Analysis
- max time kernel
129s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe
- Size 520KB
- Sample260802-tpaddacm41
- SHA256 a83b7bf2fffbbd6a21275e10a88653db813c722bf7b732866833efb78cb0e6f4
- MD5 f10bfea3d11bd171ef1afb20624c501a
- SHA1 251e50307224b30ab32f5705796de881280a5013
- SHA512 ef664e3cbde75183e82033b4f569d588bd2b46211b0678cb650d97eef8ba7dae35996ebf9c9ee179ee8fa2a314547420c1e3efbfd2c11393cb9ae4744e12ce02
- SSDEEP 12288:gj8fuxR21t5i8fSm624OyywaahswjrV27SqoO0flNZ6:gj8fuK1GYSywapO5qSXNI
- TLSH T18BB4F112B548C033E9E215314B56DBA65BBA7C794B3296C73BC436AC6FB52C1D63830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4264 BFB1.tmp 4664 C138.tmp 1732 C1D4.tmp 4100 C2CE.tmp 4768 C37A.tmp 5540 C426.tmp 1208 C4C2.tmp 4628 C55E.tmp 3404 C639.tmp 1832 C704.tmp 3952 C791.tmp 4772 C81D.tmp 2784 C8F8.tmp 5660 C9A4.tmp 5752 CA7F.tmp 5912 CB0B.tmp 460 CBE6.tmp 1256 CC73.tmp 2624 CD0F.tmp 4476 CDDA.tmp 4560 CE96.tmp 3928 CF42.tmp 4116 CFFD.tmp 2084 D0B9.tmp 5420 D184.tmp 4972 D230.tmp 5160 D2BC.tmp 5968 D368.tmp 5184 D424.tmp 3788 D4B0.tmp 3212 D57B.tmp 2272 D637.tmp 944 D702.tmp 552 D77F.tmp 3916 D80C.tmp 4596 D879.tmp 3420 D8F6.tmp 5076 D973.tmp 4688 D9F0.tmp 4680 DA7D.tmp 4660 DAEA.tmp 2732 DB86.tmp 1132 DBE4.tmp 5092 DC71.tmp 5456 DD0D.tmp 6032 DD7A.tmp 2212 DDF7.tmp 1828 DE74.tmp 4712 DF01.tmp 712 DF7E.tmp 2204 DFEB.tmp 2424 E068.tmp 812 E0F5.tmp 1460 E181.tmp 4164 E22D.tmp 4348 E2BA.tmp 1244 E327.tmp 3644 E3C4.tmp 5992 E431.tmp 3828 E49E.tmp 2856 E52B.tmp 3328 E5C7.tmp 2440 E654.tmp 572 E6D1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 324C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 383D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B094.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1786.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 965A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4264 4316 2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe 89 PID 4264 wrote to memory of 4664 4264 BFB1.tmp 90 PID 4664 wrote to memory of 1732 4664 C138.tmp 91 PID 1732 wrote to memory of 4100 1732 C1D4.tmp 92 PID 4100 wrote to memory of 4768 4100 C2CE.tmp 93 PID 4768 wrote to memory of 5540 4768 C37A.tmp 94 PID 5540 wrote to memory of 1208 5540 C426.tmp 95 PID 1208 wrote to memory of 4628 1208 C4C2.tmp 96 PID 4628 wrote to memory of 3404 4628 C55E.tmp 97 PID 3404 wrote to memory of 1832 3404 C639.tmp 98 PID 1832 wrote to memory of 3952 1832 C704.tmp 99 PID 3952 wrote to memory of 4772 3952 C791.tmp 100 PID 4772 wrote to memory of 2784 4772 C81D.tmp 101 PID 2784 wrote to memory of 5660 2784 C8F8.tmp 102 PID 5660 wrote to memory of 5752 5660 C9A4.tmp 103 PID 5752 wrote to memory of 5912 5752 CA7F.tmp 104 PID 5912 wrote to memory of 460 5912 CB0B.tmp 105 PID 460 wrote to memory of 1256 460 CBE6.tmp 106 PID 1256 wrote to memory of 2624 1256 CC73.tmp 107 PID 2624 wrote to memory of 4476 2624 CD0F.tmp 108 PID 4476 wrote to memory of 4560 4476 CDDA.tmp 109 PID 4560 wrote to memory of 3928 4560 CE96.tmp 110 PID 3928 wrote to memory of 4116 3928 CF42.tmp 111 PID 4116 wrote to memory of 2084 4116 CFFD.tmp 112 PID 2084 wrote to memory of 5420 2084 D0B9.tmp 113 PID 5420 wrote to memory of 4972 5420 D184.tmp 114 PID 4972 wrote to memory of 5160 4972 D230.tmp 115 PID 5160 wrote to memory of 5968 5160 D2BC.tmp 116 PID 5968 wrote to memory of 5184 5968 D368.tmp 117 PID 5184 wrote to memory of 3788 5184 D424.tmp 118 PID 3788 wrote to memory of 3212 3788 D4B0.tmp 119 PID 3212 wrote to memory of 2272 3212 D57B.tmp 120 PID 2272 wrote to memory of 944 2272 D637.tmp 121 PID 944 wrote to memory of 552 944 D702.tmp 122 PID 552 wrote to memory of 3916 552 D77F.tmp 123 PID 3916 wrote to memory of 4596 3916 D80C.tmp 124 PID 4596 wrote to memory of 3420 4596 D879.tmp 125 PID 3420 wrote to memory of 5076 3420 D8F6.tmp 126 PID 5076 wrote to memory of 4688 5076 D973.tmp 127 PID 4688 wrote to memory of 4680 4688 D9F0.tmp 128 PID 4680 wrote to memory of 4660 4680 DA7D.tmp 129 PID 4660 wrote to memory of 2732 4660 DAEA.tmp 130 PID 2732 wrote to memory of 1132 2732 DB86.tmp 131 PID 1132 wrote to memory of 5092 1132 DBE4.tmp 132 PID 5092 wrote to memory of 5456 5092 DC71.tmp 133 PID 5456 wrote to memory of 6032 5456 DD0D.tmp 134 PID 6032 wrote to memory of 2212 6032 DD7A.tmp 135 PID 2212 wrote to memory of 1828 2212 DDF7.tmp 136 PID 1828 wrote to memory of 4712 1828 DE74.tmp 137 PID 4712 wrote to memory of 712 4712 DF01.tmp 138 PID 712 wrote to memory of 2204 712 DF7E.tmp 139 PID 2204 wrote to memory of 2424 2204 DFEB.tmp 140 PID 2424 wrote to memory of 812 2424 E068.tmp 141 PID 812 wrote to memory of 1460 812 E0F5.tmp 142 PID 1460 wrote to memory of 4164 1460 E181.tmp 143 PID 4164 wrote to memory of 4348 4164 E22D.tmp 144 PID 4348 wrote to memory of 1244 4348 E2BA.tmp 145 PID 1244 wrote to memory of 3644 1244 E327.tmp 146 PID 3644 wrote to memory of 5992 3644 E3C4.tmp 147 PID 5992 wrote to memory of 3828 5992 E431.tmp 148 PID 3828 wrote to memory of 2856 3828 E49E.tmp 149 PID 2856 wrote to memory of 3328 2856 E52B.tmp 150 PID 3328 wrote to memory of 2440 3328 E5C7.tmp 151 PID 2440 wrote to memory of 572 2440 E654.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f10bfea3d11bd171ef1afb20624c501a_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"C:\Users\Admin\AppData\Local\Temp\BFB1.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\C138.tmp"C:\Users\Admin\AppData\Local\Temp\C138.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\C37A.tmp"C:\Users\Admin\AppData\Local\Temp\C37A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\C426.tmp"C:\Users\Admin\AppData\Local\Temp\C426.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C791.tmp"C:\Users\Admin\AppData\Local\Temp\C791.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\CB0B.tmp"C:\Users\Admin\AppData\Local\Temp\CB0B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"C:\Users\Admin\AppData\Local\Temp\CFFD.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\D57B.tmp"C:\Users\Admin\AppData\Local\Temp\D57B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\D77F.tmp"C:\Users\Admin\AppData\Local\Temp\D77F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\D973.tmp"C:\Users\Admin\AppData\Local\Temp\D973.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"C:\Users\Admin\AppData\Local\Temp\DA7D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\DB86.tmp"C:\Users\Admin\AppData\Local\Temp\DB86.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\DE74.tmp"C:\Users\Admin\AppData\Local\Temp\DE74.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\E181.tmp"C:\Users\Admin\AppData\Local\Temp\E181.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"C:\Users\Admin\AppData\Local\Temp\E2BA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\E49E.tmp"C:\Users\Admin\AppData\Local\Temp\E49E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\E52B.tmp"C:\Users\Admin\AppData\Local\Temp\E52B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\E654.tmp"C:\Users\Admin\AppData\Local\Temp\E654.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\E6D1.tmp"C:\Users\Admin\AppData\Local\Temp\E6D1.tmp"65⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\E74E.tmp"C:\Users\Admin\AppData\Local\Temp\E74E.tmp"66⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\E7BB.tmp"C:\Users\Admin\AppData\Local\Temp\E7BB.tmp"67⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\E838.tmp"C:\Users\Admin\AppData\Local\Temp\E838.tmp"68⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"69⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\E923.tmp"C:\Users\Admin\AppData\Local\Temp\E923.tmp"70⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\E990.tmp"C:\Users\Admin\AppData\Local\Temp\E990.tmp"71⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"72⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"73⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"74⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\EB94.tmp"C:\Users\Admin\AppData\Local\Temp\EB94.tmp"75⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\EC30.tmp"C:\Users\Admin\AppData\Local\Temp\EC30.tmp"76⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"77⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\ED39.tmp"C:\Users\Admin\AppData\Local\Temp\ED39.tmp"78⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\EE33.tmp"C:\Users\Admin\AppData\Local\Temp\EE33.tmp"80⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"81⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"C:\Users\Admin\AppData\Local\Temp\EF3D.tmp"82⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\EFBA.tmp"C:\Users\Admin\AppData\Local\Temp\EFBA.tmp"83⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\F027.tmp"C:\Users\Admin\AppData\Local\Temp\F027.tmp"84⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"C:\Users\Admin\AppData\Local\Temp\F0A4.tmp"85⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"86⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"87⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\F22B.tmp"C:\Users\Admin\AppData\Local\Temp\F22B.tmp"88⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"C:\Users\Admin\AppData\Local\Temp\F2B8.tmp"89⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"90⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"C:\Users\Admin\AppData\Local\Temp\F3E1.tmp"91⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"92⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"93⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\F558.tmp"C:\Users\Admin\AppData\Local\Temp\F558.tmp"94⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\F632.tmp"C:\Users\Admin\AppData\Local\Temp\F632.tmp"96⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"97⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\F73C.tmp"C:\Users\Admin\AppData\Local\Temp\F73C.tmp"98⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"99⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\F836.tmp"C:\Users\Admin\AppData\Local\Temp\F836.tmp"100⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"101⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\F94F.tmp"C:\Users\Admin\AppData\Local\Temp\F94F.tmp"102⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\F9AD.tmp"C:\Users\Admin\AppData\Local\Temp\F9AD.tmp"103⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"104⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"105⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"106⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"C:\Users\Admin\AppData\Local\Temp\FBDF.tmp"107⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"C:\Users\Admin\AppData\Local\Temp\FC5C.tmp"108⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"109⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"110⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"111⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\FE50.tmp"C:\Users\Admin\AppData\Local\Temp\FE50.tmp"112⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"113⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"114⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"115⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"116⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\B2.tmp"C:\Users\Admin\AppData\Local\Temp\B2.tmp"117⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"118⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"119⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\20A.tmp"C:\Users\Admin\AppData\Local\Temp\20A.tmp"120⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"121⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\304.tmp"C:\Users\Admin\AppData\Local\Temp\304.tmp"122⤵PID:6060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-