PID 4384 wrote to memory of 2192 4384 2BFD.tmp 118 PID 2192 wrote to memory of 1656 2192 2C99.tmp 119 PID 1656 wrote to memory of 3496 1656 2D45.tmp 120 PID 3496 wrote to memory of 2788 3496 2DF1.tmp 121 PID 2788 wrote to memory of 1916 2788 2E9D.tmp 122 PID 1916 wrote to memory of 4156 1916 2F48.tmp 123 PID 4156 wrote to memory of 2536 4156 2FA6.tmp 124 PID 2536 wrote to memory of 4652 2536 3042.tmp 125 PID 4652 wrote to memory of 3936 4652 310E.tmp 126 PID 3936 wrote to memory of 2208 3936 31AA.tmp 127 PID 2208 wrote to memory of 4924 2208 3256.tmp 128 PID 4924 wrote to memory of 1816 4924 3321.tmp 129 PID 1816 wrote to memory of 2196 1816 33AD.tmp 130 PID 2196 wrote to memory of 4492 2196 3459.tmp 131 PID 4492 wrote to memory of 3964 4492 3515.tmp 132 PID 3964 wrote to memory of 4012 3964 362E.tmp 133 PID 4012 wrote to memory of 3252 4012 368C.tmp 134 PID 3252 wrote to memory of 3100 3252 36F9.tmp 135 PID 3100 wrote to memory of 4996 3100 3776.tmp 136 PID 4996 wrote to memory of 3904 4996 37D4.tmp 137 PID 3904 wrote to memory of 4876 3904 3841.tmp 138 PID 4876 wrote to memory of 4648 4876 389F.tmp 139 PID 4648 wrote to memory of 3748 4648 390C.tmp 140 PID 3748 wrote to memory of 4660 3748 396A.tmp 141 PID 4660 wrote to memory of 3780 4660 39C8.tmp 142 PID 3780 wrote to memory of 4168 3780 3A26.tmp 143 PID 4168 wrote to memory of 4964 4168 3AA3.tmp 144 PID 4964 wrote to memory of 888 4964 3AF1.tmp 145 PID 888 wrote to memory of 1744 888 3B4F.tmp 146 PID 1744 wrote to memory of 2312 1744 3BBC.tmp 147 PID 2312 wrote to memory of 2156 2312 3C68.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_647f4286f17479c2b3f7f60b842c05ad_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_647f4286f17479c2b3f7f60b842c05ad_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\36F9.tmp"C:\Users\Admin\AppData\Local\Temp\36F9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"65⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"66⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"67⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"68⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"69⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"70⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"71⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"73⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"74⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"75⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"76⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"77⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"78⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\42B1.tmp"C:\Users\Admin\AppData\Local\Temp\42B1.tmp"79⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\430F.tmp"C:\Users\Admin\AppData\Local\Temp\430F.tmp"80⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"81⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"82⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"84⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"85⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"86⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"88⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"89⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"90⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\47B2.tmp"C:\Users\Admin\AppData\Local\Temp\47B2.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"92⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"93⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"94⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"95⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"96⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"97⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"98⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"99⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"100⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"103⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"104⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\4D60.tmp"C:\Users\Admin\AppData\Local\Temp\4D60.tmp"105⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"106⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"107⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"108⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\4F34.tmp"C:\Users\Admin\AppData\Local\Temp\4F34.tmp"109⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"110⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"111⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"112⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"113⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"114⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"115⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"116⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"117⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"119⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"120⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"121⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-