Analysis
- max time kernel
129s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 10:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_88ce0dc7f7de7228d504bb83da24e3fa_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_88ce0dc7f7de7228d504bb83da24e3fa_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-03_88ce0dc7f7de7228d504bb83da24e3fa_elex_mafia.exe
- Size 561KB
- Sample260804-m28clsybpd
- SHA256 824cc76413237ea57550b318ca343d4d2b8e198e843e6e4558b2116698dfb6cb
- MD5 88ce0dc7f7de7228d504bb83da24e3fa
- SHA1 9e0d9ce48fba76d03747f9ede7b9d75168cdf433
- SHA512 67d9e65ee193895315d0e538254a37b4eb384d6f3118a63fb91aa4cdce0cc7e6472a88366a030fe73b90d66ad93894adb3e2dae245750bd7491bfb031146da24
- SSDEEP 12288:VuelPWET0yhA2YHQdN+H0yi3yhgtg3zZTSDZuL:8eEEvhA1QdwjfRSDoL
- TLSH T12CC4CF11B2D8C435F1F31A385AF097A2197B7C619B74D8CF2788226E2EB12D1E679713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1856 BD8E.tmp 4144 BE2B.tmp 4836 BF34.tmp 2404 C09C.tmp 3368 C147.tmp 1784 C280.tmp 4576 C32C.tmp 3332 C407.tmp 4504 C520.tmp 1380 C5EB.tmp 4912 C6A6.tmp 2044 C7B0.tmp 3196 C88B.tmp 5812 C966.tmp 3224 CA31.tmp 4308 CB0B.tmp 5080 CC05.tmp 268 CCE0.tmp 4380 CDDA.tmp 2280 CEC5.tmp 5448 CFAF.tmp 3824 D08A.tmp 4220 D174.tmp 4748 D230.tmp 1328 D2DB.tmp 1252 D397.tmp 6028 D472.tmp 5808 D55C.tmp 5820 D608.tmp 5184 D6E3.tmp 4828 D7DD.tmp 3508 D8C7.tmp 6004 D9B1.tmp 1508 DA4E.tmp 5924 DAFA.tmp 3720 DB96.tmp 2080 DC32.tmp 6092 DCCE.tmp 1420 DD7A.tmp 4156 DE07.tmp 3516 DE93.tmp 948 DF30.tmp 1772 DFBC.tmp 1716 E059.tmp 672 E124.tmp 5116 E1C0.tmp 4672 E25C.tmp 5876 E2D9.tmp 2128 E356.tmp 4200 E431.tmp 4084 E4EC.tmp 1728 E579.tmp 4132 E615.tmp 2136 E692.tmp 3140 E73E.tmp 1144 E7AC.tmp 4540 E848.tmp 4604 E8D4.tmp 5852 E961.tmp 3524 E9FD.tmp 3520 EAA9.tmp 3356 EB45.tmp 4896 EBD2.tmp 1440 EC6E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 618A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 895A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A29F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7020.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 425E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5EB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 1856 3632 2026-08-03_88ce0dc7f7de7228d504bb83da24e3fa_elex_mafia.exe 89 PID 1856 wrote to memory of 4144 1856 BD8E.tmp 90 PID 4144 wrote to memory of 4836 4144 BE2B.tmp 91 PID 4836 wrote to memory of 2404 4836 BF34.tmp 92 PID 2404 wrote to memory of 3368 2404 C09C.tmp 93 PID 3368 wrote to memory of 1784 3368 C147.tmp 94 PID 1784 wrote to memory of 4576 1784 C280.tmp 95 PID 4576 wrote to memory of 3332 4576 C32C.tmp 96 PID 3332 wrote to memory of 4504 3332 C407.tmp 97 PID 4504 wrote to memory of 1380 4504 C520.tmp 98 PID 1380 wrote to memory of 4912 1380 C5EB.tmp 99 PID 4912 wrote to memory of 2044 4912 C6A6.tmp 100 PID 2044 wrote to memory of 3196 2044 C7B0.tmp 101 PID 3196 wrote to memory of 5812 3196 C88B.tmp 102 PID 5812 wrote to memory of 3224 5812 C966.tmp 103 PID 3224 wrote to memory of 4308 3224 CA31.tmp 104 PID 4308 wrote to memory of 5080 4308 CB0B.tmp 105 PID 5080 wrote to memory of 268 5080 CC05.tmp 106 PID 268 wrote to memory of 4380 268 CCE0.tmp 107 PID 4380 wrote to memory of 2280 4380 CDDA.tmp 108 PID 2280 wrote to memory of 5448 2280 CEC5.tmp 109 PID 5448 wrote to memory of 3824 5448 CFAF.tmp 110 PID 3824 wrote to memory of 4220 3824 D08A.tmp 111 PID 4220 wrote to memory of 4748 4220 D174.tmp 112 PID 4748 wrote to memory of 1328 4748 D230.tmp 113 PID 1328 wrote to memory of 1252 1328 D2DB.tmp 114 PID 1252 wrote to memory of 6028 1252 D397.tmp 115 PID 6028 wrote to memory of 5808 6028 D472.tmp 116 PID 5808 wrote to memory of 5820 5808 D55C.tmp 117 PID 5820 wrote to memory of 5184 5820 D608.tmp 118 PID 5184 wrote to memory of 4828 5184 D6E3.tmp 119 PID 4828 wrote to memory of 3508 4828 D7DD.tmp 120 PID 3508 wrote to memory of 6004 3508 D8C7.tmp 121 PID 6004 wrote to memory of 1508 6004 D9B1.tmp 122 PID 1508 wrote to memory of 5924 1508 DA4E.tmp 123 PID 5924 wrote to memory of 3720 5924 DAFA.tmp 124 PID 3720 wrote to memory of 2080 3720 DB96.tmp 125 PID 2080 wrote to memory of 6092 2080 DC32.tmp 126 PID 6092 wrote to memory of 1420 6092 DCCE.tmp 127 PID 1420 wrote to memory of 4156 1420 DD7A.tmp 128 PID 4156 wrote to memory of 3516 4156 DE07.tmp 129 PID 3516 wrote to memory of 948 3516 DE93.tmp 130 PID 948 wrote to memory of 1772 948 DF30.tmp 131 PID 1772 wrote to memory of 1716 1772 DFBC.tmp 132 PID 1716 wrote to memory of 672 1716 E059.tmp 133 PID 672 wrote to memory of 5116 672 E124.tmp 134 PID 5116 wrote to memory of 4672 5116 E1C0.tmp 135 PID 4672 wrote to memory of 5876 4672 E25C.tmp 136 PID 5876 wrote to memory of 2128 5876 E2D9.tmp 137 PID 2128 wrote to memory of 4200 2128 E356.tmp 138 PID 4200 wrote to memory of 4084 4200 E431.tmp 139 PID 4084 wrote to memory of 1728 4084 E4EC.tmp 140 PID 1728 wrote to memory of 4132 1728 E579.tmp 141 PID 4132 wrote to memory of 2136 4132 E615.tmp 142 PID 2136 wrote to memory of 3140 2136 E692.tmp 143 PID 3140 wrote to memory of 1144 3140 E73E.tmp 144 PID 1144 wrote to memory of 4540 1144 E7AC.tmp 145 PID 4540 wrote to memory of 4604 4540 E848.tmp 146 PID 4604 wrote to memory of 5852 4604 E8D4.tmp 147 PID 5852 wrote to memory of 3524 5852 E961.tmp 148 PID 3524 wrote to memory of 3520 3524 E9FD.tmp 149 PID 3520 wrote to memory of 3356 3520 EAA9.tmp 150 PID 3356 wrote to memory of 4896 3356 EB45.tmp 151 PID 4896 wrote to memory of 1440 4896 EBD2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_88ce0dc7f7de7228d504bb83da24e3fa_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_88ce0dc7f7de7228d504bb83da24e3fa_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\C09C.tmp"C:\Users\Admin\AppData\Local\Temp\C09C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\C147.tmp"C:\Users\Admin\AppData\Local\Temp\C147.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\C32C.tmp"C:\Users\Admin\AppData\Local\Temp\C32C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\C407.tmp"C:\Users\Admin\AppData\Local\Temp\C407.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\C88B.tmp"C:\Users\Admin\AppData\Local\Temp\C88B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\CB0B.tmp"C:\Users\Admin\AppData\Local\Temp\CB0B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"C:\Users\Admin\AppData\Local\Temp\CEC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\D174.tmp"C:\Users\Admin\AppData\Local\Temp\D174.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\D608.tmp"C:\Users\Admin\AppData\Local\Temp\D608.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\DA4E.tmp"C:\Users\Admin\AppData\Local\Temp\DA4E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\DC32.tmp"C:\Users\Admin\AppData\Local\Temp\DC32.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\E124.tmp"C:\Users\Admin\AppData\Local\Temp\E124.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\E579.tmp"C:\Users\Admin\AppData\Local\Temp\E579.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\E615.tmp"C:\Users\Admin\AppData\Local\Temp\E615.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\EB45.tmp"C:\Users\Admin\AppData\Local\Temp\EB45.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"65⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"C:\Users\Admin\AppData\Local\Temp\EDA7.tmp"67⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\EE33.tmp"C:\Users\Admin\AppData\Local\Temp\EE33.tmp"68⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"69⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"C:\Users\Admin\AppData\Local\Temp\EF6C.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\EFF9.tmp"C:\Users\Admin\AppData\Local\Temp\EFF9.tmp"71⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\F085.tmp"C:\Users\Admin\AppData\Local\Temp\F085.tmp"72⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\F112.tmp"C:\Users\Admin\AppData\Local\Temp\F112.tmp"73⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"74⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\F24A.tmp"C:\Users\Admin\AppData\Local\Temp\F24A.tmp"75⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"77⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"78⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"79⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"80⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"81⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"82⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"83⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\F77A.tmp"C:\Users\Admin\AppData\Local\Temp\F77A.tmp"84⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\F817.tmp"C:\Users\Admin\AppData\Local\Temp\F817.tmp"85⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"86⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\F940.tmp"C:\Users\Admin\AppData\Local\Temp\F940.tmp"87⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"88⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\FA59.tmp"C:\Users\Admin\AppData\Local\Temp\FA59.tmp"89⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"90⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"92⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"93⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\FD47.tmp"C:\Users\Admin\AppData\Local\Temp\FD47.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"C:\Users\Admin\AppData\Local\Temp\FDE3.tmp"95⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\FE70.tmp"C:\Users\Admin\AppData\Local\Temp\FE70.tmp"96⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\35.tmp"C:\Users\Admin\AppData\Local\Temp\35.tmp"99⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\D1.tmp"C:\Users\Admin\AppData\Local\Temp\D1.tmp"100⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\15E.tmp"C:\Users\Admin\AppData\Local\Temp\15E.tmp"101⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\1EA.tmp"C:\Users\Admin\AppData\Local\Temp\1EA.tmp"102⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\277.tmp"C:\Users\Admin\AppData\Local\Temp\277.tmp"103⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\2F4.tmp"C:\Users\Admin\AppData\Local\Temp\2F4.tmp"104⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\381.tmp"C:\Users\Admin\AppData\Local\Temp\381.tmp"105⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"106⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"107⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"108⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\611.tmp"C:\Users\Admin\AppData\Local\Temp\611.tmp"109⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"110⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\749.tmp"C:\Users\Admin\AppData\Local\Temp\749.tmp"111⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\7E6.tmp"C:\Users\Admin\AppData\Local\Temp\7E6.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\Users\Admin\AppData\Local\Temp\872.tmp"C:\Users\Admin\AppData\Local\Temp\872.tmp"113⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\8FF.tmp"C:\Users\Admin\AppData\Local\Temp\8FF.tmp"114⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\99B.tmp"C:\Users\Admin\AppData\Local\Temp\99B.tmp"115⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\A37.tmp"C:\Users\Admin\AppData\Local\Temp\A37.tmp"116⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\AB4.tmp"C:\Users\Admin\AppData\Local\Temp\AB4.tmp"117⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\B31.tmp"C:\Users\Admin\AppData\Local\Temp\B31.tmp"118⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"119⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\C5A.tmp"C:\Users\Admin\AppData\Local\Temp\C5A.tmp"120⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"121⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\D64.tmp"C:\Users\Admin\AppData\Local\Temp\D64.tmp"122⤵PID:1792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-