Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 17:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_54fa2d299327e414915eb2559eebe3a1_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_54fa2d299327e414915eb2559eebe3a1_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-26_54fa2d299327e414915eb2559eebe3a1_elex_mafia.exe
- Size 518KB
- Sample261027-vre73stt2m
- SHA256 c04e4f2f1f6428a058465e2f5c8f049bb1f694ecb71c339b0b9d2f68d3bf257d
- MD5 54fa2d299327e414915eb2559eebe3a1
- SHA1 c05a98ffd015b3bbcb8654d452f347a9ea730d1f
- SHA512 5a79ef1b580a598e7b47fe09ec039c263d50e9ec521af77646a65bba2cedd82297d07ccb955543c14de200a15553f0e9cfd84a32932f0360471d0c808f7b30c1
- SSDEEP 12288:Jf1yBOtIZdpH+IKedcC+w4MF/LWOqjB5+QqGu+NZ:JfcBzZdcIKi+w5DWOqwkN
- TLSH T18FB4F122B584C036E69316308E65DB924D3EBD768B2A90C77BC4366E6FB03D2D671347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 836 9F48.tmp 3780 A033.tmp 5644 A0FE.tmp 4144 A1C9.tmp 3748 A2B3.tmp 972 A350.tmp 3312 A41B.tmp 816 A4B7.tmp 3004 A582.tmp 5964 A65D.tmp 3488 A738.tmp 1848 A812.tmp 1396 A8BE.tmp 5656 A95A.tmp 4872 A9F7.tmp 4792 AA83.tmp 5008 AB20.tmp 5848 ABBC.tmp 6112 ACA6.tmp 2980 AD52.tmp 2268 ADFE.tmp 5700 AEB9.tmp 5732 AF56.tmp 4344 B002.tmp 2448 B0BD.tmp 4268 B159.tmp 5164 B1F6.tmp 3440 B2B1.tmp 5812 B36D.tmp 4104 B418.tmp 1828 B4A5.tmp 4240 B5BE.tmp 5960 B66A.tmp 1992 B6C8.tmp 4492 B735.tmp 5244 B7A3.tmp 2100 B820.tmp 5448 B88D.tmp 204 B8FA.tmp 2164 B977.tmp 5400 B9D5.tmp 2880 BA43.tmp 5308 BAA0.tmp 2852 BB0E.tmp 1648 BB8B.tmp 884 BC08.tmp 988 BC65.tmp 4068 BCD3.tmp 3804 BD40.tmp 4056 BDCD.tmp 1948 BE1B.tmp 5740 BE79.tmp 3856 BED6.tmp 2212 BF34.tmp 2580 BF92.tmp 4668 BFE0.tmp 3448 C04D.tmp 4616 C0CA.tmp 8 C128.tmp 2576 C1A5.tmp 720 C213.tmp 1908 C280.tmp 2116 C2DE.tmp 4932 C34B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 212A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A65D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5416 wrote to memory of 836 5416 2026-10-26_54fa2d299327e414915eb2559eebe3a1_elex_mafia.exe 85 PID 836 wrote to memory of 3780 836 9F48.tmp 86 PID 3780 wrote to memory of 5644 3780 A033.tmp 87 PID 5644 wrote to memory of 4144 5644 A0FE.tmp 88 PID 4144 wrote to memory of 3748 4144 A1C9.tmp 89 PID 3748 wrote to memory of 972 3748 A2B3.tmp 90 PID 972 wrote to memory of 3312 972 A350.tmp 91 PID 3312 wrote to memory of 816 3312 A41B.tmp 92 PID 816 wrote to memory of 3004 816 A4B7.tmp 93 PID 3004 wrote to memory of 5964 3004 A582.tmp 96 PID 5964 wrote to memory of 3488 5964 A65D.tmp 97 PID 3488 wrote to memory of 1848 3488 A738.tmp 98 PID 1848 wrote to memory of 1396 1848 A812.tmp 99 PID 1396 wrote to memory of 5656 1396 A8BE.tmp 100 PID 5656 wrote to memory of 4872 5656 A95A.tmp 101 PID 4872 wrote to memory of 4792 4872 A9F7.tmp 103 PID 4792 wrote to memory of 5008 4792 AA83.tmp 105 PID 5008 wrote to memory of 5848 5008 AB20.tmp 106 PID 5848 wrote to memory of 6112 5848 ABBC.tmp 107 PID 6112 wrote to memory of 2980 6112 ACA6.tmp 108 PID 2980 wrote to memory of 2268 2980 AD52.tmp 109 PID 2268 wrote to memory of 5700 2268 ADFE.tmp 110 PID 5700 wrote to memory of 5732 5700 AEB9.tmp 111 PID 5732 wrote to memory of 4344 5732 AF56.tmp 112 PID 4344 wrote to memory of 2448 4344 B002.tmp 113 PID 2448 wrote to memory of 4268 2448 B0BD.tmp 114 PID 4268 wrote to memory of 5164 4268 B159.tmp 115 PID 5164 wrote to memory of 3440 5164 B1F6.tmp 116 PID 3440 wrote to memory of 5812 3440 B2B1.tmp 117 PID 5812 wrote to memory of 4104 5812 B36D.tmp 118 PID 4104 wrote to memory of 1828 4104 B418.tmp 119 PID 1828 wrote to memory of 4240 1828 B4A5.tmp 120 PID 4240 wrote to memory of 5960 4240 B5BE.tmp 122 PID 5960 wrote to memory of 1992 5960 B66A.tmp 124 PID 1992 wrote to memory of 4492 1992 B6C8.tmp 125 PID 4492 wrote to memory of 5244 4492 B735.tmp 126 PID 5244 wrote to memory of 2100 5244 B7A3.tmp 127 PID 2100 wrote to memory of 5448 2100 B820.tmp 128 PID 5448 wrote to memory of 204 5448 B88D.tmp 129 PID 204 wrote to memory of 2164 204 B8FA.tmp 130 PID 2164 wrote to memory of 5400 2164 B977.tmp 131 PID 5400 wrote to memory of 2880 5400 B9D5.tmp 132 PID 2880 wrote to memory of 5308 2880 BA43.tmp 133 PID 5308 wrote to memory of 2852 5308 BAA0.tmp 134 PID 2852 wrote to memory of 1648 2852 BB0E.tmp 135 PID 1648 wrote to memory of 884 1648 BB8B.tmp 136 PID 884 wrote to memory of 988 884 BC08.tmp 137 PID 988 wrote to memory of 4068 988 BC65.tmp 138 PID 4068 wrote to memory of 3804 4068 BCD3.tmp 139 PID 3804 wrote to memory of 4056 3804 BD40.tmp 140 PID 4056 wrote to memory of 1948 4056 BDCD.tmp 141 PID 1948 wrote to memory of 5740 1948 BE1B.tmp 142 PID 5740 wrote to memory of 3856 5740 BE79.tmp 143 PID 3856 wrote to memory of 2212 3856 BED6.tmp 144 PID 2212 wrote to memory of 2580 2212 BF34.tmp 145 PID 2580 wrote to memory of 4668 2580 BF92.tmp 146 PID 4668 wrote to memory of 3448 4668 BFE0.tmp 147 PID 3448 wrote to memory of 4616 3448 C04D.tmp 148 PID 4616 wrote to memory of 8 4616 C0CA.tmp 149 PID 8 wrote to memory of 2576 8 C128.tmp 150 PID 2576 wrote to memory of 720 2576 C1A5.tmp 152 PID 720 wrote to memory of 1908 720 C213.tmp 154 PID 1908 wrote to memory of 2116 1908 C280.tmp 155 PID 2116 wrote to memory of 4932 2116 C2DE.tmp 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_54fa2d299327e414915eb2559eebe3a1_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_54fa2d299327e414915eb2559eebe3a1_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\A033.tmp"C:\Users\Admin\AppData\Local\Temp\A033.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"C:\Users\Admin\AppData\Local\Temp\A0FE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\A350.tmp"C:\Users\Admin\AppData\Local\Temp\A350.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A41B.tmp"C:\Users\Admin\AppData\Local\Temp\A41B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\A582.tmp"C:\Users\Admin\AppData\Local\Temp\A582.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\A9F7.tmp"C:\Users\Admin\AppData\Local\Temp\A9F7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\AB20.tmp"C:\Users\Admin\AppData\Local\Temp\AB20.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"C:\Users\Admin\AppData\Local\Temp\ABBC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\AF56.tmp"C:\Users\Admin\AppData\Local\Temp\AF56.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\B002.tmp"C:\Users\Admin\AppData\Local\Temp\B002.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\B159.tmp"C:\Users\Admin\AppData\Local\Temp\B159.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"C:\Users\Admin\AppData\Local\Temp\B2B1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\B5BE.tmp"C:\Users\Admin\AppData\Local\Temp\B5BE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\B66A.tmp"C:\Users\Admin\AppData\Local\Temp\B66A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\B735.tmp"C:\Users\Admin\AppData\Local\Temp\B735.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\B820.tmp"C:\Users\Admin\AppData\Local\Temp\B820.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\B88D.tmp"C:\Users\Admin\AppData\Local\Temp\B88D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"C:\Users\Admin\AppData\Local\Temp\BB0E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\BD40.tmp"C:\Users\Admin\AppData\Local\Temp\BD40.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\BED6.tmp"C:\Users\Admin\AppData\Local\Temp\BED6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\C1A5.tmp"C:\Users\Admin\AppData\Local\Temp\C1A5.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"65⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"66⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\C426.tmp"C:\Users\Admin\AppData\Local\Temp\C426.tmp"67⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"68⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"69⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"70⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\C57E.tmp"C:\Users\Admin\AppData\Local\Temp\C57E.tmp"71⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"72⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\C629.tmp"C:\Users\Admin\AppData\Local\Temp\C629.tmp"73⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\C678.tmp"C:\Users\Admin\AppData\Local\Temp\C678.tmp"74⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6C6.tmp"75⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"76⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"77⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"C:\Users\Admin\AppData\Local\Temp\C7C0.tmp"78⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"79⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"80⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"81⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"82⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"83⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"84⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"85⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\CA60.tmp"C:\Users\Admin\AppData\Local\Temp\CA60.tmp"86⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"C:\Users\Admin\AppData\Local\Temp\CB1B.tmp"88⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"89⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"90⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"91⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"92⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"93⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"94⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"95⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"96⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"97⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"98⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"99⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"100⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\CF90.tmp"C:\Users\Admin\AppData\Local\Temp\CF90.tmp"101⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"102⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"103⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"104⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"105⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"106⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"107⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"109⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\D29D.tmp"C:\Users\Admin\AppData\Local\Temp\D29D.tmp"110⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"111⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"112⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"113⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"114⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"115⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"116⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"C:\Users\Admin\AppData\Local\Temp\D4FE.tmp"117⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"118⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\D5AA.tmp"C:\Users\Admin\AppData\Local\Temp\D5AA.tmp"119⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\D608.tmp"C:\Users\Admin\AppData\Local\Temp\D608.tmp"120⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"121⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"122⤵PID:1028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-