Analysis
- max time kernel
128s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_301033bc40861bfa6b537e1b5173834d_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_301033bc40861bfa6b537e1b5173834d_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-12_301033bc40861bfa6b537e1b5173834d_elex_mafia.exe
- Size 560KB
- Sample260812-r5t2lsxtds
- SHA256 52af1f4621deb59d81538a68c349ee14fc959a798ec89a1494aa665119483506
- MD5 301033bc40861bfa6b537e1b5173834d
- SHA1 c1234296450b27fcaa45daa946f19460881b6b8d
- SHA512 e8ef66f37b17a498716c5f7bd76d293e4a1e8f4f37cfb1e29c91fdb736abe58570388a0c519cbafc593b0fea8c6d2737b38a02f1b9af774080cc6418863f4d54
- SSDEEP 12288:MlFXOQUDmrC8SG8sozallWNI1Yq5E5FPbb+6IZxV:MlUQbC8SxsozE6SdqXnIR
- TLSH T1F2C4F1063588C0B3E6C205344A96DBA12B3B7C655B2AA5D33BD4362DAFB43D1D77834B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6124 9699.tmp 2568 97C2.tmp 4136 9929.tmp 4636 9AEE.tmp 3792 9C07.tmp 2212 9D21.tmp 1204 9E2A.tmp 1272 9F44.tmp 1116 A05D.tmp 4380 A166.tmp 2300 A280.tmp 976 A3B8.tmp 1288 A4E1.tmp 3140 A5EB.tmp 5928 A704.tmp 3248 A7EE.tmp 4376 A985.tmp 5556 AABD.tmp 5080 ABE6.tmp 4920 ACD0.tmp 5660 ADAB.tmp 3216 AEB5.tmp 3064 AFCE.tmp 3612 B0A9.tmp 3388 B1D2.tmp 3376 B2CC.tmp 1264 B3A6.tmp 2476 B4B0.tmp 6096 B5AA.tmp 4828 B6F2.tmp 5176 B859.tmp 5356 B944.tmp 4344 BA3E.tmp 4588 BADA.tmp 1956 BB96.tmp 4040 BC61.tmp 3740 BD2C.tmp 5812 BDE7.tmp 4728 BE93.tmp 5564 BF3F.tmp 1340 BFDB.tmp 5648 C087.tmp 5624 C123.tmp 1824 C1B0.tmp 3292 C27B.tmp 1416 C346.tmp 720 C3C3.tmp 5764 C440.tmp 3284 C4DD.tmp 6036 C54A.tmp 2844 C5C7.tmp 4812 C644.tmp 4956 C6C1.tmp 6012 C73E.tmp 3940 C79C.tmp 2468 C819.tmp 6056 C8B5.tmp 5036 C932.tmp 2916 C990.tmp 5092 CA0D.tmp 5232 CA99.tmp 6052 CB16.tmp 5152 CB84.tmp 2388 CC10.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7991.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8019.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 978E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D509.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1132 wrote to memory of 6124 1132 2026-08-12_301033bc40861bfa6b537e1b5173834d_elex_mafia.exe 89 PID 6124 wrote to memory of 2568 6124 9699.tmp 90 PID 2568 wrote to memory of 4136 2568 97C2.tmp 91 PID 4136 wrote to memory of 4636 4136 9929.tmp 92 PID 4636 wrote to memory of 3792 4636 9AEE.tmp 93 PID 3792 wrote to memory of 2212 3792 9C07.tmp 94 PID 2212 wrote to memory of 1204 2212 9D21.tmp 95 PID 1204 wrote to memory of 1272 1204 9E2A.tmp 96 PID 1272 wrote to memory of 1116 1272 9F44.tmp 97 PID 1116 wrote to memory of 4380 1116 A05D.tmp 98 PID 4380 wrote to memory of 2300 4380 A166.tmp 99 PID 2300 wrote to memory of 976 2300 A280.tmp 100 PID 976 wrote to memory of 1288 976 A3B8.tmp 101 PID 1288 wrote to memory of 3140 1288 A4E1.tmp 102 PID 3140 wrote to memory of 5928 3140 A5EB.tmp 103 PID 5928 wrote to memory of 3248 5928 A704.tmp 104 PID 3248 wrote to memory of 4376 3248 A7EE.tmp 105 PID 4376 wrote to memory of 5556 4376 A985.tmp 106 PID 5556 wrote to memory of 5080 5556 AABD.tmp 107 PID 5080 wrote to memory of 4920 5080 ABE6.tmp 108 PID 4920 wrote to memory of 5660 4920 ACD0.tmp 109 PID 5660 wrote to memory of 3216 5660 ADAB.tmp 110 PID 3216 wrote to memory of 3064 3216 AEB5.tmp 111 PID 3064 wrote to memory of 3612 3064 AFCE.tmp 112 PID 3612 wrote to memory of 3388 3612 B0A9.tmp 113 PID 3388 wrote to memory of 3376 3388 B1D2.tmp 114 PID 3376 wrote to memory of 1264 3376 B2CC.tmp 115 PID 1264 wrote to memory of 2476 1264 B3A6.tmp 116 PID 2476 wrote to memory of 6096 2476 B4B0.tmp 117 PID 6096 wrote to memory of 4828 6096 B5AA.tmp 118 PID 4828 wrote to memory of 5176 4828 B6F2.tmp 119 PID 5176 wrote to memory of 5356 5176 B859.tmp 120 PID 5356 wrote to memory of 4344 5356 B944.tmp 121 PID 4344 wrote to memory of 4588 4344 BA3E.tmp 122 PID 4588 wrote to memory of 1956 4588 BADA.tmp 123 PID 1956 wrote to memory of 4040 1956 BB96.tmp 124 PID 4040 wrote to memory of 3740 4040 BC61.tmp 125 PID 3740 wrote to memory of 5812 3740 BD2C.tmp 126 PID 5812 wrote to memory of 4728 5812 BDE7.tmp 127 PID 4728 wrote to memory of 5564 4728 BE93.tmp 128 PID 5564 wrote to memory of 1340 5564 BF3F.tmp 129 PID 1340 wrote to memory of 5648 1340 BFDB.tmp 130 PID 5648 wrote to memory of 5624 5648 C087.tmp 131 PID 5624 wrote to memory of 1824 5624 C123.tmp 132 PID 1824 wrote to memory of 3292 1824 C1B0.tmp 133 PID 3292 wrote to memory of 1416 3292 C27B.tmp 134 PID 1416 wrote to memory of 720 1416 C346.tmp 135 PID 720 wrote to memory of 5764 720 C3C3.tmp 136 PID 5764 wrote to memory of 3284 5764 C440.tmp 137 PID 3284 wrote to memory of 6036 3284 C4DD.tmp 138 PID 6036 wrote to memory of 2844 6036 C54A.tmp 139 PID 2844 wrote to memory of 4812 2844 C5C7.tmp 140 PID 4812 wrote to memory of 4956 4812 C644.tmp 141 PID 4956 wrote to memory of 6012 4956 C6C1.tmp 142 PID 6012 wrote to memory of 3940 6012 C73E.tmp 143 PID 3940 wrote to memory of 2468 3940 C79C.tmp 144 PID 2468 wrote to memory of 6056 2468 C819.tmp 145 PID 6056 wrote to memory of 5036 6056 C8B5.tmp 146 PID 5036 wrote to memory of 2916 5036 C932.tmp 147 PID 2916 wrote to memory of 5092 2916 C990.tmp 148 PID 5092 wrote to memory of 5232 5092 CA0D.tmp 149 PID 5232 wrote to memory of 6052 5232 CA99.tmp 150 PID 6052 wrote to memory of 5152 6052 CB16.tmp 151 PID 5152 wrote to memory of 2388 5152 CB84.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_301033bc40861bfa6b537e1b5173834d_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_301033bc40861bfa6b537e1b5173834d_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\9699.tmp"C:\Users\Admin\AppData\Local\Temp\9699.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"C:\Users\Admin\AppData\Local\Temp\9AEE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\9C07.tmp"C:\Users\Admin\AppData\Local\Temp\9C07.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\9D21.tmp"C:\Users\Admin\AppData\Local\Temp\9D21.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"C:\Users\Admin\AppData\Local\Temp\9E2A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\9F44.tmp"C:\Users\Admin\AppData\Local\Temp\9F44.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\A05D.tmp"C:\Users\Admin\AppData\Local\Temp\A05D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A280.tmp"C:\Users\Admin\AppData\Local\Temp\A280.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"C:\Users\Admin\AppData\Local\Temp\ACD0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"C:\Users\Admin\AppData\Local\Temp\AFCE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"C:\Users\Admin\AppData\Local\Temp\B2CC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"C:\Users\Admin\AppData\Local\Temp\B4B0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"C:\Users\Admin\AppData\Local\Temp\B5AA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"C:\Users\Admin\AppData\Local\Temp\B6F2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\B944.tmp"C:\Users\Admin\AppData\Local\Temp\B944.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"C:\Users\Admin\AppData\Local\Temp\BA3E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\BADA.tmp"C:\Users\Admin\AppData\Local\Temp\BADA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"C:\Users\Admin\AppData\Local\Temp\BD2C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\C087.tmp"C:\Users\Admin\AppData\Local\Temp\C087.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\C346.tmp"C:\Users\Admin\AppData\Local\Temp\C346.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\C440.tmp"C:\Users\Admin\AppData\Local\Temp\C440.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\C644.tmp"C:\Users\Admin\AppData\Local\Temp\C644.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"C:\Users\Admin\AppData\Local\Temp\C6C1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\C73E.tmp"C:\Users\Admin\AppData\Local\Temp\C73E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\C79C.tmp"C:\Users\Admin\AppData\Local\Temp\C79C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\C819.tmp"C:\Users\Admin\AppData\Local\Temp\C819.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\CA99.tmp"C:\Users\Admin\AppData\Local\Temp\CA99.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\CB16.tmp"C:\Users\Admin\AppData\Local\Temp\CB16.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\CB84.tmp"C:\Users\Admin\AppData\Local\Temp\CB84.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\CC10.tmp"C:\Users\Admin\AppData\Local\Temp\CC10.tmp"65⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"66⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"67⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\CD97.tmp"C:\Users\Admin\AppData\Local\Temp\CD97.tmp"68⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\CE04.tmp"C:\Users\Admin\AppData\Local\Temp\CE04.tmp"69⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"71⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"C:\Users\Admin\AppData\Local\Temp\CF7B.tmp"72⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"73⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"74⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\D102.tmp"C:\Users\Admin\AppData\Local\Temp\D102.tmp"75⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\D17F.tmp"C:\Users\Admin\AppData\Local\Temp\D17F.tmp"76⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\D21B.tmp"C:\Users\Admin\AppData\Local\Temp\D21B.tmp"77⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\D306.tmp"C:\Users\Admin\AppData\Local\Temp\D306.tmp"79⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\D373.tmp"C:\Users\Admin\AppData\Local\Temp\D373.tmp"80⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\D41F.tmp"C:\Users\Admin\AppData\Local\Temp\D41F.tmp"81⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D49C.tmp"C:\Users\Admin\AppData\Local\Temp\D49C.tmp"82⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\D509.tmp"C:\Users\Admin\AppData\Local\Temp\D509.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\D586.tmp"C:\Users\Admin\AppData\Local\Temp\D586.tmp"84⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"85⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\D651.tmp"C:\Users\Admin\AppData\Local\Temp\D651.tmp"86⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"87⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D73C.tmp"C:\Users\Admin\AppData\Local\Temp\D73C.tmp"88⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"89⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"90⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"91⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"92⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"93⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"94⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"95⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"96⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\DB62.tmp"C:\Users\Admin\AppData\Local\Temp\DB62.tmp"97⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"C:\Users\Admin\AppData\Local\Temp\DBC0.tmp"98⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"99⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"100⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"C:\Users\Admin\AppData\Local\Temp\DDF2.tmp"102⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"103⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"105⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"106⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\E044.tmp"C:\Users\Admin\AppData\Local\Temp\E044.tmp"107⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"108⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"109⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"C:\Users\Admin\AppData\Local\Temp\E1DA.tmp"110⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"111⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"112⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"113⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"C:\Users\Admin\AppData\Local\Temp\E3EE.tmp"114⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\E47A.tmp"C:\Users\Admin\AppData\Local\Temp\E47A.tmp"115⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"116⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\E584.tmp"C:\Users\Admin\AppData\Local\Temp\E584.tmp"117⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"118⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"119⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"121⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"122⤵PID:4024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-