Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/10/2026, 08:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-23_ac60281a25676b2bfa8c10598df416e7_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-23_ac60281a25676b2bfa8c10598df416e7_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-23_ac60281a25676b2bfa8c10598df416e7_elex_mafia.exe
- Size 520KB
- Sample261023-kk624sax21
- SHA256 9df11c6ac904d500062da92060e3856ba4fd45e0df594ceefa365f764f1ccaa9
- MD5 ac60281a25676b2bfa8c10598df416e7
- SHA1 713aa9075761292843f30f64f6e4667601f28117
- SHA512 2642834d8b065a1854abfeffef9b24d40a1f0f47a184f367173f86abde4bd0b8e04b0881ad971844c765143ec719017830d024dbf1e54026963d771c4854235e
- SSDEEP 12288:roRXOQjmOyDllkQ5Kg89akppt1R2x6hqAI5Z1YK5ZNC7qfNZ:rogQ9yDlyj9ppb1cx6hYn3dN
- TLSH T1BBB4F021B184C032E59226308B26DFA15B3F7D669B7A56C73B843A6C6FB42C1E774347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5924 ECDC.tmp 5092 ED88.tmp 5664 EE43.tmp 1456 EED0.tmp 1248 EF8B.tmp 5672 F018.tmp 6080 F0B4.tmp 5636 F160.tmp 5364 F1FC.tmp 2612 F289.tmp 1736 F325.tmp 3044 F3B2.tmp 2108 F42F.tmp 5940 F4CB.tmp 1804 F567.tmp 540 F5D5.tmp 4688 F671.tmp 1584 F71D.tmp 616 F7B9.tmp 5444 F865.tmp 2080 F8E2.tmp 4108 F95F.tmp 1236 F9BD.tmp 5880 FA3A.tmp 3212 FB05.tmp 4304 FBD0.tmp 2920 FC6C.tmp 984 FD28.tmp 1500 FDB4.tmp 1384 FE41.tmp 2056 FECD.tmp 2640 FF5A.tmp 3796 6.tmp 6104 54.tmp 2036 C1.tmp 936 110.tmp 5856 16D.tmp 3708 1BB.tmp 4428 20A.tmp 5084 258.tmp 3864 2B5.tmp 5560 2F4.tmp 5616 352.tmp 2228 3AF.tmp 4284 3FE.tmp 4192 44C.tmp 3300 49A.tmp 3144 4F8.tmp 3304 555.tmp 1004 5A3.tmp 3888 5F2.tmp 3840 64F.tmp 2104 69D.tmp 1012 6EC.tmp 3344 73A.tmp 2792 788.tmp 1032 7D6.tmp 6044 824.tmp 5308 882.tmp 2032 8D0.tmp 5852 92E.tmp 2504 98B.tmp 5264 9E9.tmp 4512 A37.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 110D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1709.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 5924 1944 2026-10-23_ac60281a25676b2bfa8c10598df416e7_elex_mafia.exe 84 PID 5924 wrote to memory of 5092 5924 ECDC.tmp 85 PID 5092 wrote to memory of 5664 5092 ED88.tmp 86 PID 5664 wrote to memory of 1456 5664 EE43.tmp 87 PID 1456 wrote to memory of 1248 1456 EED0.tmp 88 PID 1248 wrote to memory of 5672 1248 EF8B.tmp 89 PID 5672 wrote to memory of 6080 5672 F018.tmp 90 PID 6080 wrote to memory of 5636 6080 F0B4.tmp 91 PID 5636 wrote to memory of 5364 5636 F160.tmp 92 PID 5364 wrote to memory of 2612 5364 F1FC.tmp 93 PID 2612 wrote to memory of 1736 2612 F289.tmp 94 PID 1736 wrote to memory of 3044 1736 F325.tmp 95 PID 3044 wrote to memory of 2108 3044 F3B2.tmp 98 PID 2108 wrote to memory of 5940 2108 F42F.tmp 99 PID 5940 wrote to memory of 1804 5940 F4CB.tmp 100 PID 1804 wrote to memory of 540 1804 F567.tmp 101 PID 540 wrote to memory of 4688 540 F5D5.tmp 102 PID 4688 wrote to memory of 1584 4688 F671.tmp 103 PID 1584 wrote to memory of 616 1584 F71D.tmp 104 PID 616 wrote to memory of 5444 616 F7B9.tmp 107 PID 5444 wrote to memory of 2080 5444 F865.tmp 108 PID 2080 wrote to memory of 4108 2080 F8E2.tmp 109 PID 4108 wrote to memory of 1236 4108 F95F.tmp 110 PID 1236 wrote to memory of 5880 1236 F9BD.tmp 111 PID 5880 wrote to memory of 3212 5880 FA3A.tmp 112 PID 3212 wrote to memory of 4304 3212 FB05.tmp 113 PID 4304 wrote to memory of 2920 4304 FBD0.tmp 114 PID 2920 wrote to memory of 984 2920 FC6C.tmp 115 PID 984 wrote to memory of 1500 984 FD28.tmp 116 PID 1500 wrote to memory of 1384 1500 FDB4.tmp 117 PID 1384 wrote to memory of 2056 1384 FE41.tmp 118 PID 2056 wrote to memory of 2640 2056 FECD.tmp 119 PID 2640 wrote to memory of 3796 2640 FF5A.tmp 120 PID 3796 wrote to memory of 6104 3796 6.tmp 121 PID 6104 wrote to memory of 2036 6104 54.tmp 122 PID 2036 wrote to memory of 936 2036 C1.tmp 123 PID 936 wrote to memory of 5856 936 110.tmp 124 PID 5856 wrote to memory of 3708 5856 16D.tmp 125 PID 3708 wrote to memory of 4428 3708 1BB.tmp 126 PID 4428 wrote to memory of 5084 4428 20A.tmp 127 PID 5084 wrote to memory of 3864 5084 258.tmp 128 PID 3864 wrote to memory of 5560 3864 2B5.tmp 129 PID 5560 wrote to memory of 5616 5560 2F4.tmp 130 PID 5616 wrote to memory of 2228 5616 352.tmp 132 PID 2228 wrote to memory of 4284 2228 3AF.tmp 133 PID 4284 wrote to memory of 4192 4284 3FE.tmp 134 PID 4192 wrote to memory of 3300 4192 44C.tmp 135 PID 3300 wrote to memory of 3144 3300 49A.tmp 136 PID 3144 wrote to memory of 3304 3144 4F8.tmp 137 PID 3304 wrote to memory of 1004 3304 555.tmp 138 PID 1004 wrote to memory of 3888 1004 5A3.tmp 139 PID 3888 wrote to memory of 3840 3888 5F2.tmp 140 PID 3840 wrote to memory of 2104 3840 64F.tmp 141 PID 2104 wrote to memory of 1012 2104 69D.tmp 142 PID 1012 wrote to memory of 3344 1012 6EC.tmp 143 PID 3344 wrote to memory of 2792 3344 73A.tmp 144 PID 2792 wrote to memory of 1032 2792 788.tmp 145 PID 1032 wrote to memory of 6044 1032 7D6.tmp 146 PID 6044 wrote to memory of 5308 6044 824.tmp 147 PID 5308 wrote to memory of 2032 5308 882.tmp 148 PID 2032 wrote to memory of 5852 2032 8D0.tmp 149 PID 5852 wrote to memory of 2504 5852 92E.tmp 150 PID 2504 wrote to memory of 5264 2504 98B.tmp 151 PID 5264 wrote to memory of 4512 5264 9E9.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_ac60281a25676b2bfa8c10598df416e7_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_ac60281a25676b2bfa8c10598df416e7_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\EE43.tmp"C:\Users\Admin\AppData\Local\Temp\EE43.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\F018.tmp"C:\Users\Admin\AppData\Local\Temp\F018.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"C:\Users\Admin\AppData\Local\Temp\F0B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\F160.tmp"C:\Users\Admin\AppData\Local\Temp\F160.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"C:\Users\Admin\AppData\Local\Temp\F1FC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F42F.tmp"C:\Users\Admin\AppData\Local\Temp\F42F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\F671.tmp"C:\Users\Admin\AppData\Local\Temp\F671.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"C:\Users\Admin\AppData\Local\Temp\F8E2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"C:\Users\Admin\AppData\Local\Temp\FA3A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\FB05.tmp"C:\Users\Admin\AppData\Local\Temp\FB05.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\FE41.tmp"C:\Users\Admin\AppData\Local\Temp\FE41.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\54.tmp"C:\Users\Admin\AppData\Local\Temp\54.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\16D.tmp"C:\Users\Admin\AppData\Local\Temp\16D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\1BB.tmp"C:\Users\Admin\AppData\Local\Temp\1BB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\20A.tmp"C:\Users\Admin\AppData\Local\Temp\20A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\2B5.tmp"C:\Users\Admin\AppData\Local\Temp\2B5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\2F4.tmp"C:\Users\Admin\AppData\Local\Temp\2F4.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\3AF.tmp"C:\Users\Admin\AppData\Local\Temp\3AF.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3FE.tmp"C:\Users\Admin\AppData\Local\Temp\3FE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\44C.tmp"C:\Users\Admin\AppData\Local\Temp\44C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\49A.tmp"C:\Users\Admin\AppData\Local\Temp\49A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4F8.tmp"C:\Users\Admin\AppData\Local\Temp\4F8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\555.tmp"C:\Users\Admin\AppData\Local\Temp\555.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\5A3.tmp"C:\Users\Admin\AppData\Local\Temp\5A3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5F2.tmp"C:\Users\Admin\AppData\Local\Temp\5F2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\64F.tmp"C:\Users\Admin\AppData\Local\Temp\64F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\69D.tmp"C:\Users\Admin\AppData\Local\Temp\69D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\6EC.tmp"C:\Users\Admin\AppData\Local\Temp\6EC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\7D6.tmp"C:\Users\Admin\AppData\Local\Temp\7D6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\882.tmp"C:\Users\Admin\AppData\Local\Temp\882.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\8D0.tmp"C:\Users\Admin\AppData\Local\Temp\8D0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\98B.tmp"C:\Users\Admin\AppData\Local\Temp\98B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\9E9.tmp"C:\Users\Admin\AppData\Local\Temp\9E9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\A37.tmp"C:\Users\Admin\AppData\Local\Temp\A37.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"66⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\AE3.tmp"C:\Users\Admin\AppData\Local\Temp\AE3.tmp"67⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\B31.tmp"C:\Users\Admin\AppData\Local\Temp\B31.tmp"68⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\B9F.tmp"C:\Users\Admin\AppData\Local\Temp\B9F.tmp"69⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\BFC.tmp"C:\Users\Admin\AppData\Local\Temp\BFC.tmp"70⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"71⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"72⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\CF6.tmp"C:\Users\Admin\AppData\Local\Temp\CF6.tmp"73⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\D45.tmp"C:\Users\Admin\AppData\Local\Temp\D45.tmp"74⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"75⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\DE1.tmp"C:\Users\Admin\AppData\Local\Temp\DE1.tmp"76⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"77⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"78⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"79⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\F48.tmp"C:\Users\Admin\AppData\Local\Temp\F48.tmp"80⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"81⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"82⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"83⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"84⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:976 -
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"86⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\11B9.tmp"C:\Users\Admin\AppData\Local\Temp\11B9.tmp"87⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"88⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\1275.tmp"C:\Users\Admin\AppData\Local\Temp\1275.tmp"89⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\12D2.tmp"C:\Users\Admin\AppData\Local\Temp\12D2.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"91⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"92⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"93⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"94⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\1498.tmp"C:\Users\Admin\AppData\Local\Temp\1498.tmp"95⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"96⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\1534.tmp"C:\Users\Admin\AppData\Local\Temp\1534.tmp"97⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\1582.tmp"C:\Users\Admin\AppData\Local\Temp\1582.tmp"98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\15D0.tmp"C:\Users\Admin\AppData\Local\Temp\15D0.tmp"99⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\161E.tmp"C:\Users\Admin\AppData\Local\Temp\161E.tmp"100⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"101⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"102⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"104⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\17B4.tmp"C:\Users\Admin\AppData\Local\Temp\17B4.tmp"105⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"106⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"107⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"108⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"109⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"110⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"111⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"112⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"113⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"114⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"115⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"116⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"117⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"C:\Users\Admin\AppData\Local\Temp\1BDB.tmp"118⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\1C29.tmp"C:\Users\Admin\AppData\Local\Temp\1C29.tmp"119⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"120⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"C:\Users\Admin\AppData\Local\Temp\1CF4.tmp"121⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\1D52.tmp"C:\Users\Admin\AppData\Local\Temp\1D52.tmp"122⤵PID:3352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-