Analysis
- max time kernel
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_bfec5f69c1740f85f6decd3042c1430f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_bfec5f69c1740f85f6decd3042c1430f_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_bfec5f69c1740f85f6decd3042c1430f_elex_mafia.exe
- Size 518KB
- Sample260804-rm7vrasenf
- SHA256 bb3a06b3faede2be6c79c0aad1edc4dbf3f1abe5b22e53a6d3f4278536acb68d
- MD5 bfec5f69c1740f85f6decd3042c1430f
- SHA1 7598f2ff4a1d86381838b4254e943cf92ebfbf1e
- SHA512 74da53173a78a43ced35c5807ddf6e3b3ad94fa038156e09c2a2f1a1e26fca6636992d52833e3073692104f229b8f5cdcbefbdaf8ae482da6272784e54916884
- SSDEEP 12288:Jf1yBOtIZdpH+IKe3iESVLcPmjeWgCSaNESPVRNk+NZ:JfcBzZdcIKi5SVLOF7aNLVbvN
- TLSH T113B4F111B584C136E69302348A56EB92093A7C75AB27A4C7BBC47A7E6FB13C1D378347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3268 BA4D.tmp 1256 BB47.tmp 2256 BC70.tmp 4904 BD6A.tmp 2576 BE45.tmp 4344 BF01.tmp 3116 C01A.tmp 4324 C133.tmp 364 C22D.tmp 5348 C2F8.tmp 4464 C3F2.tmp 3932 C49E.tmp 4796 C569.tmp 6124 C625.tmp 5432 C6FF.tmp 6116 C7DA.tmp 5452 C8B5.tmp 1068 C99F.tmp 4368 CA8A.tmp 3960 CBA3.tmp 3068 CC7E.tmp 5504 CD49.tmp 3248 CE24.tmp 960 CF4C.tmp 2440 D008.tmp 5712 D0F2.tmp 2960 D1CD.tmp 2844 D289.tmp 4252 D373.tmp 992 D48C.tmp 4500 D548.tmp 1004 D603.tmp 5028 D6BF.tmp 4964 D77A.tmp 5556 D845.tmp 1840 D8D2.tmp 1924 D97E.tmp 1204 D9FB.tmp 2372 DA68.tmp 4532 DAF5.tmp 2732 DB72.tmp 3100 DBFE.tmp 4388 DCAA.tmp 5884 DD66.tmp 5988 DE21.tmp 2432 DEDD.tmp 5936 DF5A.tmp 5688 DFE6.tmp 5824 E0B2.tmp 416 E14E.tmp 5640 E209.tmp 2568 E2B5.tmp 4332 E342.tmp 1896 E3CE.tmp 3508 E45B.tmp 2036 E507.tmp 4316 E594.tmp 5840 E611.tmp 1716 E6AD.tmp 2752 E72A.tmp 2540 E7D6.tmp 1320 E8A1.tmp 1176 E94D.tmp 1760 EA08.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3787.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9953.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 362F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 203B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C63.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4984 wrote to memory of 3268 4984 2026-08-04_bfec5f69c1740f85f6decd3042c1430f_elex_mafia.exe 88 PID 3268 wrote to memory of 1256 3268 BA4D.tmp 90 PID 1256 wrote to memory of 2256 1256 BB47.tmp 91 PID 2256 wrote to memory of 4904 2256 BC70.tmp 92 PID 4904 wrote to memory of 2576 4904 BD6A.tmp 93 PID 2576 wrote to memory of 4344 2576 BE45.tmp 94 PID 4344 wrote to memory of 3116 4344 BF01.tmp 95 PID 3116 wrote to memory of 4324 3116 C01A.tmp 96 PID 4324 wrote to memory of 364 4324 C133.tmp 97 PID 364 wrote to memory of 5348 364 C22D.tmp 98 PID 5348 wrote to memory of 4464 5348 C2F8.tmp 99 PID 4464 wrote to memory of 3932 4464 C3F2.tmp 100 PID 3932 wrote to memory of 4796 3932 C49E.tmp 101 PID 4796 wrote to memory of 6124 4796 C569.tmp 102 PID 6124 wrote to memory of 5432 6124 C625.tmp 103 PID 5432 wrote to memory of 6116 5432 C6FF.tmp 104 PID 6116 wrote to memory of 5452 6116 C7DA.tmp 105 PID 5452 wrote to memory of 1068 5452 C8B5.tmp 106 PID 1068 wrote to memory of 4368 1068 C99F.tmp 107 PID 4368 wrote to memory of 3960 4368 CA8A.tmp 108 PID 3960 wrote to memory of 3068 3960 CBA3.tmp 109 PID 3068 wrote to memory of 5504 3068 CC7E.tmp 110 PID 5504 wrote to memory of 3248 5504 CD49.tmp 111 PID 3248 wrote to memory of 960 3248 CE24.tmp 112 PID 960 wrote to memory of 2440 960 CF4C.tmp 113 PID 2440 wrote to memory of 5712 2440 D008.tmp 114 PID 5712 wrote to memory of 2960 5712 D0F2.tmp 115 PID 2960 wrote to memory of 2844 2960 D1CD.tmp 116 PID 2844 wrote to memory of 4252 2844 D289.tmp 117 PID 4252 wrote to memory of 992 4252 D373.tmp 118 PID 992 wrote to memory of 4500 992 D48C.tmp 119 PID 4500 wrote to memory of 1004 4500 D548.tmp 120 PID 1004 wrote to memory of 5028 1004 D603.tmp 121 PID 5028 wrote to memory of 4964 5028 D6BF.tmp 122 PID 4964 wrote to memory of 5556 4964 D77A.tmp 123 PID 5556 wrote to memory of 1840 5556 D845.tmp 124 PID 1840 wrote to memory of 1924 1840 D8D2.tmp 125 PID 1924 wrote to memory of 1204 1924 D97E.tmp 126 PID 1204 wrote to memory of 2372 1204 D9FB.tmp 127 PID 2372 wrote to memory of 4532 2372 DA68.tmp 128 PID 4532 wrote to memory of 2732 4532 DAF5.tmp 129 PID 2732 wrote to memory of 3100 2732 DB72.tmp 130 PID 3100 wrote to memory of 4388 3100 DBFE.tmp 131 PID 4388 wrote to memory of 5884 4388 DCAA.tmp 132 PID 5884 wrote to memory of 5988 5884 DD66.tmp 133 PID 5988 wrote to memory of 2432 5988 DE21.tmp 134 PID 2432 wrote to memory of 5936 2432 DEDD.tmp 135 PID 5936 wrote to memory of 5688 5936 DF5A.tmp 136 PID 5688 wrote to memory of 5824 5688 DFE6.tmp 137 PID 5824 wrote to memory of 416 5824 E0B2.tmp 138 PID 416 wrote to memory of 5640 416 E14E.tmp 139 PID 5640 wrote to memory of 2568 5640 E209.tmp 140 PID 2568 wrote to memory of 4332 2568 E2B5.tmp 141 PID 4332 wrote to memory of 1896 4332 E342.tmp 142 PID 1896 wrote to memory of 3508 1896 E3CE.tmp 143 PID 3508 wrote to memory of 2036 3508 E45B.tmp 144 PID 2036 wrote to memory of 4316 2036 E507.tmp 145 PID 4316 wrote to memory of 5840 4316 E594.tmp 146 PID 5840 wrote to memory of 1716 5840 E611.tmp 147 PID 1716 wrote to memory of 2752 1716 E6AD.tmp 148 PID 2752 wrote to memory of 2540 2752 E72A.tmp 149 PID 2540 wrote to memory of 1320 2540 E7D6.tmp 150 PID 1320 wrote to memory of 1176 1320 E8A1.tmp 151 PID 1176 wrote to memory of 1760 1176 E94D.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_bfec5f69c1740f85f6decd3042c1430f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_bfec5f69c1740f85f6decd3042c1430f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"C:\Users\Admin\AppData\Local\Temp\BD6A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\BE45.tmp"C:\Users\Admin\AppData\Local\Temp\BE45.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\BF01.tmp"C:\Users\Admin\AppData\Local\Temp\BF01.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\C01A.tmp"C:\Users\Admin\AppData\Local\Temp\C01A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\C22D.tmp"C:\Users\Admin\AppData\Local\Temp\C22D.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"C:\Users\Admin\AppData\Local\Temp\C3F2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C625.tmp"C:\Users\Admin\AppData\Local\Temp\C625.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"C:\Users\Admin\AppData\Local\Temp\C7DA.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"C:\Users\Admin\AppData\Local\Temp\C8B5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"C:\Users\Admin\AppData\Local\Temp\CBA3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\CD49.tmp"C:\Users\Admin\AppData\Local\Temp\CD49.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"C:\Users\Admin\AppData\Local\Temp\CF4C.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\D008.tmp"C:\Users\Admin\AppData\Local\Temp\D008.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\D373.tmp"C:\Users\Admin\AppData\Local\Temp\D373.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\D48C.tmp"C:\Users\Admin\AppData\Local\Temp\D48C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\D603.tmp"C:\Users\Admin\AppData\Local\Temp\D603.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\D77A.tmp"C:\Users\Admin\AppData\Local\Temp\D77A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"C:\Users\Admin\AppData\Local\Temp\DAF5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\DB72.tmp"C:\Users\Admin\AppData\Local\Temp\DB72.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\DE21.tmp"C:\Users\Admin\AppData\Local\Temp\DE21.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\E594.tmp"C:\Users\Admin\AppData\Local\Temp\E594.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\E72A.tmp"C:\Users\Admin\AppData\Local\Temp\E72A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\EA08.tmp"C:\Users\Admin\AppData\Local\Temp\EA08.tmp"65⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"66⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\EB21.tmp"C:\Users\Admin\AppData\Local\Temp\EB21.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"68⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"C:\Users\Admin\AppData\Local\Temp\EC3B.tmp"69⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\ECB8.tmp"C:\Users\Admin\AppData\Local\Temp\ECB8.tmp"70⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"71⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"72⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"73⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"74⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"75⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"76⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\F061.tmp"C:\Users\Admin\AppData\Local\Temp\F061.tmp"77⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"78⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\F17A.tmp"C:\Users\Admin\AppData\Local\Temp\F17A.tmp"79⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"80⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"81⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"82⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"83⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\F42A.tmp"C:\Users\Admin\AppData\Local\Temp\F42A.tmp"84⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\F497.tmp"C:\Users\Admin\AppData\Local\Temp\F497.tmp"85⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\F534.tmp"C:\Users\Admin\AppData\Local\Temp\F534.tmp"86⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"87⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"88⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\F69B.tmp"C:\Users\Admin\AppData\Local\Temp\F69B.tmp"89⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"90⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"91⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\F822.tmp"C:\Users\Admin\AppData\Local\Temp\F822.tmp"92⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\F88F.tmp"C:\Users\Admin\AppData\Local\Temp\F88F.tmp"93⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"94⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"95⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\FA64.tmp"C:\Users\Admin\AppData\Local\Temp\FA64.tmp"96⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\FB00.tmp"C:\Users\Admin\AppData\Local\Temp\FB00.tmp"97⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"98⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"99⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"C:\Users\Admin\AppData\Local\Temp\FCC5.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\FD42.tmp"C:\Users\Admin\AppData\Local\Temp\FD42.tmp"101⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"102⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"103⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"104⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"105⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\BD.tmp"C:\Users\Admin\AppData\Local\Temp\BD.tmp"107⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"108⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"109⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"110⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"111⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\3DA.tmp"C:\Users\Admin\AppData\Local\Temp\3DA.tmp"112⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\466.tmp"C:\Users\Admin\AppData\Local\Temp\466.tmp"113⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"115⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"116⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6B8.tmp"C:\Users\Admin\AppData\Local\Temp\6B8.tmp"117⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"118⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"119⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\87D.tmp"C:\Users\Admin\AppData\Local\Temp\87D.tmp"120⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"121⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\996.tmp"C:\Users\Admin\AppData\Local\Temp\996.tmp"122⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-