Analysis
- max time kernel
124s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_16a6db0c736faaca50b480acb70ca8cc_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_16a6db0c736faaca50b480acb70ca8cc_elex_mafia.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-11_16a6db0c736faaca50b480acb70ca8cc_elex_mafia.exe
- Size 520KB
- Sample260811-ecy4msvfrf
- SHA256 d2832508cc1568002913c818a5a0919b57554ad22e577fc71be0e148144c1604
- MD5 16a6db0c736faaca50b480acb70ca8cc
- SHA1 6d14ff576852e255c387a92431dd348ad31dd9cf
- SHA512 e3f9e9160d063ec5c148df782f53873f99cee0b8e55d9677e25e1bfbaff6e449fcb526f9071f5950150cabebb1a890dcc1c8793434d0ead7038ef405db3b2b2d
- SSDEEP 12288:roRXOQjmOy437QQJ4pwmXEa9hhY06AXpSNZ:rogQ9ym7r4oa9v6AXpSN
- TLSH T113B4F1267584C032E9D266354B66CFA10B3F7D33572692CB3784362DAFB02D1EA75346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 268 6B14.tmp 5980 6BEF.tmp 4228 6C7C.tmp 4324 6D66.tmp 4460 6E12.tmp 3804 6EED.tmp 4600 6FE7.tmp 1848 710F.tmp 2424 71CB.tmp 1232 7238.tmp 2892 7313.tmp 2496 73DE.tmp 1768 746B.tmp 2804 7517.tmp 4468 75F1.tmp 1800 76FB.tmp 4360 7797.tmp 2668 7824.tmp 2088 794D.tmp 5552 7A37.tmp 2124 7B02.tmp 2832 7BBE.tmp 6032 7CA8.tmp 5036 7D93.tmp 1932 7E7D.tmp 5988 7F38.tmp 4644 8013.tmp 3428 80BF.tmp 5816 814C.tmp 4528 8236.tmp 2736 82E2.tmp 2952 83CC.tmp 5792 84A7.tmp 996 8534.tmp 1568 85D0.tmp 4740 866C.tmp 2480 8708.tmp 2252 8785.tmp 1260 8822.tmp 4580 88DD.tmp 2404 896A.tmp 1144 89E7.tmp 4700 8A73.tmp 2508 8B00.tmp 2296 8B7D.tmp 1436 8C0A.tmp 1540 8C87.tmp 3788 8D13.tmp 3220 8DBF.tmp 3408 8E6B.tmp 3432 8EF8.tmp 440 8F84.tmp 3164 9030.tmp 5460 90DC.tmp 2132 9159.tmp 1652 91D6.tmp 5060 9253.tmp 6068 92D0.tmp 3224 937C.tmp 1456 9418.tmp 5148 9495.tmp 3928 9512.tmp 4288 95AE.tmp 5248 964B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 937C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A232.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F06C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2816.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D36E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 320E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7517.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F66C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F56D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5396 wrote to memory of 268 5396 2026-08-11_16a6db0c736faaca50b480acb70ca8cc_elex_mafia.exe 89 PID 268 wrote to memory of 5980 268 6B14.tmp 90 PID 5980 wrote to memory of 4228 5980 6BEF.tmp 91 PID 4228 wrote to memory of 4324 4228 6C7C.tmp 92 PID 4324 wrote to memory of 4460 4324 6D66.tmp 93 PID 4460 wrote to memory of 3804 4460 6E12.tmp 94 PID 3804 wrote to memory of 4600 3804 6EED.tmp 95 PID 4600 wrote to memory of 1848 4600 6FE7.tmp 96 PID 1848 wrote to memory of 2424 1848 710F.tmp 97 PID 2424 wrote to memory of 1232 2424 71CB.tmp 98 PID 1232 wrote to memory of 2892 1232 7238.tmp 99 PID 2892 wrote to memory of 2496 2892 7313.tmp 100 PID 2496 wrote to memory of 1768 2496 73DE.tmp 101 PID 1768 wrote to memory of 2804 1768 746B.tmp 102 PID 2804 wrote to memory of 4468 2804 7517.tmp 103 PID 4468 wrote to memory of 1800 4468 75F1.tmp 104 PID 1800 wrote to memory of 4360 1800 76FB.tmp 105 PID 4360 wrote to memory of 2668 4360 7797.tmp 106 PID 2668 wrote to memory of 2088 2668 7824.tmp 107 PID 2088 wrote to memory of 5552 2088 794D.tmp 108 PID 5552 wrote to memory of 2124 5552 7A37.tmp 109 PID 2124 wrote to memory of 2832 2124 7B02.tmp 110 PID 2832 wrote to memory of 6032 2832 7BBE.tmp 111 PID 6032 wrote to memory of 5036 6032 7CA8.tmp 112 PID 5036 wrote to memory of 1932 5036 7D93.tmp 113 PID 1932 wrote to memory of 5988 1932 7E7D.tmp 114 PID 5988 wrote to memory of 4644 5988 7F38.tmp 115 PID 4644 wrote to memory of 3428 4644 8013.tmp 116 PID 3428 wrote to memory of 5816 3428 80BF.tmp 117 PID 5816 wrote to memory of 4528 5816 814C.tmp 118 PID 4528 wrote to memory of 2736 4528 8236.tmp 119 PID 2736 wrote to memory of 2952 2736 82E2.tmp 120 PID 2952 wrote to memory of 5792 2952 83CC.tmp 121 PID 5792 wrote to memory of 996 5792 84A7.tmp 122 PID 996 wrote to memory of 1568 996 8534.tmp 123 PID 1568 wrote to memory of 4740 1568 85D0.tmp 124 PID 4740 wrote to memory of 2480 4740 866C.tmp 125 PID 2480 wrote to memory of 2252 2480 8708.tmp 126 PID 2252 wrote to memory of 1260 2252 8785.tmp 127 PID 1260 wrote to memory of 4580 1260 8822.tmp 128 PID 4580 wrote to memory of 2404 4580 88DD.tmp 129 PID 2404 wrote to memory of 1144 2404 896A.tmp 130 PID 1144 wrote to memory of 4700 1144 89E7.tmp 131 PID 4700 wrote to memory of 2508 4700 8A73.tmp 132 PID 2508 wrote to memory of 2296 2508 8B00.tmp 133 PID 2296 wrote to memory of 1436 2296 8B7D.tmp 134 PID 1436 wrote to memory of 1540 1436 8C0A.tmp 135 PID 1540 wrote to memory of 3788 1540 8C87.tmp 136 PID 3788 wrote to memory of 3220 3788 8D13.tmp 137 PID 3220 wrote to memory of 3408 3220 8DBF.tmp 138 PID 3408 wrote to memory of 3432 3408 8E6B.tmp 139 PID 3432 wrote to memory of 440 3432 8EF8.tmp 140 PID 440 wrote to memory of 3164 440 8F84.tmp 141 PID 3164 wrote to memory of 5460 3164 9030.tmp 142 PID 5460 wrote to memory of 2132 5460 90DC.tmp 143 PID 2132 wrote to memory of 1652 2132 9159.tmp 144 PID 1652 wrote to memory of 5060 1652 91D6.tmp 145 PID 5060 wrote to memory of 6068 5060 9253.tmp 146 PID 6068 wrote to memory of 3224 6068 92D0.tmp 147 PID 3224 wrote to memory of 1456 3224 937C.tmp 148 PID 1456 wrote to memory of 5148 1456 9418.tmp 149 PID 5148 wrote to memory of 3928 5148 9495.tmp 150 PID 3928 wrote to memory of 4288 3928 9512.tmp 151 PID 4288 wrote to memory of 5248 4288 95AE.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_16a6db0c736faaca50b480acb70ca8cc_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_16a6db0c736faaca50b480acb70ca8cc_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\6D66.tmp"C:\Users\Admin\AppData\Local\Temp\6D66.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\6E12.tmp"C:\Users\Admin\AppData\Local\Temp\6E12.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\6EED.tmp"C:\Users\Admin\AppData\Local\Temp\6EED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\710F.tmp"C:\Users\Admin\AppData\Local\Temp\710F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\71CB.tmp"C:\Users\Admin\AppData\Local\Temp\71CB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\7797.tmp"C:\Users\Admin\AppData\Local\Temp\7797.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\7824.tmp"C:\Users\Admin\AppData\Local\Temp\7824.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\794D.tmp"C:\Users\Admin\AppData\Local\Temp\794D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\7B02.tmp"C:\Users\Admin\AppData\Local\Temp\7B02.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\7F38.tmp"C:\Users\Admin\AppData\Local\Temp\7F38.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\8013.tmp"C:\Users\Admin\AppData\Local\Temp\8013.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\83CC.tmp"C:\Users\Admin\AppData\Local\Temp\83CC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\85D0.tmp"C:\Users\Admin\AppData\Local\Temp\85D0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8708.tmp"C:\Users\Admin\AppData\Local\Temp\8708.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\88DD.tmp"C:\Users\Admin\AppData\Local\Temp\88DD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\896A.tmp"C:\Users\Admin\AppData\Local\Temp\896A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\8F84.tmp"C:\Users\Admin\AppData\Local\Temp\8F84.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9030.tmp"C:\Users\Admin\AppData\Local\Temp\9030.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\9253.tmp"C:\Users\Admin\AppData\Local\Temp\9253.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\92D0.tmp"C:\Users\Admin\AppData\Local\Temp\92D0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\937C.tmp"C:\Users\Admin\AppData\Local\Temp\937C.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9495.tmp"C:\Users\Admin\AppData\Local\Temp\9495.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\9512.tmp"C:\Users\Admin\AppData\Local\Temp\9512.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"65⤵
- Executes dropped EXE
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"66⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\9754.tmp"C:\Users\Admin\AppData\Local\Temp\9754.tmp"67⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\97D1.tmp"C:\Users\Admin\AppData\Local\Temp\97D1.tmp"68⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"69⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"70⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"71⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\9A52.tmp"C:\Users\Admin\AppData\Local\Temp\9A52.tmp"72⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"73⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"C:\Users\Admin\AppData\Local\Temp\9B5C.tmp"74⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"75⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\9C65.tmp"C:\Users\Admin\AppData\Local\Temp\9C65.tmp"76⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"77⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"78⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"79⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"80⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"81⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"82⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"83⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"C:\Users\Admin\AppData\Local\Temp\A0E9.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"85⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"87⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"88⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"89⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\A435.tmp"C:\Users\Admin\AppData\Local\Temp\A435.tmp"90⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"92⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"C:\Users\Admin\AppData\Local\Temp\A5EB.tmp"93⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A668.tmp"C:\Users\Admin\AppData\Local\Temp\A668.tmp"94⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"95⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"96⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\A84C.tmp"C:\Users\Admin\AppData\Local\Temp\A84C.tmp"97⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"98⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"99⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\AA30.tmp"C:\Users\Admin\AppData\Local\Temp\AA30.tmp"100⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"101⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"103⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"C:\Users\Admin\AppData\Local\Temp\ACA1.tmp"104⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"C:\Users\Admin\AppData\Local\Temp\AD4D.tmp"105⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"C:\Users\Admin\AppData\Local\Temp\ADDA.tmp"106⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\AE67.tmp"C:\Users\Admin\AppData\Local\Temp\AE67.tmp"107⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"108⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"109⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\B00C.tmp"C:\Users\Admin\AppData\Local\Temp\B00C.tmp"110⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B099.tmp"C:\Users\Admin\AppData\Local\Temp\B099.tmp"111⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B106.tmp"C:\Users\Admin\AppData\Local\Temp\B106.tmp"112⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"113⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"114⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"115⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"116⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"117⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"118⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"119⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"C:\Users\Admin\AppData\Local\Temp\B5BA.tmp"120⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"121⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-