Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-11_634748f9c4e4c28815babbc01f51cd5b_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-11_634748f9c4e4c28815babbc01f51cd5b_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-11_634748f9c4e4c28815babbc01f51cd5b_elex_mafia.exe
- Size 560KB
- Sample261012-yvb7daew9z
- SHA256 736b7ecfac01aba14ed52a184bbddd53643e592d1e255a44380bb89b3fc07285
- MD5 634748f9c4e4c28815babbc01f51cd5b
- SHA1 a4637daa65ccb874decc2616f311bb039b384947
- SHA512 d3da05b063a4cf826ff5aab0637e31778485ef2af95adc966340789434a0dd2a9554ee55d966b16521f0f3925750ef7f5104ca15f8ab3a6faca6646610dfbd59
- SSDEEP 12288:MlFXOQUDmrC8SOtS9Rezzkte2gqjq4P3GIZxV:MlUQbC8SOthHkttgCq4PWIR
- TLSH T1D6C4F1123544C073F69202314A66CFA62B3F7C754B2AA5C73B84366DAFB42D1DA7934B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4112 D50E.tmp 4728 D656.tmp 4352 D702.tmp 1872 D85A.tmp 3716 D954.tmp 5396 DA1F.tmp 4716 DB67.tmp 2324 DCAF.tmp 2752 DDD8.tmp 5964 DF10.tmp 4488 DFFB.tmp 2396 E0E5.tmp 4608 E25C.tmp 1192 E375.tmp 120 E49E.tmp 4300 E5C7.tmp 3812 E6B2.tmp 5432 E79C.tmp 5080 E886.tmp 4396 E980.tmp 5232 EA9A.tmp 5560 EB94.tmp 4672 ECCC.tmp 5200 EDE5.tmp 560 EEEF.tmp 2292 F018.tmp 4120 F141.tmp 2124 F26A.tmp 3600 F373.tmp 1712 F48C.tmp 3236 F558.tmp 1040 F671.tmp 860 F75B.tmp 2004 F7E8.tmp 6084 F884.tmp 1860 F96E.tmp 3708 FA3A.tmp 6036 FB14.tmp 2456 FBC0.tmp 3196 FCBA.tmp 1964 FD66.tmp 1472 FDE3.tmp 3636 FE60.tmp 2648 FF2B.tmp 5944 16.tmp 1412 F0.tmp 4812 17D.tmp 4600 248.tmp 5912 323.tmp 5704 3A0.tmp 4216 41D.tmp 4368 48A.tmp 1768 517.tmp 4456 5A3.tmp 5092 630.tmp 2132 6BD.tmp 2992 73A.tmp 4188 7B7.tmp 1536 863.tmp 5812 8E0.tmp 3188 95D.tmp 3420 9E9.tmp 2816 A85.tmp 2240 B02.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E30E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F141.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E10F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C317.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5840 wrote to memory of 4112 5840 2026-10-11_634748f9c4e4c28815babbc01f51cd5b_elex_mafia.exe 89 PID 4112 wrote to memory of 4728 4112 D50E.tmp 90 PID 4728 wrote to memory of 4352 4728 D656.tmp 91 PID 4352 wrote to memory of 1872 4352 D702.tmp 92 PID 1872 wrote to memory of 3716 1872 D85A.tmp 93 PID 3716 wrote to memory of 5396 3716 D954.tmp 94 PID 5396 wrote to memory of 4716 5396 DA1F.tmp 95 PID 4716 wrote to memory of 2324 4716 DB67.tmp 96 PID 2324 wrote to memory of 2752 2324 DCAF.tmp 97 PID 2752 wrote to memory of 5964 2752 DDD8.tmp 98 PID 5964 wrote to memory of 4488 5964 DF10.tmp 99 PID 4488 wrote to memory of 2396 4488 DFFB.tmp 100 PID 2396 wrote to memory of 4608 2396 E0E5.tmp 101 PID 4608 wrote to memory of 1192 4608 E25C.tmp 102 PID 1192 wrote to memory of 120 1192 E375.tmp 103 PID 120 wrote to memory of 4300 120 E49E.tmp 104 PID 4300 wrote to memory of 3812 4300 E5C7.tmp 105 PID 3812 wrote to memory of 5432 3812 E6B2.tmp 106 PID 5432 wrote to memory of 5080 5432 E79C.tmp 107 PID 5080 wrote to memory of 4396 5080 E886.tmp 108 PID 4396 wrote to memory of 5232 4396 E980.tmp 109 PID 5232 wrote to memory of 5560 5232 EA9A.tmp 110 PID 5560 wrote to memory of 4672 5560 EB94.tmp 111 PID 4672 wrote to memory of 5200 4672 ECCC.tmp 112 PID 5200 wrote to memory of 560 5200 EDE5.tmp 113 PID 560 wrote to memory of 2292 560 EEEF.tmp 114 PID 2292 wrote to memory of 4120 2292 F018.tmp 115 PID 4120 wrote to memory of 2124 4120 F141.tmp 116 PID 2124 wrote to memory of 3600 2124 F26A.tmp 117 PID 3600 wrote to memory of 1712 3600 F373.tmp 118 PID 1712 wrote to memory of 3236 1712 F48C.tmp 119 PID 3236 wrote to memory of 1040 3236 F558.tmp 120 PID 1040 wrote to memory of 860 1040 F671.tmp 121 PID 860 wrote to memory of 2004 860 F75B.tmp 122 PID 2004 wrote to memory of 6084 2004 F7E8.tmp 123 PID 6084 wrote to memory of 1860 6084 F884.tmp 124 PID 1860 wrote to memory of 3708 1860 F96E.tmp 125 PID 3708 wrote to memory of 6036 3708 FA3A.tmp 126 PID 6036 wrote to memory of 2456 6036 FB14.tmp 127 PID 2456 wrote to memory of 3196 2456 FBC0.tmp 128 PID 3196 wrote to memory of 1964 3196 FCBA.tmp 129 PID 1964 wrote to memory of 1472 1964 FD66.tmp 130 PID 1472 wrote to memory of 3636 1472 FDE3.tmp 131 PID 3636 wrote to memory of 2648 3636 FE60.tmp 132 PID 2648 wrote to memory of 5944 2648 FF2B.tmp 133 PID 5944 wrote to memory of 1412 5944 16.tmp 134 PID 1412 wrote to memory of 4812 1412 F0.tmp 135 PID 4812 wrote to memory of 4600 4812 17D.tmp 136 PID 4600 wrote to memory of 5912 4600 248.tmp 137 PID 5912 wrote to memory of 5704 5912 323.tmp 138 PID 5704 wrote to memory of 4216 5704 3A0.tmp 139 PID 4216 wrote to memory of 4368 4216 41D.tmp 140 PID 4368 wrote to memory of 1768 4368 48A.tmp 141 PID 1768 wrote to memory of 4456 1768 517.tmp 142 PID 4456 wrote to memory of 5092 4456 5A3.tmp 143 PID 5092 wrote to memory of 2132 5092 630.tmp 144 PID 2132 wrote to memory of 2992 2132 6BD.tmp 145 PID 2992 wrote to memory of 4188 2992 73A.tmp 146 PID 4188 wrote to memory of 1536 4188 7B7.tmp 147 PID 1536 wrote to memory of 5812 1536 863.tmp 148 PID 5812 wrote to memory of 3188 5812 8E0.tmp 149 PID 3188 wrote to memory of 3420 3188 95D.tmp 150 PID 3420 wrote to memory of 2816 3420 9E9.tmp 151 PID 2816 wrote to memory of 2240 2816 A85.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_634748f9c4e4c28815babbc01f51cd5b_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_634748f9c4e4c28815babbc01f51cd5b_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\D50E.tmp"C:\Users\Admin\AppData\Local\Temp\D50E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\D656.tmp"C:\Users\Admin\AppData\Local\Temp\D656.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\D85A.tmp"C:\Users\Admin\AppData\Local\Temp\D85A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\DDD8.tmp"C:\Users\Admin\AppData\Local\Temp\DDD8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\DF10.tmp"C:\Users\Admin\AppData\Local\Temp\DF10.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"C:\Users\Admin\AppData\Local\Temp\E0E5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\E375.tmp"C:\Users\Admin\AppData\Local\Temp\E375.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\E49E.tmp"C:\Users\Admin\AppData\Local\Temp\E49E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"C:\Users\Admin\AppData\Local\Temp\E5C7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\E79C.tmp"C:\Users\Admin\AppData\Local\Temp\E79C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\E886.tmp"C:\Users\Admin\AppData\Local\Temp\E886.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\E980.tmp"C:\Users\Admin\AppData\Local\Temp\E980.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"C:\Users\Admin\AppData\Local\Temp\EA9A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\EB94.tmp"C:\Users\Admin\AppData\Local\Temp\EB94.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"C:\Users\Admin\AppData\Local\Temp\EDE5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\F018.tmp"C:\Users\Admin\AppData\Local\Temp\F018.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\F141.tmp"C:\Users\Admin\AppData\Local\Temp\F141.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\F558.tmp"C:\Users\Admin\AppData\Local\Temp\F558.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\F75B.tmp"C:\Users\Admin\AppData\Local\Temp\F75B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"C:\Users\Admin\AppData\Local\Temp\F7E8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\F884.tmp"C:\Users\Admin\AppData\Local\Temp\F884.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\F96E.tmp"C:\Users\Admin\AppData\Local\Temp\F96E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"C:\Users\Admin\AppData\Local\Temp\FCBA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\FE60.tmp"C:\Users\Admin\AppData\Local\Temp\FE60.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"C:\Users\Admin\AppData\Local\Temp\FF2B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\16.tmp"C:\Users\Admin\AppData\Local\Temp\16.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\F0.tmp"C:\Users\Admin\AppData\Local\Temp\F0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\17D.tmp"C:\Users\Admin\AppData\Local\Temp\17D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\3A0.tmp"C:\Users\Admin\AppData\Local\Temp\3A0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\517.tmp"C:\Users\Admin\AppData\Local\Temp\517.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\5A3.tmp"C:\Users\Admin\AppData\Local\Temp\5A3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\6BD.tmp"C:\Users\Admin\AppData\Local\Temp\6BD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8E0.tmp"C:\Users\Admin\AppData\Local\Temp\8E0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9E9.tmp"C:\Users\Admin\AppData\Local\Temp\9E9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"65⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\B8F.tmp"C:\Users\Admin\AppData\Local\Temp\B8F.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"67⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\D35.tmp"C:\Users\Admin\AppData\Local\Temp\D35.tmp"69⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"70⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"71⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\EBC.tmp"C:\Users\Admin\AppData\Local\Temp\EBC.tmp"72⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\F48.tmp"C:\Users\Admin\AppData\Local\Temp\F48.tmp"73⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\FD5.tmp"C:\Users\Admin\AppData\Local\Temp\FD5.tmp"74⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\1061.tmp"C:\Users\Admin\AppData\Local\Temp\1061.tmp"75⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"76⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\119A.tmp"C:\Users\Admin\AppData\Local\Temp\119A.tmp"77⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\1207.tmp"C:\Users\Admin\AppData\Local\Temp\1207.tmp"78⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"79⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\12F2.tmp"C:\Users\Admin\AppData\Local\Temp\12F2.tmp"80⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\136F.tmp"C:\Users\Admin\AppData\Local\Temp\136F.tmp"81⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\13FB.tmp"C:\Users\Admin\AppData\Local\Temp\13FB.tmp"82⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"83⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\1505.tmp"C:\Users\Admin\AppData\Local\Temp\1505.tmp"84⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\1582.tmp"C:\Users\Admin\AppData\Local\Temp\1582.tmp"85⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"86⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"87⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"88⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"89⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"90⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"91⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"93⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"C:\Users\Admin\AppData\Local\Temp\1AC2.tmp"95⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"C:\Users\Admin\AppData\Local\Temp\1B5E.tmp"96⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"C:\Users\Admin\AppData\Local\Temp\1BEB.tmp"97⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\1C58.tmp"C:\Users\Admin\AppData\Local\Temp\1C58.tmp"98⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"99⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\1D81.tmp"C:\Users\Admin\AppData\Local\Temp\1D81.tmp"100⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"101⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"C:\Users\Admin\AppData\Local\Temp\1E7B.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"105⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"106⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\210B.tmp"C:\Users\Admin\AppData\Local\Temp\210B.tmp"107⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\21A7.tmp"C:\Users\Admin\AppData\Local\Temp\21A7.tmp"108⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"109⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\2282.tmp"C:\Users\Admin\AppData\Local\Temp\2282.tmp"110⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"111⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\236C.tmp"C:\Users\Admin\AppData\Local\Temp\236C.tmp"112⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"113⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"114⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\24E3.tmp"C:\Users\Admin\AppData\Local\Temp\24E3.tmp"115⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\2560.tmp"C:\Users\Admin\AppData\Local\Temp\2560.tmp"116⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"117⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\264B.tmp"C:\Users\Admin\AppData\Local\Temp\264B.tmp"118⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"119⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\2745.tmp"C:\Users\Admin\AppData\Local\Temp\2745.tmp"120⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\27B2.tmp"C:\Users\Admin\AppData\Local\Temp\27B2.tmp"121⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\283F.tmp"C:\Users\Admin\AppData\Local\Temp\283F.tmp"122⤵PID:4132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-