Analysis
- max time kernel
116s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_cc02e28f23d531a5b4274b0fc6432bb5_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_cc02e28f23d531a5b4274b0fc6432bb5_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_cc02e28f23d531a5b4274b0fc6432bb5_elex_mafia.exe
- Size 524KB
- Sample260730-ddq9rabp9x
- SHA256 e1f35ab1ea7081218ee1e374a00d0aaeb500074a82d6cdc9e142d6feecc49b73
- MD5 cc02e28f23d531a5b4274b0fc6432bb5
- SHA1 b93f7771698fcfc7e5047deeaf6eef8f3529a64a
- SHA512 50aecac505fcb63df17ce2c6423a2cbb774dff5950e7038d88208cc914a871388a8cc4d5c38454cab8dbea33b1c9fc29b8d9efa6c5c0f98b78410b4e1be4861e
- SSDEEP 12288:TRyZzqyL66T8krNx5akSySvEQxrUly0yrOp6NZ:TRyQylT8kDokSDvpqp6N
- TLSH T133B4F115B888C036F6A205724B56EB92597E7D716B6398CB3B98266E2FF03D1C374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4152 46B4.tmp 3344 47EC.tmp 3660 4915.tmp 3560 4A7C.tmp 6120 4BD4.tmp 6004 4CAF.tmp 2828 4DB9.tmp 1288 4EB3.tmp 2916 4FAD.tmp 1608 5097.tmp 4344 5191.tmp 5360 529B.tmp 124 53B4.tmp 5756 549E.tmp 1880 55E6.tmp 4092 570F.tmp 4448 57FA.tmp 960 58B5.tmp 3236 599F.tmp 5220 5AE8.tmp 4292 5BC2.tmp 3180 5CAD.tmp 3512 5DA7.tmp 2604 5EEF.tmp 3124 5FCA.tmp 3692 60F2.tmp 5012 621B.tmp 1496 6315.tmp 5692 63F0.tmp 1988 6509.tmp 2112 65E4.tmp 5648 671D.tmp 3944 6836.tmp 1764 68F1.tmp 4764 698E.tmp 5732 6A39.tmp 2276 6AE5.tmp 1836 6BC0.tmp 3792 6C9B.tmp 5636 6DC4.tmp 2844 6E9E.tmp 4356 6F3B.tmp 4516 7006.tmp 4664 70A2.tmp 2348 712F.tmp 3392 7229.tmp 5604 72F4.tmp 1736 73A0.tmp 3428 743C.tmp 1752 74D8.tmp 5724 7555.tmp 4208 75E2.tmp 3324 765F.tmp 3128 76EB.tmp 3680 7768.tmp 5988 77E5.tmp 5672 7872.tmp 4320 78FF.tmp 3256 797C.tmp 1148 79F9.tmp 4980 7A76.tmp 3044 7AF3.tmp 5696 7B7F.tmp 4332 7C0C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B94F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 328B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E12A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 621B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E5D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5716 wrote to memory of 4152 5716 2026-07-30_cc02e28f23d531a5b4274b0fc6432bb5_elex_mafia.exe 89 PID 4152 wrote to memory of 3344 4152 46B4.tmp 90 PID 3344 wrote to memory of 3660 3344 47EC.tmp 91 PID 3660 wrote to memory of 3560 3660 4915.tmp 92 PID 3560 wrote to memory of 6120 3560 4A7C.tmp 93 PID 6120 wrote to memory of 6004 6120 4BD4.tmp 94 PID 6004 wrote to memory of 2828 6004 4CAF.tmp 95 PID 2828 wrote to memory of 1288 2828 4DB9.tmp 96 PID 1288 wrote to memory of 2916 1288 4EB3.tmp 97 PID 2916 wrote to memory of 1608 2916 4FAD.tmp 98 PID 1608 wrote to memory of 4344 1608 5097.tmp 99 PID 4344 wrote to memory of 5360 4344 5191.tmp 100 PID 5360 wrote to memory of 124 5360 529B.tmp 101 PID 124 wrote to memory of 5756 124 53B4.tmp 102 PID 5756 wrote to memory of 1880 5756 549E.tmp 103 PID 1880 wrote to memory of 4092 1880 55E6.tmp 104 PID 4092 wrote to memory of 4448 4092 570F.tmp 105 PID 4448 wrote to memory of 960 4448 57FA.tmp 106 PID 960 wrote to memory of 3236 960 58B5.tmp 107 PID 3236 wrote to memory of 5220 3236 599F.tmp 108 PID 5220 wrote to memory of 4292 5220 5AE8.tmp 109 PID 4292 wrote to memory of 3180 4292 5BC2.tmp 110 PID 3180 wrote to memory of 3512 3180 5CAD.tmp 111 PID 3512 wrote to memory of 2604 3512 5DA7.tmp 112 PID 2604 wrote to memory of 3124 2604 5EEF.tmp 113 PID 3124 wrote to memory of 3692 3124 5FCA.tmp 114 PID 3692 wrote to memory of 5012 3692 60F2.tmp 115 PID 5012 wrote to memory of 1496 5012 621B.tmp 116 PID 1496 wrote to memory of 5692 1496 6315.tmp 117 PID 5692 wrote to memory of 1988 5692 63F0.tmp 118 PID 1988 wrote to memory of 2112 1988 6509.tmp 119 PID 2112 wrote to memory of 5648 2112 65E4.tmp 120 PID 5648 wrote to memory of 3944 5648 671D.tmp 121 PID 3944 wrote to memory of 1764 3944 6836.tmp 122 PID 1764 wrote to memory of 4764 1764 68F1.tmp 123 PID 4764 wrote to memory of 5732 4764 698E.tmp 124 PID 5732 wrote to memory of 2276 5732 6A39.tmp 125 PID 2276 wrote to memory of 1836 2276 6AE5.tmp 126 PID 1836 wrote to memory of 3792 1836 6BC0.tmp 127 PID 3792 wrote to memory of 5636 3792 6C9B.tmp 128 PID 5636 wrote to memory of 2844 5636 6DC4.tmp 129 PID 2844 wrote to memory of 4356 2844 6E9E.tmp 130 PID 4356 wrote to memory of 4516 4356 6F3B.tmp 131 PID 4516 wrote to memory of 4664 4516 7006.tmp 132 PID 4664 wrote to memory of 2348 4664 70A2.tmp 133 PID 2348 wrote to memory of 3392 2348 712F.tmp 134 PID 3392 wrote to memory of 5604 3392 7229.tmp 135 PID 5604 wrote to memory of 1736 5604 72F4.tmp 136 PID 1736 wrote to memory of 3428 1736 73A0.tmp 137 PID 3428 wrote to memory of 1752 3428 743C.tmp 138 PID 1752 wrote to memory of 5724 1752 74D8.tmp 139 PID 5724 wrote to memory of 4208 5724 7555.tmp 140 PID 4208 wrote to memory of 3324 4208 75E2.tmp 141 PID 3324 wrote to memory of 3128 3324 765F.tmp 142 PID 3128 wrote to memory of 3680 3128 76EB.tmp 143 PID 3680 wrote to memory of 5988 3680 7768.tmp 144 PID 5988 wrote to memory of 5672 5988 77E5.tmp 145 PID 5672 wrote to memory of 4320 5672 7872.tmp 146 PID 4320 wrote to memory of 3256 4320 78FF.tmp 147 PID 3256 wrote to memory of 1148 3256 797C.tmp 148 PID 1148 wrote to memory of 4980 1148 79F9.tmp 149 PID 4980 wrote to memory of 3044 4980 7A76.tmp 150 PID 3044 wrote to memory of 5696 3044 7AF3.tmp 151 PID 5696 wrote to memory of 4332 5696 7B7F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_cc02e28f23d531a5b4274b0fc6432bb5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_cc02e28f23d531a5b4274b0fc6432bb5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\53B4.tmp"C:\Users\Admin\AppData\Local\Temp\53B4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\549E.tmp"C:\Users\Admin\AppData\Local\Temp\549E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\55E6.tmp"C:\Users\Admin\AppData\Local\Temp\55E6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\58B5.tmp"C:\Users\Admin\AppData\Local\Temp\58B5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\599F.tmp"C:\Users\Admin\AppData\Local\Temp\599F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\60F2.tmp"C:\Users\Admin\AppData\Local\Temp\60F2.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\621B.tmp"C:\Users\Admin\AppData\Local\Temp\621B.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\6315.tmp"C:\Users\Admin\AppData\Local\Temp\6315.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\63F0.tmp"C:\Users\Admin\AppData\Local\Temp\63F0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\6509.tmp"C:\Users\Admin\AppData\Local\Temp\6509.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\68F1.tmp"C:\Users\Admin\AppData\Local\Temp\68F1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\70A2.tmp"C:\Users\Admin\AppData\Local\Temp\70A2.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\743C.tmp"C:\Users\Admin\AppData\Local\Temp\743C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\75E2.tmp"C:\Users\Admin\AppData\Local\Temp\75E2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\76EB.tmp"C:\Users\Admin\AppData\Local\Temp\76EB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\7768.tmp"C:\Users\Admin\AppData\Local\Temp\7768.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\78FF.tmp"C:\Users\Admin\AppData\Local\Temp\78FF.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"65⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"66⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"67⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7D73.tmp"C:\Users\Admin\AppData\Local\Temp\7D73.tmp"68⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"69⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"70⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"72⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\8013.tmp"C:\Users\Admin\AppData\Local\Temp\8013.tmp"73⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"74⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"75⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"76⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"77⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"78⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"79⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\83FB.tmp"C:\Users\Admin\AppData\Local\Temp\83FB.tmp"80⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"81⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"82⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\8572.tmp"C:\Users\Admin\AppData\Local\Temp\8572.tmp"83⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\85EF.tmp"C:\Users\Admin\AppData\Local\Temp\85EF.tmp"84⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"85⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"86⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"87⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"88⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"89⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"90⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\89A8.tmp"C:\Users\Admin\AppData\Local\Temp\89A8.tmp"91⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\8A25.tmp"C:\Users\Admin\AppData\Local\Temp\8A25.tmp"92⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"93⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"94⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"C:\Users\Admin\AppData\Local\Temp\8B9C.tmp"95⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"96⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"97⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"98⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"99⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"100⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"101⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\8F84.tmp"C:\Users\Admin\AppData\Local\Temp\8F84.tmp"102⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"103⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\907E.tmp"C:\Users\Admin\AppData\Local\Temp\907E.tmp"104⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"105⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9178.tmp"C:\Users\Admin\AppData\Local\Temp\9178.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\91F5.tmp"C:\Users\Admin\AppData\Local\Temp\91F5.tmp"107⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"108⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\92EF.tmp"C:\Users\Admin\AppData\Local\Temp\92EF.tmp"109⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"110⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"111⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\9486.tmp"C:\Users\Admin\AppData\Local\Temp\9486.tmp"112⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"113⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"114⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"116⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\9754.tmp"C:\Users\Admin\AppData\Local\Temp\9754.tmp"117⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\97F1.tmp"C:\Users\Admin\AppData\Local\Temp\97F1.tmp"118⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"119⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"120⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"121⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\9A23.tmp"C:\Users\Admin\AppData\Local\Temp\9A23.tmp"122⤵PID:5980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-