Analysis
- max time kernel
122s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_ecdb34efc31084a50e2c3f5f3e6116bd_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_ecdb34efc31084a50e2c3f5f3e6116bd_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-31_ecdb34efc31084a50e2c3f5f3e6116bd_elex_mafia.exe
- Size 564KB
- Sample260731-tpye7sdb97
- SHA256 3b68c804180fcc8efe563c8a7933d74c508445001a5104c42cb5bbffd2a3f461
- MD5 ecdb34efc31084a50e2c3f5f3e6116bd
- SHA1 14ae4f0b843950a8588792d257b90e729e188067
- SHA512 763c44142ba7143a5a0d52825738a450a7707f9d80e87eabfd80998198eaec281b6c0f6c35f5a53f2dcf50e5b66770e50ffb74f81893de4f6d527d3c2aeb9a7d
- SSDEEP 12288:Kdhh2PNZW9m4iYmgakhR/pcWkSbom9g+ACTZulH:KdqPu9m4XzcWkmiCTglH
- TLSH T10CC4E12AB244C13AF1C201314A26E7A25A3E7C75977AA5C73F94252E2FB27D1D339347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4760 7F58.tmp 4788 80FE.tmp 936 8246.tmp 4056 8301.tmp 252 836F.tmp 416 843A.tmp 1080 8524.tmp 3552 85D0.tmp 364 868B.tmp 3212 8747.tmp 1844 87F3.tmp 6068 88DD.tmp 5224 8989.tmp 2104 8A45.tmp 4300 8AF0.tmp 4388 8BBC.tmp 5420 8C87.tmp 4332 8D61.tmp 1660 8E6B.tmp 1052 8F46.tmp 5812 9021.tmp 204 90BD.tmp 4408 912A.tmp 2200 91A7.tmp 3496 92B1.tmp 3228 937C.tmp 3188 9409.tmp 1408 94A5.tmp 3388 9580.tmp 4828 962B.tmp 5780 96F7.tmp 5124 97C2.tmp 4624 989C.tmp 1632 9929.tmp 4080 99B6.tmp 4208 9A52.tmp 4252 9ADF.tmp 824 9B6B.tmp 2964 9BD9.tmp 2064 9C65.tmp 3144 9CF2.tmp 5580 9D9E.tmp 2548 9E59.tmp 2008 9EF5.tmp 4812 9FA1.tmp 3404 A02E.tmp 4040 A0CA.tmp 1804 A166.tmp 2608 A1F3.tmp 3928 A2BE.tmp 5632 A36A.tmp 3564 A3D7.tmp 5668 A464.tmp 972 A4E1.tmp 4124 A58D.tmp 2968 A629.tmp 3752 A6B6.tmp 4584 A723.tmp 4384 A7B0.tmp 5112 A83C.tmp 1036 A8D9.tmp 5108 A956.tmp 4220 A9D3.tmp 2348 AA50.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 498D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F638.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F18A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 368D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 340D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 736C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 616 wrote to memory of 4760 616 2026-07-31_ecdb34efc31084a50e2c3f5f3e6116bd_elex_mafia.exe 89 PID 4760 wrote to memory of 4788 4760 7F58.tmp 90 PID 4788 wrote to memory of 936 4788 80FE.tmp 91 PID 936 wrote to memory of 4056 936 8246.tmp 92 PID 4056 wrote to memory of 252 4056 8301.tmp 93 PID 252 wrote to memory of 416 252 836F.tmp 94 PID 416 wrote to memory of 1080 416 843A.tmp 95 PID 1080 wrote to memory of 3552 1080 8524.tmp 96 PID 3552 wrote to memory of 364 3552 85D0.tmp 97 PID 364 wrote to memory of 3212 364 868B.tmp 98 PID 3212 wrote to memory of 1844 3212 8747.tmp 99 PID 1844 wrote to memory of 6068 1844 87F3.tmp 100 PID 6068 wrote to memory of 5224 6068 88DD.tmp 101 PID 5224 wrote to memory of 2104 5224 8989.tmp 102 PID 2104 wrote to memory of 4300 2104 8A45.tmp 103 PID 4300 wrote to memory of 4388 4300 8AF0.tmp 104 PID 4388 wrote to memory of 5420 4388 8BBC.tmp 105 PID 5420 wrote to memory of 4332 5420 8C87.tmp 106 PID 4332 wrote to memory of 1660 4332 8D61.tmp 107 PID 1660 wrote to memory of 1052 1660 8E6B.tmp 108 PID 1052 wrote to memory of 5812 1052 8F46.tmp 109 PID 5812 wrote to memory of 204 5812 9021.tmp 110 PID 204 wrote to memory of 4408 204 90BD.tmp 111 PID 4408 wrote to memory of 2200 4408 912A.tmp 112 PID 2200 wrote to memory of 3496 2200 91A7.tmp 113 PID 3496 wrote to memory of 3228 3496 92B1.tmp 114 PID 3228 wrote to memory of 3188 3228 937C.tmp 115 PID 3188 wrote to memory of 1408 3188 9409.tmp 116 PID 1408 wrote to memory of 3388 1408 94A5.tmp 117 PID 3388 wrote to memory of 4828 3388 9580.tmp 118 PID 4828 wrote to memory of 5780 4828 962B.tmp 119 PID 5780 wrote to memory of 5124 5780 96F7.tmp 120 PID 5124 wrote to memory of 4624 5124 97C2.tmp 121 PID 4624 wrote to memory of 1632 4624 989C.tmp 122 PID 1632 wrote to memory of 4080 1632 9929.tmp 123 PID 4080 wrote to memory of 4208 4080 99B6.tmp 124 PID 4208 wrote to memory of 4252 4208 9A52.tmp 125 PID 4252 wrote to memory of 824 4252 9ADF.tmp 126 PID 824 wrote to memory of 2964 824 9B6B.tmp 127 PID 2964 wrote to memory of 2064 2964 9BD9.tmp 128 PID 2064 wrote to memory of 3144 2064 9C65.tmp 129 PID 3144 wrote to memory of 5580 3144 9CF2.tmp 130 PID 5580 wrote to memory of 2548 5580 9D9E.tmp 131 PID 2548 wrote to memory of 2008 2548 9E59.tmp 132 PID 2008 wrote to memory of 4812 2008 9EF5.tmp 133 PID 4812 wrote to memory of 3404 4812 9FA1.tmp 134 PID 3404 wrote to memory of 4040 3404 A02E.tmp 135 PID 4040 wrote to memory of 1804 4040 A0CA.tmp 136 PID 1804 wrote to memory of 2608 1804 A166.tmp 137 PID 2608 wrote to memory of 3928 2608 A1F3.tmp 138 PID 3928 wrote to memory of 5632 3928 A2BE.tmp 139 PID 5632 wrote to memory of 3564 5632 A36A.tmp 140 PID 3564 wrote to memory of 5668 3564 A3D7.tmp 141 PID 5668 wrote to memory of 972 5668 A464.tmp 142 PID 972 wrote to memory of 4124 972 A4E1.tmp 143 PID 4124 wrote to memory of 2968 4124 A58D.tmp 144 PID 2968 wrote to memory of 3752 2968 A629.tmp 145 PID 3752 wrote to memory of 4584 3752 A6B6.tmp 146 PID 4584 wrote to memory of 4384 4584 A723.tmp 147 PID 4384 wrote to memory of 5112 4384 A7B0.tmp 148 PID 5112 wrote to memory of 1036 5112 A83C.tmp 149 PID 1036 wrote to memory of 5108 1036 A8D9.tmp 150 PID 5108 wrote to memory of 4220 5108 A956.tmp 151 PID 4220 wrote to memory of 2348 4220 A9D3.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_ecdb34efc31084a50e2c3f5f3e6116bd_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ecdb34efc31084a50e2c3f5f3e6116bd_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\7F58.tmp"C:\Users\Admin\AppData\Local\Temp\7F58.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\80FE.tmp"C:\Users\Admin\AppData\Local\Temp\80FE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\8246.tmp"C:\Users\Admin\AppData\Local\Temp\8246.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\88DD.tmp"C:\Users\Admin\AppData\Local\Temp\88DD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\9021.tmp"C:\Users\Admin\AppData\Local\Temp\9021.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\937C.tmp"C:\Users\Admin\AppData\Local\Temp\937C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\9409.tmp"C:\Users\Admin\AppData\Local\Temp\9409.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\96F7.tmp"C:\Users\Admin\AppData\Local\Temp\96F7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\97C2.tmp"C:\Users\Admin\AppData\Local\Temp\97C2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\9A52.tmp"C:\Users\Admin\AppData\Local\Temp\9A52.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\9C65.tmp"C:\Users\Admin\AppData\Local\Temp\9C65.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\A36A.tmp"C:\Users\Admin\AppData\Local\Temp\A36A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\A464.tmp"C:\Users\Admin\AppData\Local\Temp\A464.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\A629.tmp"C:\Users\Admin\AppData\Local\Temp\A629.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"C:\Users\Admin\AppData\Local\Temp\A6B6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\A723.tmp"C:\Users\Admin\AppData\Local\Temp\A723.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\A83C.tmp"C:\Users\Admin\AppData\Local\Temp\A83C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"C:\Users\Admin\AppData\Local\Temp\A8D9.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A956.tmp"C:\Users\Admin\AppData\Local\Temp\A956.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\AA50.tmp"C:\Users\Admin\AppData\Local\Temp\AA50.tmp"65⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"66⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"67⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"68⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"69⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"70⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"71⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"72⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\AF41.tmp"C:\Users\Admin\AppData\Local\Temp\AF41.tmp"73⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"74⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"75⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"76⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"77⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"78⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"79⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"80⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"81⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\B433.tmp"C:\Users\Admin\AppData\Local\Temp\B433.tmp"82⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"83⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"84⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"85⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\B694.tmp"C:\Users\Admin\AppData\Local\Temp\B694.tmp"86⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"87⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"88⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\B859.tmp"C:\Users\Admin\AppData\Local\Temp\B859.tmp"89⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"90⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"92⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"93⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\BACA.tmp"C:\Users\Admin\AppData\Local\Temp\BACA.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"95⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"C:\Users\Admin\AppData\Local\Temp\BBC4.tmp"96⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\BC61.tmp"C:\Users\Admin\AppData\Local\Temp\BC61.tmp"97⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"98⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"C:\Users\Admin\AppData\Local\Temp\BD5B.tmp"99⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"100⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\BE64.tmp"C:\Users\Admin\AppData\Local\Temp\BE64.tmp"101⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\BED2.tmp"C:\Users\Admin\AppData\Local\Temp\BED2.tmp"102⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"C:\Users\Admin\AppData\Local\Temp\BF5E.tmp"103⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"104⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\C078.tmp"C:\Users\Admin\AppData\Local\Temp\C078.tmp"105⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\C104.tmp"C:\Users\Admin\AppData\Local\Temp\C104.tmp"106⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C172.tmp"C:\Users\Admin\AppData\Local\Temp\C172.tmp"107⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"108⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"109⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"110⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"111⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"C:\Users\Admin\AppData\Local\Temp\C3B4.tmp"112⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C431.tmp"C:\Users\Admin\AppData\Local\Temp\C431.tmp"113⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\C4AE.tmp"C:\Users\Admin\AppData\Local\Temp\C4AE.tmp"114⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"115⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"116⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\C673.tmp"C:\Users\Admin\AppData\Local\Temp\C673.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C72E.tmp"C:\Users\Admin\AppData\Local\Temp\C72E.tmp"118⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\C79C.tmp"C:\Users\Admin\AppData\Local\Temp\C79C.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"120⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C876.tmp"C:\Users\Admin\AppData\Local\Temp\C876.tmp"121⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"122⤵PID:4456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-