Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 06:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_582a574d05e1b50e8e7ed0e762ec55e2_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_582a574d05e1b50e8e7ed0e762ec55e2_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_582a574d05e1b50e8e7ed0e762ec55e2_elex_mafia.exe
- Size 561KB
- Sample260805-grflysbk91
- SHA256 c126f84047c789f22d8afdc0783cfd74e9be724c9bad0b09274197b038dd25da
- MD5 582a574d05e1b50e8e7ed0e762ec55e2
- SHA1 dfed1e86e0109b15ee6e6ab3ac370b41106443fe
- SHA512 3fbfe3f8d7dce276cc19ab8b55e9020f4825f0d2889183b0668c27bded001be2940ecb089477ec0ec55a3f1e9439be0e23bae63fb252d54ec7392a99b6a61546
- SSDEEP 12288:VuelPWET0yhP/5RHvYjzhvVsJJJ5CoWuft7fCuDZuL:8eEEvhX5VYjz7+dzWuft7fCuDoL
- TLSH T1E8C4DF15B6C8C836F1F31A344AF49762497BBC619B35E8CB2788266D1FB12D0E639713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4740 A89F.tmp 3268 A95A.tmp 2528 A9F7.tmp 1720 AB00.tmp 3480 AB9D.tmp 1820 AC29.tmp 2124 ACD5.tmp 4372 AD52.tmp 456 AE0E.tmp 892 AE9A.tmp 904 AF75.tmp 3564 B021.tmp 1132 B0EC.tmp 2440 B188.tmp 2100 B234.tmp 3252 B2D0.tmp 4836 B38C.tmp 4760 B447.tmp 2184 B4D4.tmp 4868 B570.tmp 3104 B61C.tmp 4988 B699.tmp 2376 B735.tmp 3108 B810.tmp 3580 B8AC.tmp 116 B977.tmp 4056 BA52.tmp 1764 BADF.tmp 4476 BB5C.tmp 1268 BBD9.tmp 3704 BC65.tmp 2192 BCD3.tmp 744 BD8E.tmp 3732 BE3A.tmp 4696 BE88.tmp 4828 BF05.tmp 2400 BF53.tmp 1680 BFA2.tmp 1904 BFFF.tmp 5040 C05D.tmp 1180 C0AB.tmp 2504 C109.tmp 928 C176.tmp 996 C1D4.tmp 4120 C232.tmp 3400 C290.tmp 1808 C2DE.tmp 1540 C34B.tmp 4480 C416.tmp 4880 C474.tmp 840 C4E1.tmp 4484 C52F.tmp 2096 C58D.tmp 2568 C5DB.tmp 4808 C649.tmp 4816 C6B6.tmp 4904 C723.tmp 4260 C791.tmp 4564 C7DF.tmp 2632 C83D.tmp 3888 C89A.tmp 2004 C8E9.tmp 2424 C937.tmp 1544 C985.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B38C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 454C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E52B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CADD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3396 wrote to memory of 4740 3396 2026-08-05_582a574d05e1b50e8e7ed0e762ec55e2_elex_mafia.exe 86 PID 4740 wrote to memory of 3268 4740 A89F.tmp 87 PID 3268 wrote to memory of 2528 3268 A95A.tmp 88 PID 2528 wrote to memory of 1720 2528 A9F7.tmp 89 PID 1720 wrote to memory of 3480 1720 AB00.tmp 90 PID 3480 wrote to memory of 1820 3480 AB9D.tmp 91 PID 1820 wrote to memory of 2124 1820 AC29.tmp 92 PID 2124 wrote to memory of 4372 2124 ACD5.tmp 93 PID 4372 wrote to memory of 456 4372 AD52.tmp 94 PID 456 wrote to memory of 892 456 AE0E.tmp 95 PID 892 wrote to memory of 904 892 AE9A.tmp 96 PID 904 wrote to memory of 3564 904 AF75.tmp 97 PID 3564 wrote to memory of 1132 3564 B021.tmp 98 PID 1132 wrote to memory of 2440 1132 B0EC.tmp 99 PID 2440 wrote to memory of 2100 2440 B188.tmp 100 PID 2100 wrote to memory of 3252 2100 B234.tmp 101 PID 3252 wrote to memory of 4836 3252 B2D0.tmp 102 PID 4836 wrote to memory of 4760 4836 B38C.tmp 103 PID 4760 wrote to memory of 2184 4760 B447.tmp 104 PID 2184 wrote to memory of 4868 2184 B4D4.tmp 105 PID 4868 wrote to memory of 3104 4868 B570.tmp 106 PID 3104 wrote to memory of 4988 3104 B61C.tmp 107 PID 4988 wrote to memory of 2376 4988 B699.tmp 108 PID 2376 wrote to memory of 3108 2376 B735.tmp 109 PID 3108 wrote to memory of 3580 3108 B810.tmp 110 PID 3580 wrote to memory of 116 3580 B8AC.tmp 111 PID 116 wrote to memory of 4056 116 B977.tmp 112 PID 4056 wrote to memory of 1764 4056 BA52.tmp 113 PID 1764 wrote to memory of 4476 1764 BADF.tmp 114 PID 4476 wrote to memory of 1268 4476 BB5C.tmp 115 PID 1268 wrote to memory of 3704 1268 BBD9.tmp 116 PID 3704 wrote to memory of 2192 3704 BC65.tmp 117 PID 2192 wrote to memory of 744 2192 BCD3.tmp 118 PID 744 wrote to memory of 3732 744 BD8E.tmp 119 PID 3732 wrote to memory of 4696 3732 BE3A.tmp 120 PID 4696 wrote to memory of 4828 4696 BE88.tmp 121 PID 4828 wrote to memory of 2400 4828 BF05.tmp 122 PID 2400 wrote to memory of 1680 2400 BF53.tmp 123 PID 1680 wrote to memory of 1904 1680 BFA2.tmp 124 PID 1904 wrote to memory of 5040 1904 BFFF.tmp 125 PID 5040 wrote to memory of 1180 5040 C05D.tmp 126 PID 1180 wrote to memory of 2504 1180 C0AB.tmp 127 PID 2504 wrote to memory of 928 2504 C109.tmp 128 PID 928 wrote to memory of 996 928 C176.tmp 129 PID 996 wrote to memory of 4120 996 C1D4.tmp 130 PID 4120 wrote to memory of 3400 4120 C232.tmp 131 PID 3400 wrote to memory of 1808 3400 C290.tmp 132 PID 1808 wrote to memory of 1540 1808 C2DE.tmp 133 PID 1540 wrote to memory of 4480 1540 C34B.tmp 134 PID 4480 wrote to memory of 4880 4480 C416.tmp 135 PID 4880 wrote to memory of 840 4880 C474.tmp 136 PID 840 wrote to memory of 4484 840 C4E1.tmp 137 PID 4484 wrote to memory of 2096 4484 C52F.tmp 138 PID 2096 wrote to memory of 2568 2096 C58D.tmp 139 PID 2568 wrote to memory of 4808 2568 C5DB.tmp 140 PID 4808 wrote to memory of 4816 4808 C649.tmp 141 PID 4816 wrote to memory of 4904 4816 C6B6.tmp 142 PID 4904 wrote to memory of 4260 4904 C723.tmp 143 PID 4260 wrote to memory of 4564 4260 C791.tmp 144 PID 4564 wrote to memory of 2632 4564 C7DF.tmp 145 PID 2632 wrote to memory of 3888 2632 C83D.tmp 146 PID 3888 wrote to memory of 2004 3888 C89A.tmp 147 PID 2004 wrote to memory of 2424 2004 C8E9.tmp 148 PID 2424 wrote to memory of 1544 2424 C937.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_582a574d05e1b50e8e7ed0e762ec55e2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_582a574d05e1b50e8e7ed0e762ec55e2_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\A89F.tmp"C:\Users\Admin\AppData\Local\Temp\A89F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\A95A.tmp"C:\Users\Admin\AppData\Local\Temp\A95A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A9F7.tmp"C:\Users\Admin\AppData\Local\Temp\A9F7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\AB00.tmp"C:\Users\Admin\AppData\Local\Temp\AB00.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\B021.tmp"C:\Users\Admin\AppData\Local\Temp\B021.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"C:\Users\Admin\AppData\Local\Temp\B0EC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\B234.tmp"C:\Users\Admin\AppData\Local\Temp\B234.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\B38C.tmp"C:\Users\Admin\AppData\Local\Temp\B38C.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\B447.tmp"C:\Users\Admin\AppData\Local\Temp\B447.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\B699.tmp"C:\Users\Admin\AppData\Local\Temp\B699.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\B735.tmp"C:\Users\Admin\AppData\Local\Temp\B735.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\B810.tmp"C:\Users\Admin\AppData\Local\Temp\B810.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"C:\Users\Admin\AppData\Local\Temp\BBD9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\BF05.tmp"C:\Users\Admin\AppData\Local\Temp\BF05.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\BF53.tmp"C:\Users\Admin\AppData\Local\Temp\BF53.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\C05D.tmp"C:\Users\Admin\AppData\Local\Temp\C05D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\C232.tmp"C:\Users\Admin\AppData\Local\Temp\C232.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\C474.tmp"C:\Users\Admin\AppData\Local\Temp\C474.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\C52F.tmp"C:\Users\Admin\AppData\Local\Temp\C52F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\C58D.tmp"C:\Users\Admin\AppData\Local\Temp\C58D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\C791.tmp"C:\Users\Admin\AppData\Local\Temp\C791.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C937.tmp"C:\Users\Admin\AppData\Local\Temp\C937.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C985.tmp"C:\Users\Admin\AppData\Local\Temp\C985.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"66⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"C:\Users\Admin\AppData\Local\Temp\CA8E.tmp"68⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"70⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"71⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"72⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"74⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:460 -
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"76⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\CDEA.tmp"C:\Users\Admin\AppData\Local\Temp\CDEA.tmp"77⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\CE38.tmp"C:\Users\Admin\AppData\Local\Temp\CE38.tmp"78⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"79⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"80⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\CF61.tmp"C:\Users\Admin\AppData\Local\Temp\CF61.tmp"81⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"C:\Users\Admin\AppData\Local\Temp\CFDE.tmp"82⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"83⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\D0C8.tmp"C:\Users\Admin\AppData\Local\Temp\D0C8.tmp"84⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"85⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D174.tmp"C:\Users\Admin\AppData\Local\Temp\D174.tmp"86⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"87⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"88⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\D29D.tmp"C:\Users\Admin\AppData\Local\Temp\D29D.tmp"89⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"90⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"91⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"92⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\D404.tmp"C:\Users\Admin\AppData\Local\Temp\D404.tmp"93⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"94⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"95⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"97⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"98⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"99⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\D695.tmp"C:\Users\Admin\AppData\Local\Temp\D695.tmp"100⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"101⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\D750.tmp"C:\Users\Admin\AppData\Local\Temp\D750.tmp"102⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"103⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"104⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"105⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"106⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"107⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"108⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"109⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\DABB.tmp"C:\Users\Admin\AppData\Local\Temp\DABB.tmp"110⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\DB09.tmp"C:\Users\Admin\AppData\Local\Temp\DB09.tmp"111⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\DB57.tmp"C:\Users\Admin\AppData\Local\Temp\DB57.tmp"112⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"113⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"115⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"116⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"117⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"118⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\DDD8.tmp"C:\Users\Admin\AppData\Local\Temp\DDD8.tmp"119⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"120⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"121⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\DF10.tmp"C:\Users\Admin\AppData\Local\Temp\DF10.tmp"122⤵PID:4924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-